freeipa

#6577 ipa-ca-install fails for the second server after converting from CA-less to CA-full
Closed Opened by tkrizek.

Closed
Reopen Issue

During a review of PR https://github.com/freeipa/freeipa/pull/355 that fixes #6226 (which has to be fixed before it's possible to encounter this bug) I encountered the following issue.

After installing CA-less master and CA-less replica, install a CA on one of the servers. The installation should succeed. Afterwards, attempt to install CA on the other server. The installation will end with an error message "CA did not start in 300 seconds." Please note that it does not matter whether you first install the CA on master or replica - the first installation always succeeds, while the second one fails.

The relevant logs show that pki-tomcat fails to connect to LDAPS on port 636, which is actually running and listening for connections. There is probably an issue with the propagation of CA certificate to other servers during ipa-ca-install, because running ipa-certupdate seems to fix the problem.

/var/log/pki/pki-tomcat/ca/debug

[21/Dec/2016:12:43:46][localhost-startStop-1]: SSL handshake happened
Could not connect to LDAP server host vm-058-045.example.com port 636 Error netscape.ldap.LDAPException: Authentication failed (48)

/var/log/dirsrv/slapd-DOM-058-045-EXAMPLE-COM/access

[21/Dec/2016:12:43:46.640540945 +0100] conn=4 fd=66 slot=66 SSL connection from 10.34.58.45 to 10.34.58.45
[21/Dec/2016:12:43:46.653170560 +0100] conn=4 TLS1.2 128-bit AES
[21/Dec/2016:12:43:46.665708312 +0100] conn=4 op=0 BIND dn="" method=sasl version=3 mech=EXTERNAL

Metadata Update from @tkrizek:
- Issue assigned to jcholast
- Issue set to the milestone: FreeIPA 4.5

Metadata Update from @mbasti:
- Issue close_status updated to: None
- Issue set to the milestone: FreeIPA 4.5.1 (was: FreeIPA 4.5)

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.2 (was: FreeIPA 4.5.1)

FreeIPA 4.5.1 has been released, moving to FreeIPA 4.5.2 milestone

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.3 (was: FreeIPA 4.5.2)

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.4 (was: FreeIPA 4.5.3)

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.5 (was: FreeIPA 4.5.4)

ipa-certupdate is a necessary step. I guess it would make sense to perform it as the first step of
the ipa-ca-install on the other replicas.

Metadata Update from @ftweedal:
- Issue assigned to ftweedal (was: jcholast)

Metadata Update from @pvoborni:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1232

master:

  • 93d53e5cd02addf3b654f0a728bfac4d610a524f CertUpdate: make it easy to invoke from other programs
  • 8960141adbd527ad249cd237f78a8ea2f7452e4e ipa-ca-install: run certupdate as initial step
  • 97942a7c7aac61d657832709e2dcc45a4cb4e4df Run certupdate after promoting to CA-ful deployment
  • 39fdc2d25063e9017baaa6ea1f79fc224b07f283 ipa_certupdate: avoid classmethod and staticmethod

ipa-4-6:

  • 75e4cf1d2a4de9323b95437b6097059014d21ac3 CertUpdate: make it easy to invoke from other programs
  • 75a3ede7107c07521a668bcfeb268a5024132731 ipa-ca-install: run certupdate as initial step
  • cd4d9cc46d7d4b3bb9ed7a69976b0986b083abfa Run certupdate after promoting to CA-ful deployment
  • 5eab20e3e8c9a9e9a2fe1d91de65045705637ccd ipa_certupdate: avoid classmethod and staticmethod

Currently, there is no expectation for another 4.5 release. This issue is fixed in 4.6, 4.7, and master, thus closing.

Metadata Update from @abbra:
- Issue set to the milestone: FreeIPA 4.6 (was: FreeIPA 4.5.5)
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
defect
IPA
https://fedorahosted.org/freeipa/ticket/6226
https://github.com/freeipa/freeipa/pull/1232
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.