<html><head></head><body><div>I need to upgrade from IPA3.0 to IPA4.2 (from centos 6.7 to 7.2) and the replica process is failing to install on the new system:</div><div><br></div><div>2016-01-13T17:27:46Z DEBUG Starting external process</div><div>2016-01-13T17:27:46Z DEBUG args='/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpjklK4o'</div><div>2016-01-13T17:28:19Z DEBUG Process finished, return code=1</div><div>2016-01-13T17:28:19Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.20160113122746.log</div><div>Loading deployment configuration from /tmp/tmpjklK4o.</div><div>Installing CA into /var/lib/pki/pki-tomcat.</div><div>Storing deployment configuration into /etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg.</div><div><br></div><div>Installation failed.</div><div><br></div><div><br></div><div>2016-01-13T17:28:19Z DEBUG stderr=/usr/lib/python2.7/site-packages/urllib3/connectionpool.py:769: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certifi</div><div>cate verification is strongly advised. See: <a href="https://urllib3.readthedocs.org/en/latest/security.html">https://urllib3.readthedocs.org/en/latest/security.html</a></div><div> InsecureRequestWarning)</div><div>pkispawn : WARNING ....... unable to validate security domain user/password through REST interface. Interface not available</div><div>pkispawn : ERROR ....... Exception from Java Configuration Servlet: 500 Server Error: Internal Server Error</div><div>pkispawn : ERROR ....... ParseError: not well-formed (invalid token): line 1, column 0: {"Attributes":{"Attribute":[]},"ClassName":"com.netscape.certsrv.base.PKIException</div><div>","Code":500,"Message":"Clone does not have all the required certificates"} </div><div><br></div><div>2016-01-13T17:28:19Z CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpjklK4o'' returned non-zero exit status 1</div><div>2016-01-13T17:28:19Z CRITICAL See the installation logs and the following files/directories for more information:</div><div>2016-01-13T17:28:19Z CRITICAL /var/log/pki-ca-install.log</div><div>2016-01-13T17:28:19Z CRITICAL /var/log/pki/pki-tomcat</div><div>2016-01-13T17:28:19Z DEBUG Traceback (most recent call last):</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 418, in start_creation</div><div> run_step(full_msg, method)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 408, in run_step</div><div> method()</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 620, in __spawn_instance</div><div> DogtagInstance.spawn_instance(self, cfg_file)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 201, in spawn_instance</div><div> self.handle_setup_error(e)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 465, in handle_setup_error</div><div> raise RuntimeError("%s configuration failed." % self.subsystem)</div><div>RuntimeError: CA configuration failed.</div><div><br></div><div>2016-01-13T17:28:19Z DEBUG [error] RuntimeError: CA configuration failed.</div><div>2016-01-13T17:28:19Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute</div><div> return_value = self.run()</div><div> File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 311, in run</div><div class="-x-evo-signature-wrapper"><span><br></span></div><div class="-x-evo-signature-wrapper"><span><br></span></div><div class="-x-evo-signature-wrapper"><span><br></span></div><div class="-x-evo-signature-wrapper"><span>It looks to me that the original, first install version 3.0 system is generating a bad gpg file. Will a reinstall of the orginal cert file solve this? If so, where and what is the best procedure? Is there a way to add CA capability to an existing master replicant by reusing it's original replica.gpg file?</span></div><div class="-x-evo-signature-wrapper"><span><br></span></div><div class="-x-evo-signature-wrapper"><span>Background: the old v3.0 system runs on a virtual machine (ovirt). The physical host had a series of "bad days" that involved multiple crashes and lock-ups that were ultimately attributed to insufficient cooling of the RAID card. It is suspected that the data was scrambled on the drive. The original cert is backed up but the remaining machine backups are of dubious quality (long story - bad week at the datacenter).</span></div><div class="-x-evo-signature-wrapper"><span><br></span></div><div class="-x-evo-signature-wrapper"><span>This is the last system on old hardware that was hit when the datacenter cooling totally failed and erased all the backups. Some days your're the pigeon, some days you're the statue.</span></div><div class="-x-evo-signature-wrapper"><span><br></span></div><div class="-x-evo-signature-wrapper"><span><br></span></div><div class="-x-evo-signature-wrapper"><span>-- </span></div><div class="-x-evo-signature-wrapper"><span><br></span></div><div class="-x-evo-signature-wrapper"><span><br></span></div><div class="-x-evo-signature-wrapper"><span><br>
<meta http-equiv="Content-Type" content="text/html; CHARSET=UTF-8">
<meta name="GENERATOR" content="GtkHTML/4.8.5">
Jim Kinney<br>
Senior System Administrator<br>
36 Eagle Row Suite 588<br>
Department of Biomedical Informatics<br>
Emory University School of Medicine<br>
jkinney@emory.edu<br>
404-712-0300
</span></div></body></html>