freeipa

#8823 ipa replica fails to install ca -
Closed: worksforme by rcritten. Opened by ataz.

Closed: worksforme
Reopen Issue

Issue

ca install fails on replica.

Steps to Reproduce

1.ipa-replica-install --principal $USERID --admin-password $PASSWORD --server $MASTERSERVER --domain $DOMAIN
2. ipa-ca-install
3.

Actual behavior

[5/28]: configuring certificate server instance
cipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpqE4hvp' returned non-zero exit status 1
ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information:
ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.

Expected behavior

ca installed successfully

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.6.8-5.el7.centos.4.x86_64
ipa-client-4.6.8-5.el7.centos.4.x86_64
389-ds-base-1.3.10.2-10.el7_9.x86_64
pki-ca-10.5.18-12.el7_9.noarch
krb5-server-1.15.1-50.el7.x86_64

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

# ipa-ca-install 
Directory Manager (existing master) password: 
Run connection check to master
Connection check OK
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
  [1/28]: creating certificate server db
  [2/28]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 13 seconds elapsed
Update succeeded
  [3/28]: creating ACIs for admin
  [4/28]: creating installation admin user
  [5/28]: configuring certificate server instance
cipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpqE4hvp' returned non-zero exit status 1
ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information:
ipaserver.install.dogtaginstance: CRITICAL   /var/log/pki/pki-tomcat
  [error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
root@

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

Did you look at the log files as the command output suggests?

I did, I don't understand the connection refused once the connection check OK's

root@ipa-las-las10-1:~# tail  /var/log/pki/pki-ca-spawn.20210427114108.log 
2021-04-27 11:41:12 pkispawn    : INFO     ....... rm -f /etc/pki/pki-tomcat/pfile
2021-04-27 11:41:12 pkispawn    : INFO     ....... executing 'systemctl daemon-reload'
2021-04-27 11:41:12 pkispawn    : INFO     ....... executing 'systemctl start pki-tomcatd@pki-tomcat.service'
2021-04-27 11:41:13 pkispawn    : DEBUG    ........... No connection - server may still be down
2021-04-27 11:41:13 pkispawn    : DEBUG    ........... No connection - exception thrown: ('Connection aborted.', error(111, 'Connection refused'))
2021-04-27 11:41:14 pkispawn    : DEBUG    ........... No connection - server may still be down
2021-04-27 11:41:14 pkispawn    : DEBUG    ........... No connection - exception thrown: ('Connection aborted.', error(111, 'Connection refused'))
2021-04-27 11:41:19 pkispawn    : DEBUG    ........... <?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><State>0</State><Type>CA</Type><Status>running</Status><Version>10.5.18-12.el7_9</Version></XMLResponse>
2021-04-27 11:41:20 pkispawn    : INFO     ....... constructing PKI configuration data.
2021-04-27 11:41:20 pkispawn    : INFO     ....... configuring PKI configuration data.
root@ipa-las-las10-1:~#

This is expected. The CA runs inside of tomcat so even though tomcat starts the CA has its own startup time so a loop is run to ensure it is actually up and answering requests.

how do I get it past step 5 to complete the other 23 steps?
Edited by ataz

As I said, you need to look in the debug log to try to find out where it failed. You can attach a copy here, redact as needed.

@ataz
- according to the rpm -q output, the installation contains a mix of centos and rhel7 packages. What are the repositories configured for your machine?
- there are a few known issues that happen randomly during CA installation (#8680, #8564, #8748). In order to move forward, the pki-ca-spawn.log + journal on the replica may help diagnose the issue. If there is already an existing CA in the topology, the logs from this CA (/var/log/pki/pki-tomcat) may also contain relevant information, as the replica needs to contact the CA to create the clone.

