dogtagpki

#897 IPA Replica installation fails when using an external CA
Closed: Invalid Opened by mharmsen.

Closed: Invalid
Reopen Issue

Description of problem: IPA Replica installation fails when using an external CA

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-30.el6

How reproducible:
Always

Steps to Reproduce:

1.1. install IPA server with:
# ipa-server-install -a --hostname=ipa-master-01.nix.example.com \
-n nix.example.com -p -r NIX.EXAMPLE.COM --setup-dns \
--forwarder=192.168.122.111 --forwarder=192.168.122.112 --idstart=6000 --external-ca -U
1.2. Have the CA request signed by external CA
1.3. Complete the installation:

ipa-server-install --external_cert_file=/root/IDM.cer --external_ca_file=/root/RootCa.crt

  1. Install IPA replica.
    2.1. On master:

ipa-replica-prepare ipa-replica-01.nix.example.com --ip-address 192.168.122.192

scp /var/lib/ipa/replica-info-ipa-replica-01.nix.example.com.gpg ipa-replica-01.nix.example.com:/var/lib/ipa/

2.2. On Replica Server:

ipa-replica-install --setup-ca --setup-dns --forwarder=192.168.122.111 --forwarder=192.168.122.112 /var/lib/ipa/replica-info-ipa-replica-01.nix.example.com.gpg

Actual results:
Installation fails with:
Directory Manager (existing master) password:

Run connection check to master
Check connection from replica to remote master 'ipa-master-01.nix.example.com':
Directory Service: Unsecure port (389): OK
Directory Service: Secure port (636): OK
Kerberos KDC: TCP (88): OK
Kerberos Kpasswd: TCP (464): OK
HTTP Server: Unsecure port (80): OK
HTTP Server: Secure port (443): OK
PKI-CA: Directory Service port (7389): OK

The following list of ports use UDP protocol and would need to be
checked manually:
Kerberos KDC: UDP (88): SKIPPED
Kerberos Kpasswd: UDP (464): SKIPPED

Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
admin@NIX.EXAMPLE.COM password:

Execute check on remote master
Check connection from master to remote replica 'ipa-replica-01.nix.example.com':
Directory Service: Unsecure port (389): OK
Directory Service: Secure port (636): OK
Kerberos KDC: TCP (88): OK
Kerberos KDC: UDP (88): OK
Kerberos Kpasswd: TCP (464): OK
Kerberos Kpasswd: UDP (464): OK
HTTP Server: Unsecure port (80): OK
HTTP Server: Secure port (443): OK
PKI-CA: Directory Service port (7389): OK

Connection from master to replica is OK.

Connection check OK
Configuring NTP daemon (ntpd)
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server for the CA (pkids): Estimated time 30 seconds
[1/3]: creating directory server user
[2/3]: creating directory server instance
[3/3]: restarting directory server
Done configuring directory server for the CA (pkids).
Configuring certificate server (pki-cad): Estimated time 3 minutes 30 seconds
[1/17]: creating certificate server user
[2/17]: creating pki-ca instance
[3/17]: configuring certificate server instance
ipa : CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname ipa-replica-01.nix.example.com -cs_port 9445 -client_certdb_dir /tmp/tmp-UlMiMD -client_certdb_pwd XXXXXXXX -preop_pin MAXPWrHvrrqC9dsIfdaO -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=NIX.EXAMPLE.COM -ldap_host ipa-replica-01.nix.example.com -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=NIX.EXAMPLE.COM -ca_subsystem_cert_subject_name CN=CA Subsystem,O=NIX.EXAMPLE.COM -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=NIX.EXAMPLE.COM -ca_server_cert_subject_name CN=ipa-replica-01.nix.example.com,O=NIX.EXAMPLE.COM -ca_audit_signing_cert_subject_name CN=CA Audit,O=NIX.EXAMPLE.COM -ca_sign_cert_subject_name CN=Certificate Authority,O=NIX.EXAMPLE.COM -external false -clone true -clone_p12_file ca.p12 -clone_p12_password XXXXXXXX -sd_hostname ipa-master-01.nix.example.com -sd_admin_port 443 -sd_admin_name admin -sd_admin_password XXXXXXXX -clone_start_tls true -clone_uri https://ipa-master-01.nix.example.com:443' returned non-zero exit status 255

Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

Configuration of CA failed

Expected results:

Additional info:

  • Proposed milestone: 10.2 (May)

This bug was originally cloned from Bugzilla Bug #1051382 - IPA Replica installation fails when using an external CA, and I believe was only ever reported by a customer running an IPA Replica on RHEL 6.

The customer in the bug was utilizing a Microsoft CA and had apparently somehow introduced non-XML compliant characters (possibly by utilizing Microsoft Word as an editor?). A "patch" was produced to gather further debug information, but since the patch "filtered" out bad XML characters, it sufficed to allow the customer to complete their deployment. As such, this patch will be included in future versions of RHEL 6.

While studying a similar XML problem in [Bugzilla Bug #1096142 - IPA replica setup fails during CA setup with "unable to parse xml"], it was discovered that the problem (similar to the issue described above) only appeared to occur when the 'pki-silent' batch-based configuration tool was being utilized (testing of the Firefox GUI-based configuration methods were unable to encounter any problems related to XML). Testing of the Dogtag 10 'pkispawn' batch-based REST interface method (the Dogtag 10 replacement for the RHEL 6 'pki-silent' batched base method) in https://fedorahosted.org/pki/ticket/1033 PKI TRAC Ticket #1033 - IPA replica setup fails during CA setup with "unable to parse xml" proved that the XML parsing issue did not occur in the Dogtag 10 code base.

Consequently, since to my knowledge, we have never had a case of this issue reported against Dogtag 10 in Fedora, and we have no viable test data to successfully replicate this issue in Fedora, I am closing this bug as 'wontfix'.

If, at a later date, this issue is encountered on Fedora, and can be replicated, then this bug may be re-opened, or a new bug can be filed at this time. Basically, the "patch" provided in Bugzilla Bug #1051382 - IPA Replica installation fails when using an external CA would need to be applied to the source file 'pki/base/util/src/com/netscape/cmsutil/xml/XMLObject.java'. However, this could potentially cause side-effects, as this was the same code utilized by the Firefox GUI-based configuration which exhibited no issues.

Metadata Update from @mharmsen:
- Issue assigned to mharmsen
- Issue set to the milestone: 10.2 - 06/14 (June)

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1464

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Low
defect
Installation/Configuration
RHCust
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.