dogtagpki

#2632 pki-tomcatd fails to start during ipa-ca-install on a replica
Closed: duplicate Opened by mharmsen.

Closed: duplicate
Reopen Issue

ipareplica-ca-install.log

The service pki-tomcatd does not start correctly during ipa-ca-install on an
ipa replica so the CA installation is stalled on step '[9/25]: importing CA
chain to RA certificate database'.

Same result with reinstallation of entire replica with --setup-ca option.

At this step the service pki-tomcatd is considered as active by systemd, the
service listens ports 8080 and 8043. But HTTP POST/GET on
/ca/admin/ca/getStatus service timeout with no response.

The TCP flows has been however established (so no firewall/selinux problem)

Then I have to kill install process to stop it even after several hours.

  • The catalina logs are empty.
  • I cannot see any error clue on pki-tomcat/ca/debug .
  • I don't know what the pki-tomcat is waiting for : strace shows nothing when starting this tomcat instance with it.

The CA master works pretty well with same software version.

Steps to Reproduce:

 ipa-ca-install /var/lib/ipa/*****.gpg

Actual results:

CA Clone install is not completed and pki is not working

Expected results:

CA Clone install completed and pki fully working

Additional info:

pki CLI returns no result because it uses not working HTTP/HTTPS API

Metadata Update from @mharmsen:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1435710

Metadata Update from @mharmsen:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1435710

Metadata Update from @mharmsen:
- Custom field component adjusted to General
- Custom field feature adjusted to ''
- Custom field origin adjusted to Community
- Custom field proposedmilestone adjusted to ''
- Custom field proposedpriority adjusted to ''
- Custom field reviewer adjusted to ''
- Custom field type adjusted to defect
- Custom field version adjusted to ''
- Issue priority set to: critical

Per PKI Bug Council of 04/05/2017: 10.4 - critical

Potential cause of issue:
* https://pagure.io/freeipa/issue/6766 - Getting dogtag status stuck
* https://pagure.io/389-ds-base/issue/49209 - Hang due to omitted replica lock release

Hello,
The issue got worse, Dogtag now fails to start even during IPA master server installation on Fedora 26. I am getting an internal server exception:

2017-04-25T09:54:22Z DEBUG Waiting for CA to start...
2017-04-25T09:54:23Z DEBUG request POST http://vm-058-242.abc.idm.lab.eng.brq.redhat.com:8080/ca/admin/ca/getStatus
2017-04-25T09:54:23Z DEBUG request body ''
2017-04-25T09:54:23Z DEBUG response status 500
2017-04-25T09:54:23Z DEBUG response headers Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Language: en
Content-Length: 2351
Date: Tue, 25 Apr 2017 09:54:23 GMT
Connection: close
2017-04-25T09:54:23Z DEBUG response body '<!DOCTYPE html><html><head><title>Apache Tomcat/8.0.43 - Error report</title><style type="t
ext/css">H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,s
ans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:
#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,s
ans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}
A {color : black;}A.name {color : black;}.line {height: 1px; background-color: #525D76; border: none;}</style> </head><body><h1>HTTP 
Status 500 - Subsystem unavailable</h1><div class="line"></div><p><b>type</b> Exception report</p><p><b>message</b> <u>Subsystem unav
ailable</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u><
/p><p><b>exception</b></p><pre>javax.ws.rs.ServiceUnavailableException: Subsystem unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.f
indSecurityConstraints(ProxyRealm.java:138)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:498)
\n\torg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)\n\torg.apache.catalina.valves.AbstractAccessLogValve
.invoke(AbstractAccessLogValve.java:620)\n\torg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502)\n\torg.apache
.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1132)\n\torg.apache.coyote.AbstractProtocol$AbstractConne
ctionHandler.process(AbstractProtocol.java:684)\n\torg.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1533
)\n\torg.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1489)\n\tjava.util.concurrent.ThreadPoolExecutor.run
Worker(ThreadPoolExecutor.java:1142)\n\tjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\n\torg.apache
.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run(Thread.java:745)\n</pre><p><b>note</
b> <u>The full stack trace of the root cause is available in the Apache Tomcat/8.0.43 logs.</u></p><hr class="line"><h3>Apache Tomcat
/8.0.43</h3></body></html>'
2017-04-25T09:54:23Z DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500

This happens during the certificate server setup:

domain=${HOSTNAME/vm-/dom-}; sudo /usr/sbin/ipa-server-install -p milan_je_buh123 -a milan_je_buh123 --hostname $HOSTNAME --domain ${domain} -r ${domain^^} --setup-dns --no-reverse --auto-forwarders -U --domain-level 0
...
...
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
  [1/29]: configuring certificate server instance
  [2/29]: exporting Dogtag certificate store pin
  [3/29]: stopping certificate server instance to update CS.cfg
  [4/29]: backing up CS.cfg
  [5/29]: disabling nonces
  [6/29]: set up CRL publishing
  [7/29]: enable PKIX certificate path discovery and validation
  [8/29]: starting certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to restart the Dogtag instance.See the installation log for details.
  [9/29]: configure certmonger for renewals
  [10/29]: requesting RA certificate from CA
  [error] RuntimeError: Unable to retrieve CA chain: request failed with HTTP status 500
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR    Unable to retrieve CA chain: request failed with HTTP status 500
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Packages:
pki-server-10.3.5-12.fc26.noarch
389-ds-base-1.3.6.4-1.fc26.x86_64
freeipa-server-4.5.90-201704242205.fc26.x86_64

Closed as duplicate of https://pagure.io/389-ds-base/issue/49209

Metadata Update from @mharmsen:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)

Metadata Update from @mharmsen:
- Issue set to the milestone: 10.4.4 (was: 10.4)

Metadata Update from @mharmsen:
- Issue assigned to mharmsen

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2752

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Low
defect
''
''
Community
''
''
General
''
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.