<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 04/26/2017 10:22 AM, Rob Crittenden wrote: </div> <blockquote cite="mid:0afa51e4-49f3-6ecb-63f0-7b20fe028f8f@redhat.com" type="cite"> <pre wrap="">Bret Wortman wrote: </pre> <blockquote type="cite"> <pre wrap="">Digging still deeper: # ipa cert-request f.f --principal=HTTP/`hostname`@DAMASCUSGRP.COM ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (503) Looks like this is an HTTP error; so is it possible that my IPA thinks it has a CA but there's no CMS available? </pre> </blockquote> <pre wrap=""> Apache proxies requests to the CA so there could be a mismatch I suppose. I'd ensure that the pki processes are running on the box for starters and then dig into the CA debug log for more details.</pre> </blockquote> Is that /var/log/pki/pki-tomcat/ca/debug? If so, then nothing happens in it during the above operations. As you noted, apache produces the following when trying to show a valid cert even though there's nothing in what I think is the pki ca debug log. ps aux shows pki processes alive, at least, and in ownership of the 8009 port (verified by lsof). [Wed Apr 26 14:38:48.157961 2017] [:error] [pid 15801] ipa: INFO: [jsonserver_session] <a class="moz-txt-link-abbreviated" href="mailto:admin@DAMASCUSGRP.COM">admin@DAMASCUSGRP.COM</a>: ping(): SUCCESS [Wed Apr 26 14:38:48.247040 2017] [proxy:error] [pid 15804] (111)Connection refused: AH00957: AJP: attempt to connect to 127.0.0.1:8009 (localhost) failed [Wed Apr 26 14:38:48.247072 2017] [proxy:error] [pid 15804] AH00959: ap_proxy_connect_)backend disabling worker for (localhost) for 60s [Wed Apr 26 14:38:48.247078 2017] [proxy_ajp:error] [pid 15804] [client 192.168.208.54:56618] AH00896: failed to make connection to backend: localhost [Wed Apr 26 14:38:48.247531 2017] [:error] [pid 15800] ipa: ERROR: ra.get_certificate(): Unable to communicate with CMS (503) [Wed Apr 26 14:38:48.247765 2017] [:error] [pid 15800] ipa: INFO: [jsonserver_session] <a class="moz-txt-link-abbreviated" href="mailto:admin@DAMASCUSGRP.COM">admin@DAMASCUSGRP.COM</a>: cert_show/1(u'895', version=u'2.213'): CertificateOperationError <blockquote cite="mid:0afa51e4-49f3-6ecb-63f0-7b20fe028f8f@redhat.com" type="cite"> <pre wrap=""> rob </pre> <blockquote type="cite"> <pre wrap=""> On 04/26/2017 08:41 AM, Bret Wortman wrote: </pre> <blockquote type="cite"> <pre wrap=""> Using the firefox debugger, I get these errors when trying to pop up the New Certificate dialog: Empty string passed to getElementById(). (5) jquery.js:4:1060 TypeError: u is undefined app.js:1:362059 Empty string passed to getElementById(). (5) jquery.js:4:1060 TypeError: t is undefined app.js:1:217432 I'm definitely not a web kind of guy so I'm not sure if this is helpful or not. This is on 4.4.0, API Version 2.213. Bret On 04/26/2017 08:35 AM, Bret Wortman wrote: </pre> <blockquote type="cite"> <pre wrap=""> Good news. One of my servers _does_ have CA installed. So why does "Action -> New Certificate" not do anything on this or any other server? Bret On 04/25/2017 02:52 PM, Bret Wortman wrote: </pre> <blockquote type="cite"> <pre wrap=""> I recently had to upgrade all my Fedora IPA servers to C7. It went well, and we've been up and running nicely on 4.4.0 on C7 for the past month or so. Today, someone came and asked me to generate a new certificate for their web server. All was good until I went to the IPA UI and tried to perform Actions->New Certificate, which did nothing. I tried each of our 3 servers in turn. All came back with no popup window and no error, either. I suspect the problem might be that we no longer have a CA server due to the method I used to upgrade the servers. I likely missed a "--setup-ca" in there somewhere, so my rolling update rolled over the CA. What's my best hope of recovery? I never ran this before, so I'm not sure if this shows that I'm missing a CA or not: # ipa ca-find ------------ 1 CA matched ------------ Name: ipa Description IPA CA Authority ID: 3ce3346[...] Subject DN: CN=Certificate Authority, O=DAMASCUSGRP.COM Issuer DN: CN=Certificate Authority,O=DAMASCUSGRP.COM ---------------------------- Number of entries returned 1 ---------------------------- # ipa ca-add dg --desc "Damascus Group" --subject "CN=DG CA, O=DAMASCUSGRP.COM" ipa: ERROR: Failed to authenticate to CA REST API # klist Ticket cache: KEYRING:persistent:0:0 Default principal: <a class="moz-txt-link-abbreviated" href="mailto:admin@DAMASCUSGRP.COM">admin@DAMASCUSGRP.COM</a> Valid starting Expires Service principal 04/25/2017 18:48:26 04/26/2017 18:48:21 <a class="moz-txt-link-abbreviated" href="mailto:krbtgt/DAMASCUSGRP.COM@DAMASCUSGRP.COM">krbtgt/DAMASCUSGRP.COM@DAMASCUSGRP.COM</a> # What's my best path of recovery? -- *Bret Wortman* The Damascus Group </pre> </blockquote> <pre wrap=""> </pre> </blockquote> <pre wrap=""> </pre> </blockquote> <pre wrap=""> </pre> </blockquote> <pre wrap=""> </pre> </blockquote> </body> </html>