<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Title" content=""> <meta name="Keywords" content=""> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Hi Sebastian,<o:p></o:p> Unfortunately, that doesn't seem to be it and reinstalling the replica with —setup-ca failed again with the same errors. I've included relevant sections of the logs.<o:p></o:p> <o:p> </o:p> /var/log/ipareplica-install.log:<o:p></o:p> <o:p> </o:p> 016-06-02T10:43:16Z DEBUG Starting external process<o:p></o:p> 2016-06-02T10:43:16Z DEBUG args='/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpl8RqSM'<o:p></o:p> 2016-06-02T10:43:16Z DEBUG Process finished, return code=1<o:p></o:p> 2016-06-02T10:43:16Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.20160602064316.log<o:p></o:p> Loading deployment configuration from /tmp/tmpl8RqSM.<o:p></o:p> <o:p> </o:p> 2016-06-02T10:43:16Z DEBUG stderr=Traceback (most recent call last):<o:p></o:p> File "/usr/sbin/pkispawn", line 717, in <module><o:p></o:p> main(sys.argv)<o:p></o:p> File "/usr/sbin/pkispawn", line 523, in main<o:p></o:p> parser.compose_pki_master_dictionary()<o:p></o:p> File "/usr/lib/python2.7/site-packages/pki/server/deployment/pkiparser.py", line 573, in compose_pki_master_dictionary<o:p></o:p> instance.load()<o:p></o:p> File "/usr/lib/python2.7/site-packages/pki/server/__init__.py", line 454, in load<o:p></o:p> subsystem.load()<o:p></o:p> File "/usr/lib/python2.7/site-packages/pki/server/__init__.py", line 118, in load<o:p></o:p> lines = open(self.cs_conf).read().splitlines()<o:p></o:p> IOError: [Errno 2] No such file or directory: '/var/lib/pki/pki-tomcat/ca/conf/CS.cfg'<o:p></o:p> <o:p> </o:p> 2016-06-02T10:43:16Z CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpl8RqSM'' returned non-zero exit status 1<o:p></o:p> 2016-06-02T10:43:16Z CRITICAL See the installation logs and the following files/directories for more information:<o:p></o:p> 2016-06-02T10:43:16Z CRITICAL /var/log/pki-ca-install.log<o:p></o:p> 2016-06-02T10:43:16Z CRITICAL /var/log/pki/pki-tomcat<o:p></o:p> 2016-06-02T10:43:16Z DEBUG Traceback (most recent call last):<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 418, in start_creation<o:p></o:p> run_step(full_msg, method)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 408, in run_step<o:p></o:p> method()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 620, in __spawn_instance<o:p></o:p> DogtagInstance.spawn_instance(self, cfg_file)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 201, in spawn_instance<o:p></o:p> self.handle_setup_error(e)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 465, in handle_setup_error<o:p></o:p> <o:p> </o:p> raise RuntimeError("%s configuration failed." % self.subsystem)<o:p></o:p> RuntimeError: CA configuration failed.<o:p></o:p> <o:p> </o:p> 2016-06-02T10:43:16Z DEBUG [error] RuntimeError: CA configuration failed.<o:p></o:p> 2016-06-02T10:43:16Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute<o:p></o:p> return_value = self.run()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 311, in run<o:p></o:p> cfgr.run()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 281, in run<o:p></o:p> self.execute()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 303, in execute<o:p></o:p> for nothing in self._executor():<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 343, in __runner<o:p></o:p> self._handle_exception(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 365, in _handle_exception<o:p></o:p> util.raise_exc_info(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 333, in __runner<o:p></o:p> step()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 87, in run_generator_with_yield_from<o:p></o:p> <o:p> </o:p> raise_exc_info(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 65, in run_generator_with_yield_from<o:p></o:p> <o:p> </o:p> value = gen.send(prev_value)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 524, in _configure<o:p></o:p> executor.next()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 343, in __runner<o:p></o:p> self._handle_exception(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in _handle_exception<o:p></o:p> self.