search

dogtagpki / pki

The Dogtag Certificate System is an enterprise-class Certificate Authority (CA) which supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management.
https://www.dogtagpki.org
GNU General Public License v2.0
361 stars 134 forks source link

Improve error reporting when the imported certs are invalid #3269

Open pki-bot opened 3 years ago

pki-bot commented 3 years ago

This issue was migrated from Pagure Issue #3152. Originally filed by cipherboy (@cipherboy) on 2020-03-16 09:55:26:

Description of problem:

I am seeing a failure both when using --setup-ca in ipa-replica-install and running ipa-ca-install separately when --setup-ca not used.

From an ipa-ca-install:

Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds
  [1/22]: creating certificate server user
  [2/22]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmp4raVhy'' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL   /var/log/pki-ca-install.log
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL   /var/log/pki/pki-tomcat
  [error] RuntimeError: CA configuration failed.

Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

CA configuration failed.

Then at the end of the /var/log/pki/pki-tomcat/ca/debug, I see this:

[01/Apr/2016:20:49:37][http-bio-8443-exec-3]: SystemConfigService: clone does not have all the certificates.
[01/Apr/2016:20:49:37][http-bio-8443-exec-3]: Clone does not have all the required certificates

Version-Release number of selected component (if applicable): ipa-server-4.2.0-15.el7_2.12.x86_64

How reproducible: unknown

Steps to Reproduce:

  1. Install IPA master
  2. Install IPA replica
  3. Install CA on replica using: ipa-ca-install -p Password -w Password /var/lib/ipa/replica-file.gpg

Problem was also seen with 2 steps:

  1. Install IPA master
  2. Install IPA replica with CA include --setup-ca in ipa-replica-install command.

Actual results: Fails as mentioned above.

Expected results: No failure and CA properly installed.

Additional info:

pki-bot commented 3 years ago

Comment from cipherboy (@cipherboy) at 2020-03-16 09:56:06

https://bugzilla.redhat.com/show_bug.cgi?id=1323318

pki-bot commented 3 years ago

Comment from cipherboy (@cipherboy) at 2020-03-16 09:56:07

Metadata Update from @cipherboy: