freeipa

#6841 [ipa-replica-install] - Certificate issuance failed (CA_REJECTED)
Closed: duplicate Opened by mreznik.

Closed: duplicate
Reopen Issue

"ipa-replica-install" failing in Certificate issuance failed (CA_REJECTED) while running "test_line_topology_without_ca" test. It is replica of replica. However the issue is not being hit frequently rather it is quite rare. 

2017-03-31T09:23:22Z DEBUG Done configuring certificate server (pki-tomcatd).
2017-03-31T09:23:22Z DEBUG Configuring Kerberos KDC (krb5kdc)
2017-03-31T09:23:22Z DEBUG   [1/2]: installing X509 Certificate for PKINIT
2017-03-31T09:24:01Z DEBUG retrieving schema for SchemaCache url=ldap://server01.ipa.test conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fa4c62c9c68>
2017-03-31T09:24:02Z DEBUG certmonger request is in state dbus.String(u'GENERATING_KEY_PAIR', variant_level=1)
2017-03-31T09:24:07Z DEBUG certmonger request is in state dbus.String(u'CA_REJECTED', variant_level=1)
2017-03-31T09:24:07Z DEBUG Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 423, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 413, in run_step
    method()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/krbinstance.py", line 392, in setup_pkinit
    profile='KDCs_PKINIT_Certs')
  File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py", line 317, in request_and_wait_for_cert
    raise RuntimeError("Certificate issuance failed ({})".format(state))
RuntimeError: Certificate issuance failed (CA_REJECTED)
2017-03-31T09:24:07Z DEBUG   [error] RuntimeError: Certificate issuance failed (CA_REJECTED)
2017-03-31T09:24:07Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
...
...
...
  File "/usr/lib/python2.7/site-packages/ipaserver/install/krbinstance.py", line 392, in setup_pkinit
    profile='KDCs_PKINIT_Certs')
  File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py", line 317, in request_and_wait_for_cert
    raise RuntimeError("Certificate issuance failed ({})".format(state))
2017-03-31T09:24:07Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: Certificate issuance failed (CA_REJECTED)
2017-03-31T09:24:07Z ERROR Certificate issuance failed (CA_REJECTED)
2017-03-31T09:24:07Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Known fail scenarios: 

master > replica > replica FAIL
master > replica > replica > replica FAIL

ipareplica-install.log

ipareplica-install.log

As per "cheimes" resubmitting the request is working:

    # hostname
    system01.ipa.test
    # ipa-getcert list
    Number of certificates and requests being tracked: 4.
    Request ID '20170331092245':
            status: MONITORING
            stuck: no
            key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IPA.TEST',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IPA.TEST/pwdfile.txt'
            certificate: type=NSSDB,location='/etc/dirsrv/slapd-IPA.TEST',nickname='Server-Cert',token='NSS Certificate DB'
            CA: IPA
            issuer: CN=Certificate Authority,O=IPA.TEST
            subject: CN=system01.ipa.test,O=IPA.TEST
            expires: 2019-04-01 09:22:46 UTC
            principal name: ldap/system01.ipa.test@IPA.TEST
            key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
            eku: id-kp-serverAuth,id-kp-clientAuth
            pre-save command:
            post-save command:
            track: yes
            auto-renew: yes
    Request ID '20170331092306':
            status: MONITORING
            stuck: no
            key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
            certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
            CA: IPA
            issuer: CN=Certificate Authority,O=IPA.TEST
            subject: CN=system01.ipa.test,O=IPA.TEST
            expires: 2019-04-01 09:23:06 UTC
            principal name: HTTP/system01.ipa.test@IPA.TEST
            key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
            eku: id-kp-serverAuth,id-kp-clientAuth
            pre-save command:
            post-save command:
            track: yes
            auto-renew: yes
    Request ID '20170331092402':
            status: CA_REJECTED
            ca-error: Server at https://system01.ipa.test/ipa/xml failed request, will retry: -504 (HTTP response code is 401, not 200).
            stuck: yes
            key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
            certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
            CA: IPA
            issuer:
            subject:
            expires: unknown
            pre-save command:
            post-save command:
            track: yes
            auto-renew:
    # cat /var/log/httpd/access_log
    2620:52:0:224e:21a:4aff:fe23:162f - - [31/Mar/2017:11:24:02 +0200] "POST /ipa/xml HTTP/1.1" 401 1469yes
    # cat /var/log/httpd/error_log
    [Fri Mar 31 11:23:18.856816 2017] [core:notice] [pid 19346] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
    [Fri Mar 31 11:23:18.857740 2017] [suexec:notice] [pid 19346] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
    [Fri Mar 31 11:23:18.857762 2017] [:warn] [pid 19346] NSSSessionCacheTimeout is deprecated. Ignoring.
    [Fri Mar 31 11:23:19.008978 2017] [auth_digest:notice] [pid 19346] AH01757: generating secret for digest authentication ...
    [Fri Mar 31 11:23:19.010097 2017] [lbmethod_heartbeat:notice] [pid 19346] AH02282: No slotmem from mod_heartmonitor
    [Fri Mar 31 11:23:19.010110 2017] [:warn] [pid 19346] NSSSessionCacheTimeout is deprecated. Ignoring.
    [Fri Mar 31 11:23:19.012370 2017] [wsgi:warn] [pid 19346] mod_wsgi: Compiled for Python/2.7.12.
    [Fri Mar 31 11:23:19.012379 2017] [wsgi:warn] [pid 19346] mod_wsgi: Runtime using Python/2.7.13.
    [Fri Mar 31 11:23:19.021012 2017] [mpm_prefork:notice] [pid 19346] AH00163: Apache/2.4.25 (Fedora) mod_auth_gssapi/1.5.0 mod_nss/1.0.14 NSS/3.28.3 mod_wsgi/4.4.23 Python/2.7.13 configured -- resuming normal operations
    [Fri Mar 31 11:23:19.021034 2017] [core:notice] [pid 19346] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'
    [Fri Mar 31 11:23:22.321816 2017] [wsgi:error] [pid 19351] ipa: INFO: *** PROCESS START ***
    [Fri Mar 31 11:23:22.676894 2017] [wsgi:error] [pid 19350] ipa: INFO: *** PROCESS START ***
    resubmitting the request worked for me:
    # ipa-getcert resubmit -i 20170331092402
    # ipa-getcert list -i 20170331092402
    Number of certificates and requests being tracked: 4.
    Request ID '20170331092402':
            status: MONITORING
            stuck: no
            key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
            certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
            CA: IPA
            issuer: CN=Certificate Authority,O=IPA.TEST
            subject: CN=system01.ipa.test,O=IPA.TEST
            expires: 2019-04-01 09:34:37 UTC
            principal name: krbtgt/IPA.TEST@IPA.TEST
            key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
            eku: id-kp-serverAuth,id-pkinit-KPKdc
            pre-save command:
            post-save command:
            track: yes
            auto-renew: yes

closing as duplicate of https://pagure.io/freeipa/issue/6817

Please make sure to search the existing issues more thoroughly before creating a new one.

Metadata Update from @mbabinsk:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)

The issue #6817 says that "replica install fails against <4.5 master". In this case all of the systems were 4.5.

I have the same issue on 4.6 - it seems to want to create the certificate on the actual machine i'm installing... And it doesn't have the ca support running yet - it's not there yet.

This seems broken to me =)

You found a similar error message but different root cause.

Agreed, still haven't managed to zero in on it...

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.