__parent._handle_exception(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 365, in _handle_exception<o:p></o:p> util.raise_exc_info(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in _handle_exception<o:p></o:p> super(ComponentBase, self)._handle_exception(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 365, in _handle_exception<o:p></o:p> util.raise_exc_info(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 333, in __runner<o:p></o:p> step()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 87, in run_generator_with_yield_from<o:p></o:p> <o:p> </o:p> raise_exc_info(exc_info)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 65, in run_generator_with_yield_from<o:p></o:p> <o:p> </o:p> value = gen.send(prev_value)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install<o:p></o:p> for nothing in self._installer(self.parent):<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 879, in main<o:p></o:p> install(self)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 295, in decorated<o:p></o:p> func(installer)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 584, in install<o:p></o:p> ca.install(False, config, options)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 106, in install<o:p></o:p> install_step_0(standalone, replica_config, options)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 130, in install_step_0<o:p></o:p> ra_p12=getattr(options, 'ra_p12', None))<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1543, in install_replica_ca<o:p></o:p> subject_base=config.subject_base)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 486, in configure_instance<o:p></o:p> self.start_creation(runtime=210)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 418, in start_creation<o:p></o:p> run_step(full_msg, method)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 408, in run_step<o:p></o:p> method()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 620, in __spawn_instance<o:p></o:p> DogtagInstance.spawn_instance(self, cfg_file)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 201, in spawn_instance<o:p></o:p> self.handle_setup_error(e)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 465, in handle_setup_error<o:p></o:p> <o:p> </o:p> raise RuntimeError("%s configuration failed." % self.subsystem)<o:p></o:p> <o:p> </o:p> 2016-06-02T10:43:16Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: CA configuration failed.<o:p></o:p> 2016-06-02T10:43:16Z ERROR CA configuration failed.<o:p></o:p> <o:p> </o:p> Of note, there is no /var/log/pki-ca-install.log file nor (as the error above shows) is there /var/lib/pki/pki-tomcat/ca/conf/CS.cfg.<o:p></o:p> <o:p> </o:p> Best regards,<o:p></o:p> Dan<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> <div> <a href="http://www.high5games.com/"><img border="0" width="220" height="50" id="Picture_x0020_1" src="cid:image001.jpg@01D1BC9B.51C5B800" alt="cid:image001.jpg@01D1BC9A.CBB33580"></a><o:p></o:p> Daniel Alex Finkelstein| Senior Dev Ops Engineer<o:p></o:p> <a href="mailto:Dan.Finkelstein@h5g.com">Dan.Finkelstein@h5g.com</a> | 212.604.3447<o:p></o:p> One World Trade Center, New York, NY 10007<o:p></o:p> <a href="http://www.high5games.com/">www.high5games.com</a><o:p></o:p> Play <a href="https://apps.facebook.com/highfivecasino/">High 5 Casino</a> and <a href="https://apps.facebook.com/shakethesky/">Shake the Sky</a><o:p></o:p> Follow us on: <a href="http://www.facebook.com/high5games">Facebook</a>, <a href="https://twitter.com/High5Games">Twitter</a>, <a href="http://www.youtube.com/High5Games">YouTube</a>, <a href="http://www.linkedin.com/company/1072533?trk=tyah">Linkedin</a><o:p></o:p> <o:p> </o:p> </div> This message and any attachments may contain confidential or privileged information and are only for the use of the intended recipient of this message. If you are not the intended recipient, please notify the sender by return email, and delete or destroy this and all copies of this message and all attachments. Any unauthorized disclosure, use, distribution, or reproduction of this message or any attachments is prohibited and may be unlawful.