The Dogtag Certificate System is an enterprise-class Certificate Authority (CA) which supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management.
I am seeing a failure both when using --setup-ca in ipa-replica-install and running ipa-ca-install separately when --setup-ca not used.
From an ipa-ca-install:
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds
[1/22]: creating certificate server user
[2/22]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmp4raVhy'' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki-ca-install.log
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
Then at the end of the /var/log/pki/pki-tomcat/ca/debug, I see this:
[01/Apr/2016:20:49:37][http-bio-8443-exec-3]: SystemConfigService: clone does not have all the certificates.
[01/Apr/2016:20:49:37][http-bio-8443-exec-3]: Clone does not have all the required certificates
Version-Release number of selected component (if applicable):
ipa-server-4.2.0-15.el7_2.12.x86_64
How reproducible:
unknown
Steps to Reproduce:
Install IPA master
Install IPA replica
Install CA on replica using:
ipa-ca-install -p Password -w Password /var/lib/ipa/replica-file.gpg
Problem was also seen with 2 steps:
Install IPA master
Install IPA replica with CA
include --setup-ca in ipa-replica-install command.
Actual results:
Fails as mentioned above.
Expected results:
No failure and CA properly installed.
This issue was migrated from Pagure Issue #3152. Originally filed by cipherboy (@cipherboy) on 2020-03-16 09:55:26:
Description of problem:
I am seeing a failure both when using --setup-ca in ipa-replica-install and running ipa-ca-install separately when --setup-ca not used.
From an ipa-ca-install:
Then at the end of the /var/log/pki/pki-tomcat/ca/debug, I see this:
Version-Release number of selected component (if applicable): ipa-server-4.2.0-15.el7_2.12.x86_64
How reproducible: unknown
Steps to Reproduce:
Problem was also seen with 2 steps:
Actual results: Fails as mentioned above.
Expected results: No failure and CA properly installed.
Additional info: