<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="DA" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> We had problems with one idm replica complaining about different ldap database versions and at the same time errors on starting pki-tomcat. I decided to delete the ipa server and reinstall.<o:p></o:p> The ipa server delete went without problems, but the reinstall….<o:p></o:p> <o:p> </o:p> ipa-replica-install --setup-ca --setup-dns --forwarder 10.200.207.11 --forwarder 10.200.206.11 --principal admin --admin-password “secret”<o:p></o:p> <o:p> </o:p> This fails on ca install, but without set-up ca the install was succesfull.<o:p></o:p> I tried both with the server enrolled as client and with the server not enrolled – no difference.<o:p></o:p> The installation was successful in a different envirionment but same software versions.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> server is rhel 7.3, ipa: VERSION: 4.4.0, API_VERSION: 2.213<o:p></o:p> <o:p> </o:p> When ipa-replica-install fails with –setup-ca ipareplica-install.log shows :<o:p></o:p> 2017-04-23T19:44:45Z DEBUG Starting external process<o:p></o:p> 2017-04-23T19:44:45Z DEBUG args=/usr/sbin/pkispawn -s CA -f /tmp/tmpBLQe1X<o:p></o:p> 2017-04-23T19:44:46Z DEBUG Process finished, return code=1<o:p></o:p> 2017-04-23T19:44:46Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.20170423214445.log<o:p></o:p> Loading deployment configuration from /tmp/tmpBLQe1X.<o:p></o:p> <o:p> </o:p> 2017-04-23T19:44:46Z DEBUG stderr=Traceback (most recent call last):<o:p></o:p> File "/usr/sbin/pkispawn", line 817, in <module><o:p></o:p> main(sys.argv)<o:p></o:p> File "/usr/sbin/pkispawn", line 501, in main<o:p></o:p> create_master_dictionary(parser)<o:p></o:p> File "/usr/sbin/pkispawn", line 641, in create_master_dictionary<o:p></o:p> parser.compose_pki_master_dictionary()<o:p></o:p> File "/usr/lib/python2.7/site-packages/pki/server/deployment/pkiparser.py", line 614, in compose_pki_master_dictionary<o:p></o:p> instance.load()<o:p></o:p> File "/usr/lib/python2.7/site-packages/pki/server/__init__.py", line 595, in load<o:p></o:p> subsystem.load()<o:p></o:p> File "/usr/lib/python2.7/site-packages/pki/server/__init__.py", line 129, in load<o:p></o:p> lines = open(self.cs_conf).read().splitlines()<o:p></o:p> IOError: [Errno 2] No such file or directory: '/var/lib/pki/pki-tomcat/ca/conf/CS.cfg'<o:p></o:p> <o:p> </o:p> 2017-04-23T19:44:46Z CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpBLQe1X' returned non-zero exit status 1<o:p></o:p> 2017-04-23T19:44:46Z CRITICAL See the installation logs and the following files/directories for more information:<o:p></o:p> 2017-04-23T19:44:46Z CRITICAL /var/log/pki/pki-tomcat<o:p></o:p> 2017-04-23T19:44:46Z DEBUG Traceback (most recent call last):<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation<o:p></o:p> run_step(full_msg, method)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step<o:p></o:p> method()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 586, in __spawn_instance<o:p></o:p> DogtagInstance.spawn_instance(self, cfg_file)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 181, in spawn_instance<o:p></o:p> self.handle_setup_error(e)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 420, in handle_setup_error<o:p></o:p> raise RuntimeError("%s configuration failed." % self.subsystem)<o:p></o:p> RuntimeError: CA configuration failed.<o:p></o:p> <o:p> </o:p> 2017-04-23T19:44:46Z DEBUG [error] RuntimeError: CA configuration failed.<o:p></o:p> 2017-04-23T19:44:46Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute<o:p></o:p> return_value = self.run()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 318, in run<o:p></o:p> cfgr.run()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 310, in run<o:p></o:p> self.execute()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 332, in execute<o:p></o:p> for nothing in self._executor():<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Nothing in /var/log/pki/pki-tomcat.<o:p></o:p> <o:p> </o:p> Further observations:<o:p></o:p> During changing the certificate to thirdparty ssl, I got the following error in /var/log/httpd/error_log :<o:p></o:p> [Mon Apr 24 09:03:14.267871 2017] [:error] [pid 11004] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.<o:p></o:p> p11-kit: couldn't open and map file: /etc/pki/ca-trust/source/ipa.p11-kit: Permission denied<o:p></o:p> <o:p> </o:p> I changed the permission on /etc/pki/ca-trust/source/ipa.p11-kit from 600 to 644 and added “NSSEnforceValidCerts off” to /etc/httpd/conf.d/nss.conf<o:p></o:p> After that ipa-certupdate succeeded.<o:p></o:p> <o:p> </o:p> Are there any way to install the ca without reinstalling the whole ipa-server again?<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> Regards<o:p></o:p> Bjarne Blichfeldt.<o:p></o:p> <o:p> </o:p> </div> </body> </html>