<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Title" content=""> <meta name="Keywords" content=""> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Thanks for the clarification. I tried again, but no luck. The stdout/err was:<o:p></o:p> <o:p> </o:p> [root@ipa ~]# ipa-ca-install /var/lib/ipa/replica-info-ipa.example.com.local.gpg<o:p></o:p> Directory Manager (existing master) password:<o:p></o:p> <o:p> </o:p> Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds<o:p></o:p> [1/21]: creating certificate server user<o:p></o:p> [2/21]: configuring certificate server instance<o:p></o:p> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpD3cjWu'' returned non-zero exit status 1<o:p></o:p> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:<o:p></o:p> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki-ca-install.log<o:p></o:p> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat<o:p></o:p> [error] RuntimeError: CA configuration failed.<o:p></o:p> <o:p> </o:p> Your system may be partly configured.<o:p></o:p> Run /usr/sbin/ipa-server-install --uninstall to clean up.<o:p></o:p> <o:p> </o:p> CA configuration failed.<o:p></o:p> <o:p> </o:p> And the ipareplica-ca-install.log is:<o:p></o:p> <o:p> </o:p> [root@ipa log]# cat ipareplica-ca-install.log<o:p></o:p> 2016-06-06T17:59:37Z DEBUG /sbin/ipa-ca-install was invoked with argument "/var/lib/ipa/replica-info-ipa.example.com.local.gpg" and options: {'external_cert_files': None, 'skip_schema_check': False, 'external_ca_type': None, 'unattended': False, 'no_host_dns': False, 'ca_signing_algorithm': None, 'debug': False, 'external_ca': False, 'skip_conncheck': False}<o:p></o:p> 2016-06-06T17:59:37Z DEBUG IPA version 4.2.0-15.0.1.el7.centos.6.1<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing all plugin modules in ipalib.plugins...<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.aci<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.automember<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.automount<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.baseldap<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.baseuser<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.batch<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.caacl<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.cert<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.certprofile<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.config<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.delegation<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.dns<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.domainlevel<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.group<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.hbacrule<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.hbacsvc<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.hbacsvcgroup<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.hbactest<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.host<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.hostgroup<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.idrange<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.idviews<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.internal<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.kerberos<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.krbtpolicy<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.migration<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.misc<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.netgroup<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.otpconfig<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.otptoken<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.otptoken_yubikey<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.passwd<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.permission<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.ping<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.pkinit<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.privilege<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.pwpolicy<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Starting external process<o:p></o:p> 2016-06-06T17:59:37Z DEBUG args='klist' '-V'<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Process finished, return code=0<o:p></o:p> 2016-06-06T17:59:37Z DEBUG stdout=Kerberos 5 version 1.13.2<o:p></o:p> <o:p> </o:p> 2016-06-06T17:59:37Z DEBUG