<o:p></o:p> <o:p> </o:p> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Sebastian Schäfer <sebastian.schaefer@dlr.de> Date: Thursday, June 2, 2016 at 02:59 To: "freeipa-users@redhat.com" <freeipa-users@redhat.com>, Daniel Finkestein <Dan.Finkelstein@high5games.com> Subject: Re: [Freeipa-users] FreeIPA 4.2.0 on CentOS 7.2 as replica of FreeIPA 3.0.0 on CentOS 6.8; cannot install CA components as replica, cannot promote to master<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> <div> <div> Hi Dan,<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> I had a similar problem when updating my FreeIPA. In my case it turned<o:p></o:p> </div> <div> out that the certificates that get bundled with the replica preparation<o:p></o:p> </div> <div> file were expired. This is due to the /root/cacert.p12 file not being<o:p></o:p> </div> <div> updated during the preparation process until FreeIPA 3.2.2<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> The file can be recreated with the commands from step 2 of<o:p></o:p> </div> <div> <a href="http://www.freeipa.org/page/Howto/Change_Directory_Manager_Password">http://www.freeipa.org/page/Howto/Change_Directory_Manager_Password</a><o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> If that does not solve the problem, it would be good to see (part of)<o:p></o:p> </div> <div> the actual logfiles of your replica installation attempt.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Best regards<o:p></o:p> </div> <div> --<o:p></o:p> </div> <div> Sebastian Schäfer, M. A.<o:p></o:p> </div> <div> -------------------------------<o:p></o:p> </div> <div> Deutsches Zentrum für Luft- und Raumfahrt e.V. (DLR)<o:p></o:p> </div> <div> Institute of Space Operations and Astronaut Training<o:p></o:p> </div> <div> Microgravity User Support Center (MUSC)<o:p></o:p> </div> <div> Linder Höhe | 51147 Köln<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Telefon 02203 601-30 01 | Telefax: 02203 61471 | <a href="mailto:sebastian.schaefer@dlr.de"> sebastian.schaefer@dlr.de</a><o:p></o:p> </div> <div> www.DLR.de<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> On 06/01/2016 06:45 PM, <a href="mailto:Dan.Finkelstein@high5games.com"> Dan.Finkelstein@high5games.com</a> wrote:<o:p></o:p> </div> <blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"> <div> Hi folks,<o:p></o:p> </div> <div> As the subject suggests, we're converting from FreeIPA 3.0.0 on CentOS 6<o:p></o:p> </div> <div> to 4.2.0 on CentOS 7. The way we're doing it is to create FreeIPA<o:p></o:p> </div> <div> replicas in CentOS 7 and then hope to promote one of them to the CA<o:p></o:p> </div> <div> master. I'm running into two problems:<o:p></o:p> </div> <div> <o:p></o:p> </div> <div> The first is that when we create a replica in FreeIPA 4.2.0 with the<o:p></o:p> </div> <div> —setup-ca option, that portion fails. Here's a snippet of the output:<o:p></o:p> </div> <div> Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes<o:p></o:p> </div> <div> 30 seconds<o:p></o:p> </div> <div> [1/23]: creating certificate server user<o:p></o:p> </div> <div> [2/23]: configuring certificate server instance<o:p></o:p> </div> <div> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to<o:p></o:p> </div> <div> configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f'<o:p></o:p> </div> <div> '/tmp/tmpqPeYOW'' returned non-zero exit status 1<o:p></o:p> </div> <div> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the<o:p></o:p> </div> <div> installation logs and the following files/directories for more information:<o:p></o:p> </div> <div> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL <o:p></o:p> </div> <div> /var/log/pki-ca-install.log<o:p></o:p> </div> <div> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL <o:p></o:p> </div> <div> /var/log/pki/pki-tomcat<o:p></o:p> </div> <div> [error] RuntimeError: CA configuration failed.<o:p></o:p> </div> <div> Your system may be partly configured.<o:p></o:p> </div> <div> Run /usr/sbin/ipa-server-install --uninstall to clean up.<o:p></o:p> </div> </blockquote> <div> <o:p> </o:p> </div> </div> </div> </div> </body> </html>