freeipa

#6820 [ipa-replica-prepare] - Certificate issuance failed
Closed: duplicate Opened by mreznik.

Closed: duplicate
Reopen Issue

When running simple_replication-domlevel-0 tests getting error "Certificate issuance failed". The issue is not always reproducible, sometimes it is present and sometimes not but it more fails the passes. When checking pki-tomcat/ca/debug and system logs there is an issue with connecting to LDAP server, however those errors are presented also in logs when the command works.

The following error message seems to be in the logs where it fails in addition:

Cannot build CA chain. Error java.security.cert.CertificateException: Certificate is not a PKCS #11 certificate

debug-fails

system-fails

Can you please check the logs again to verify that this is not a duplicate of https://pagure.io/freeipa/issue/6274 ?

Unfortunately the logs in the ticket 6274 are no longer there (404). However it looks like it might be the same issue. I am having suspicion that when running from one particular controller node it usually passes (maybe ssh commands are just executed a little slower from there?). I will try to reproduce it couple of times locally with time.sleep(45) in tasks.py and let you know. Sorry for the duplicate then.

Please check for the 'Profile caIPaserviceCert not found' message when it occurs next time. Since Dogtag developers are not very willing to fix this issue we may want to add some sleep intervals between master installation and replica-prepare.

@mbabinsk The message indeed appears in the debug log posted at this issue, closing it as a duplicate of https://pagure.io/freeipa/issue/6274

Metadata Update from @stlaz:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.