stderr=<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.radiusproxy<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.realmdomains<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.role<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.rpcclient<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.selfservice<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.selinuxusermap<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.server<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.service<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.servicedelegation<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.session<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.stageuser<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.sudocmd<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.sudocmdgroup<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.sudorule<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.topology<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.trust<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.user<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.vault<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipalib.plugins.virtual<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing all plugin modules in ipaserver.plugins...<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipaserver.plugins.dogtag<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipaserver.plugins.join<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipaserver.plugins.ldap2<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipaserver.plugins.rabase<o:p></o:p> 2016-06-06T17:59:37Z DEBUG importing plugin module ipaserver.plugins.xmlserver<o:p></o:p> 2016-06-06T17:59:37Z DEBUG SessionAuthManager.register: name=jsonserver_session_42663248<o:p></o:p> 2016-06-06T17:59:37Z DEBUG SessionAuthManager.register: name=xmlserver_session_42686160<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Mounting ipaserver.rpcserver.jsonserver_session() at '/session/json'<o:p></o:p> 2016-06-06T17:59:37Z DEBUG session_auth_duration: 0:20:00<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Mounting ipaserver.rpcserver.jsonserver_kerb() at '/json'<o:p></o:p> 2016-06-06T17:59:37Z DEBUG session_auth_duration: 0:20:00<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Mounting ipaserver.rpcserver.login_password() at '/session/login_password'<o:p></o:p> 2016-06-06T17:59:37Z DEBUG session_auth_duration: 0:20:00<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Mounting ipaserver.rpcserver.change_password() at '/session/change_password'<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Mounting ipaserver.rpcserver.xmlserver_session() at '/session/xml'<o:p></o:p> 2016-06-06T17:59:37Z DEBUG session_auth_duration: 0:20:00<o:p></o:p> 2016-06-06T17:59:37Z DEBUG session_auth_duration: 0:20:00<o:p></o:p> 2016-06-06T17:59:37Z DEBUG Mounting ipaserver.rpcserver.sync_token() at '/session/sync_token'<o:p></o:p> 2016-06-06T17:59:38Z DEBUG Mounting ipaserver.rpcserver.login_kerberos() at '/session/login_kerberos'<o:p></o:p> 2016-06-06T17:59:38Z DEBUG session_auth_duration: 0:20:00<o:p></o:p> 2016-06-06T17:59:38Z DEBUG Mounting ipaserver.rpcserver.xmlserver() at '/xml'<o:p></o:p> 2016-06-06T17:59:38Z DEBUG session_auth_duration: 0:20:00<o:p></o:p> 2016-06-06T17:59:40Z DEBUG Starting external process<o:p></o:p> 2016-06-06T17:59:40Z DEBUG args='/usr/bin/gpg-agent' '--batch' '--homedir' '/tmp/tmpm9cf7Xipa/ipa-cLLKJh/.gnupg' '--daemon' '/usr/bin/gpg' '--batch' '--homedir' '/tmp/tmpm9cf7Xipa/ipa-cLLKJh/.gnupg' '--passphrase-fd' '0' '--yes' '--no-tty' '-o' '/tmp/tmpm9cf7Xipa/files.tar' '-d' '/var/lib/ipa/replica-info-ipa.example.com.gpg'<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Process finished, return code=0<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Starting external process<o:p></o:p> 2016-06-06T17:59:41Z DEBUG args='tar' 'xf' '/tmp/tmpm9cf7Xipa/files.tar' '-C' '/tmp/tmpm9cf7Xipa'<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Process finished, return code=0<o:p></o:p> 2016-06-06T17:59:41Z DEBUG stdout=<o:p></o:p> 2016-06-06T17:59:41Z DEBUG stderr=<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Installing replica file with version 300 (0 means no version in prepared file).<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Check if ipa.example.com is a primary hostname for localhost<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Primary hostname for localhost: ipa.example.com<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Search DNS for ipa.example.com<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Check if ipa.h5c.local is not a CNAME<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Check reverse address of 10.55.10.31<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Found reverse name: ipa.example.com<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Created connection context.ldap2_42662608<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Checking if IPA