 
root@ipa-las-las10-1:~# yum install  freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
Loaded plugins: fastestmirror, rhnplugin
This system is receiving updates from RHN Classic or Red Hat Satellite.
Loading mirror speeds from cached hostfile
Resolving Dependencies
--> Running transaction check
---> Package 389-ds-base.x86_64 0:1.3.10.2-10.el7_9 will be installed
---> Package ipa-client.x86_64 0:4.6.8-5.el7.centos.5 will be installed
---> Package ipa-server.x86_64 0:4.6.8-5.el7.centos.5 will be installed
--> Processing Dependency: slapi-nis >= 0.56.0-4 for package: ipa-server-4.6.8-5.el7.centos.5.x86_64
---> Package krb5-server.x86_64 0:1.15.1-50.el7 will be installed
---> Package pki-ca.noarch 0:10.5.18-12.el7_9 will be installed
--> Running transaction check
---> Package slapi-nis.x86_64 0:0.56.5-3.el7_9 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
============================================================================================================================================================================================================
 Package                                      Arch                                    Version                                                 Repository                                               Size
============================================================================================================================================================================================================
Installing:
 389-ds-base                                  x86_64                                  1.3.10.2-10.el7_9                                       centos7-x86_64-updates                                  1.7 M
 ipa-client                                   x86_64                                  4.6.8-5.el7.centos.5                                    centos7-x86_64-updates                                  290 k
 ipa-server                                   x86_64                                  4.6.8-5.el7.centos.5                                    centos7-x86_64-updates                                  532 k
 krb5-server                                  x86_64                                  1.15.1-50.el7                                           centos7-x86_64                                          1.0 M
 pki-ca                                       noarch                                  10.5.18-12.el7_9                                        centos7-x86_64-updates                                  485 k
Installing for dependencies:
 slapi-nis                                    x86_64                                  0.56.5-3.el7_9                                          centos7-x86_64-updates                                  149 k
Transaction Summary
============================================================================================================================================================================================================
Install  5 Packages (+1 Dependent package)
Total size: 4.2 M
Installed size: 11 M
Is this ok [y/d/N]: 

root@ipa-las-las10-1:/etc/yum.repos.d# yum repolist -v centos7-x86_64-updates
Loading "rhnplugin" plugin
Loading "fastestmirror" plugin
Config time: 0.044
This system is receiving updates from RHN Classic or Red Hat Satellite.
Looking for repo options for [main]
Looking for repo options for [centos7-x86_64]
Repo 'centos7-x86_64' setting option 'enabled' = '1'
Repo 'centos7-x86_64' setting option 'gpgcheck' = '1'
Repo 'centos7-x86_64' setting option 'timeout' = '120'
Looking for repo options for [centos7-x86_64-updates]
Repo 'centos7-x86_64-updates' setting option 'enabled' = '1'
Repo 'centos7-x86_64-updates' setting option 'gpgcheck' = '1'
Repo 'centos7-x86_64-updates' setting option 'timeout' = '120'
Looking for repo options for [puppet-el7-x86_64]
Repo 'puppet-el7-x86_64' setting option 'enabled' = '1'
Repo 'puppet-el7-x86_64' setting option 'gpgcheck' = '1'
Repo 'puppet-el7-x86_64' setting option 'timeout' = '120'
Looking for repo options for [zabbix52-centos7-x86_64]
Repo 'zabbix52-centos7-x86_64' setting option 'enabled' = '1'
Repo 'zabbix52-centos7-x86_64' setting option 'gpgcheck' = '1'
Repo 'zabbix52-centos7-x86_64' setting option 'timeout' = '120'
Yum version: 3.4.3
Loading mirror speeds from cached hostfile
Setting up Package Sacks
pkgsack time: 0.008
Repo-id      : centos7-x86_64-updates
Repo-name    : CentOS 7 Updates (x86_64)
Repo-status  : enabled
Repo-updated : Fri Apr 30 00:40:03 2021
Repo-pkgs    : 5,463
Repo-size    : 23 G
Repo-baseurl : https://updates.$INTERNALHOSTNAME.net/XMLRPC/GET-REQ/centos7-x86_64-updates
Repo-expire  : 21,600 second(s) (last: Fri Apr 30 11:13:05 2021)
  Filter     : read-only:present
repolist: 5,463
root@ipa-las-las10-1:/etc/yum.repos.d#

Where $INTERNALHOSTNAME is an internal server.
Edited by ataz

So you're saying this is CentOS-only then? The repo configuration doesn't necessarily tell the whole story.

Either way the CA debug log should hold some info. Find the last "DEBUG SUBSYSTEM INITIALIZED" in /var/log/pki/pki-tomcat/ca/debug and work down to the first error.

I got it to work by Uninstalling and waiting 20 minutes. Then doing the
replica install with setup-ca flags instead of doing a replica install then
a ca install.

On Mon, May 3, 2021, 4:14 PM Rob Crittenden pagure@pagure.io wrote:

rcritten added a new comment to an issue you are following:
``
So you're saying this is CentOS-only then? The repo configuration doesn't
necessarily tell the whole story.

Either way the CA debug log should hold some info. Find the last "DEBUG
SUBSYSTEM INITIALIZED" in /var/log/pki/pki-tomcat/ca/debug and work down to
the first error.
``

To reply, visit the link below or just reply to this email
https://pagure.io/freeipa/issue/8823

Great, glad you got your installation completed.

Metadata Update from @rcritten:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.