schema is present in ldap://ipa-replica.example.com:7389<o:p></o:p> 2016-06-06T17:59:41Z DEBUG retrieving schema for SchemaCache url=ldap://ipa-replica.example.com:7389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x28b41b8><o:p></o:p> 2016-06-06T17:59:41Z DEBUG Check OK<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Destroyed connection context.ldap2_42662608<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds<o:p></o:p> 2016-06-06T17:59:41Z DEBUG [1/21]: creating certificate server user<o:p></o:p> 2016-06-06T17:59:41Z DEBUG group pkiuser exists<o:p></o:p> 2016-06-06T17:59:41Z DEBUG user pkiuser exists<o:p></o:p> 2016-06-06T17:59:41Z DEBUG duration: 0 seconds<o:p></o:p> 2016-06-06T17:59:41Z DEBUG [2/21]: configuring certificate server instance<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Contents of pkispawn configuration file (/tmp/tmpD3cjWu):<o:p></o:p> [CA]<o:p></o:p> pki_security_domain_name = IPA<o:p></o:p> pki_enable_proxy = True<o:p></o:p> pki_restart_configured_instance = False<o:p></o:p> pki_backup_keys = True<o:p></o:p> pki_backup_password = XXXXXXXX<o:p></o:p> pki_profiles_in_ldap = True<o:p></o:p> pki_client_database_dir = /tmp/tmp-jUfjcK<o:p></o:p> pki_client_database_password = XXXXXXXX<o:p></o:p> pki_client_database_purge = False<o:p></o:p> pki_client_pkcs12_password = XXXXXXXX<o:p></o:p> pki_admin_name = admin<o:p></o:p> pki_admin_uid = admin<o:p></o:p> pki_admin_email = root@localhost<o:p></o:p> pki_admin_password = XXXXXXXX<o:p></o:p> pki_admin_nickname = ipa-ca-agent<o:p></o:p> pki_admin_subject_dn = cn=ipa-ca-agent,O=EXAMPLE.COM<o:p></o:p> pki_client_admin_cert_p12 = /root/ca-agent.p12<o:p></o:p> pki_ds_ldap_port = 389<o:p></o:p> pki_ds_password = XXXXXXXX<o:p></o:p> pki_ds_base_dn = o=ipaca<o:p></o:p> pki_ds_database = ipaca<o:p></o:p> pki_subsystem_subject_dn = cn=CA Subsystem,O= EXAMPLE.COM<o:p></o:p> pki_ocsp_signing_subject_dn = cn=OCSP Subsystem,O= EXAMPLE.COM<o:p></o:p> pki_ssl_server_subject_dn = cn=ipa.example.com,O= EXAMPLE.COM<o:p></o:p> pki_audit_signing_subject_dn = cn=CA Audit,O= EXAMPLE.COM<o:p></o:p> pki_ca_signing_subject_dn = cn=Certificate Authority,O= EXAMPLE.COM<o:p></o:p> pki_subsystem_nickname = subsystemCert cert-pki-ca<o:p></o:p> pki_ocsp_signing_nickname = ocspSigningCert cert-pki-ca<o:p></o:p> pki_ssl_server_nickname = Server-Cert cert-pki-ca<o:p></o:p> pki_audit_signing_nickname = auditSigningCert cert-pki-ca<o:p></o:p> pki_ca_signing_nickname = caSigningCert cert-pki-ca<o:p></o:p> pki_ca_signing_key_algorithm = SHA256withRSA<o:p></o:p> pki_security_domain_hostname = ipa-replica.example.com<o:p></o:p> pki_security_domain_https_port = 443<o:p></o:p> pki_security_domain_user = admin<o:p></o:p> pki_security_domain_password = XXXXXXXX<o:p></o:p> pki_clone = True<o:p></o:p> pki_clone_pkcs12_path = /tmp/ca.p12<o:p></o:p> pki_clone_pkcs12_password = XXXXXXXX<o:p></o:p> pki_clone_replication_security = TLS<o:p></o:p> pki_clone_replication_master_port = 7389<o:p></o:p> pki_clone_replication_clone_port = 389<o:p></o:p> pki_clone_replicate_schema = False<o:p></o:p> pki_clone_uri = https://ipa-replica.example.com:443<o:p></o:p> <o:p> </o:p> <o:p> </o:p> 2016-06-06T17:59:41Z DEBUG Starting external process<o:p></o:p> 2016-06-06T17:59:41Z DEBUG args='/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpD3cjWu'<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Process finished, return code=1<o:p></o:p> 2016-06-06T17:59:41Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.20160606135941.log<o:p></o:p> Loading deployment configuration from /tmp/tmpD3cjWu.<o:p></o:p> <o:p> </o:p> 2016-06-06T17:59:41Z DEBUG stderr=Traceback (most recent call last):<o:p></o:p> File "/usr/sbin/pkispawn", line 717, in <module><o:p></o:p> main(sys.argv)<o:p></o:p> File "/usr/sbin/pkispawn", line 523, in main<o:p></o:p> parser.compose_pki_master_dictionary()<o:p></o:p> File "/usr/lib/python2.7/site-packages/pki/server/deployment/pkiparser.py", line 573, in compose_pki_master_dictionary<o:p></o:p> instance.load()<o:p></o:p> File "/usr/lib/python2.7/site-packages/pki/server/__init__.py", line 454, in load<o:p></o:p> subsystem.load()<o:p></o:p> File "/usr/lib/python2.7/site-packages/pki/server/__init__.py", line 118, in load<o:p></o:p> lines = open(self.cs_conf).read().splitlines()<o:p></o:p> IOError: [Errno 2] No such file or directory: '/var/lib/pki/pki-tomcat/ca/conf/CS.cfg'<o:p></o:p> <o:p> </o:p> 2016-06-06T17:59:41Z CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpD3cjWu'' returned non-zero exit status 1<o:p></o:p> 2016-06-06T17:59:41Z CRITICAL See the installation logs and the following files/directories for more information:<o:p></o:p> 2016-06-06T17:59:41Z CRITICAL /var/log/pki-ca-install.log<o:p></o:p> 2016-06-06T17:59:41Z CRITICAL /var/log/pki/pki-tomcat<o:p></o:p> 2016-06-06T17:59:41Z DEBUG Traceback (most recent call last):<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 418, in start_creation<o:p></o:p> run_step(full_msg, method)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 408, in run_step<o:p></o:p> method()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 620, in __spawn_instance<o:p></o:p> DogtagInstance.spawn_instance(self, cfg_file)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 201, in spawn_instance<o:p></o:p> self.handle_setup_error(e)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 465, in handle_setup_error<o:p></o:p> <o:p> </o:p> raise RuntimeError("%s configuration failed." % self.subsystem)<o:p></o:p> RuntimeError: CA configuration failed.<o:p></o:p> <o:p> </o:p> 2016-06-06T17:59:41Z DEBUG [error] RuntimeError: CA configuration failed.<o:p></o:p> 2016-06-06T17:59:41Z DEBUG File "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 732, in run_script<o:p></o:p> return_value = main_function()<o:p></o:p> <o:p> </o:p> File "/sbin/ipa-ca-install", line 202, in main<o:p></o:p> install_replica(safe_options, options, filename)<o:p></o:p> <o:p> </o:p> File "/sbin/ipa-ca-install", line 150, in install_replica<o:p></o:p> ca.install(True, config, options)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 106, in install<o:p></o:p> install_step_0(standalone, replica_config, options)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 130, in install_step_0<o:p></o:p> ra_p12=getattr(options, 'ra_p12', None))<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1543, in install_replica_ca<o:p></o:p> subject_base=config.subject_base)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 486, in configure_instance<o:p></o:p> self.start_creation(runtime=210)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 418, in start_creation<o:p></o:p> run_step(full_msg, method)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 408, in run_step<o:p></o:p> method()<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 620, in __spawn_instance<o:p></o:p> DogtagInstance.spawn_instance(self, cfg_file)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 201, in spawn_instance<o:p></o:p> self.handle_setup_error(e)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 465, in handle_setup_error<o:p></o:p> raise RuntimeError("%s configuration failed." % self.subsystem)<o:p></o:p> <o:p> </o:p> 2016-06-06T17:59:41Z DEBUG The ipa-ca-install command failed, exception: RuntimeError: CA configuration failed.<o:p></o:p> <o:p> </o:p> <div> <a href="http://www.high5games.com/"><img border="0" width="220" height="50" id="_x0000_i1025" src="cid:image001.jpg@01D1BFFD.A8A3E740"></a><o:p></o:p> Daniel Alex Finkelstein| Senior Dev Ops Engineer<o:p></o:p> <a href="mailto:Dan.Finkelstein@h5g.com">Dan.Finkelstein@h5g.com</a> | 212.604.3447<o:p></o:p> One World Trade Center, New York, NY 10007<o:p></o:p> <a href="http://www.high5games.com/">www.high5games.com</a><o:p></o:p> Play <a href="https://apps.facebook.com/highfivecasino/">High 5 Casino</a> and <a href="https://apps.facebook.com/shakethesky/"> Shake the Sky</a><o:p></o:p> Follow us on: <a href="http://www.facebook.com/high5games">Facebook</a>, <a href="https://twitter.com/High5Games">Twitter</a>, <a href="http://www.youtube.com/High5Games">YouTube</a>, <a href="http://www.linkedin.com/company/1072533?trk=tyah">Linkedin</a><o:p></o:p> <o:p> </o:p> </div> This message and any attachments may contain confidential or privileged information and are only for the use of the intended recipient of this message. If you are not the intended recipient, please notify the sender by return email, and delete or destroy this and all copies of this message and all attachments. Any unauthorized disclosure, use, distribution, or reproduction of this message or any attachments is prohibited and may be unlawful.<o:p></o:p> <o:p> </o:p> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Rob Crittenden <rcritten@redhat.com> Date: Monday, June 6, 2016 at 11:44 To: Daniel Finkestein <Dan.Finkelstein@high5games.com>, "freeipa-users@redhat.com" <freeipa-users@redhat.com> Subject: Re: [Freeipa-users] FreeIPA 4.2.0 on CentOS 7.2 as replica of FreeIPA 3.0.0 on CentOS 6.8; cannot install CA components as replica, cannot promote to master<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> <div> <div> <a href="mailto:Dan.Finkelstein@high5games.com">Dan.Finkelstein@high5games.com</a> wrote:<o:p></o:p> </div> <blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"> <div> Swing and a miss: when setting up the replicas, we always use the<o:p></o:p> </div> <div> —setup-ca and end the command with the replica gpg file, but it's the<o:p></o:p> </div> <div> —setup-ca that fails as per the earlier messages. If we proceed without<o:p></o:p> </div> <div> —setup-ca, it's fine. I'll try it without skipping the connection check,<o:p></o:p> </div> <div> but I don't think the replica file is the issue.<o:p></o:p> </div> </blockquote> <div> <o:p> </o:p> </div> <div> I meant to say: ipa-ca-install replicafile<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> When running ipa-ca-install without a replicafile then it assumes you <o:p></o:p> </div> <div> are trying to set up a brand new CA which isn't allowed if one already <o:p></o:p> </div> <div> exists. The messaging has been improved upstream.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Skipping the conncheck can mask odd problems and should be used sparingly.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> rob<o:p></o:p> </div> <div> <o:p> </o:p> </div> <blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"> <div> <o:p> </o:p> </div> <div> Thanks,<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Dan<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> <<a href="http://www.high5games.com/">http://www.high5games.com/</a>><o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> *Daniel Alex Finkelstein*| Senior Dev Ops Engineer<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> <a href="mailto:_Dan.Finkelstein@h5g.com">_Dan.Finkelstein@h5g.com</a> <<a href="mailto:Dan.Finkelstein@h5g.com%3E_|">mailto:Dan.Finkelstein@h5g.com>_|</a> 212.604.3447<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> One World Trade Center, New York, NY 10007<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> www.high5games.com <<a href="http://www.high5games.com/">http://www.high5games.com/</a>><o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Play High 5 Casino <<a href="https://apps.facebook.com/highfivecasino/">https://apps.facebook.com/highfivecasino/</a>> and Shake<o:p></o:p> </div> <div> the Sky <<a href="https://apps.facebook.com/shakethesky/">https://apps.facebook.com/shakethesky/</a>><o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Follow us on: Facebook <<a href="http://www.facebook.com/high5games">http://www.facebook.com/high5games</a>>, Twitter<o:p></o:p> </div> <div> <<a href="https://twitter.com/High5Games">https://twitter.com/High5Games</a>>, YouTube<o:p></o:p> </div> <div> <<a href="http://www.youtube.com/High5Games">http://www.youtube.com/High5Games</a>>, Linkedin<o:p></o:p> </div> <div> <<a href="http://www.linkedin.com/company/1072533?trk=tyah">http://www.linkedin.com/company/1072533?trk=tyah</a>><o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> //<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> /This message and any attachments may contain confidential or privileged<o:p></o:p> </div> <div> information and are only for the use of the intended recipient of this<o:p></o:p> </div> <div> message. If you are not the intended recipient, please notify the sender<o:p></o:p> </div> <div> by return email, and delete or destroy this and all copies of this<o:p></o:p> </div> <div> message and all attachments. Any unauthorized disclosure, use,<o:p></o:p> </div> <div> distribution, or reproduction of this message or any attachments is<o:p></o:p> </div> <div> prohibited and may be unlawful./<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> *From: *Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>><o:p></o:p> </div> <div> *Date: *Monday, June 6, 2016 at 09:51<o:p></o:p> </div> <div> *To: *Daniel Finkestein <<a href="mailto:Dan.Finkelstein@high5games.com">Dan.Finkelstein@high5games.com</a>>,<o:p></o:p> </div> <div> "<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>" <<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><o:p></o:p> </div> <div> *Subject: *Re: [Freeipa-users] FreeIPA 4.2.0 on CentOS 7.2 as replica of<o:p></o:p> </div> <div> FreeIPA 3.0.0 on CentOS 6.8; cannot install CA components as replica,<o:p></o:p> </div> <div> cannot promote to master<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> I think I figured out what is wrong. It is trying to add a NEW CA, not<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> creating a replica of the CA on this host. You need to pass in the<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> replica install file as an argument:<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> # ipa-replica-install foo.example.com<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> Not sure skipping the conncheck is a great idea either.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> rob<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> <o:p> </o:p> </div> <div> <o:p> </o:p> </div> </blockquote> <div> <o:p> </o:p> </div> <div> <o:p> </o:p> </div> </div> </div> </div> </body> </html>