fedora-infrastructure

#12689 STG : unable to get TLS .csr signed by ipa through fasjson.stg.fedoraproject.org
Closed: Fixed by arrfab. Opened by arrfab.

Closed: Fixed
Reopen Issue

It seems that IPA doesn't process the tls cert signing operation requested through fasjson (stg) : 

[+] 20250729-07:42 centos-cert -> Validating user [arrfab] with realm [STG.FEDORAPROJECT.ORG] against https://fasjson.stg.fedoraproject.org
[+] 20250729-07:42 centos-cert -> We can reach [https://fasjson.stg.fedoraproject.org] with realm [arrfab@STG.FEDORAPROJECT.ORG], so now asking for TLS cert ...
Generating CSR...
Uploading CSR for signature...
Error: could not sign the CSR (400: Failed to authenticate to CA REST API, {'message': 'Failed to authenticate to CA REST API', 'code': 4016, 'source': 'RPC'}).
[+] 20250729-07:42 centos-cert -> [ISSUE] : Unable to retrieve TLS cert

Can someone investigate what's happening ?

Metadata Update from @zlopez:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: Needs investigation, medium-gain, ops, staging

Metadata Update from @zlopez:
- Issue assigned to zlopez

Here is what I tried for now:

  • Checking the fasjson points to correct IPA instance (it does)
  • Running playbook again
  • Rebuilding the fasjson

So after some investigation with @arrfab we found out that the issue is probably not on fasjson side, but we found error in IPA logs

arrfab@STG.FEDORAPROJECT.ORG: cert_request('-----BEGIN CERTIFICATE REQUEST-----XXX\\n-----END CERTIFICATE REQUEST-----\\n', request_type='pkcs10', profile_id='user Certs', cacn='ipa', principal='arrfab', add=False, chain=False, all=True, raw=False, version='2.235'): RemoteRetrieveError

I contacted freeIPA folks if they can provide some hints at what could cause this.

It's likely this: 

[root@ipa01 ~][STG]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
pki-tomcatd Service: STOPPED
ipa-otpd Service: RUNNING
1 service(s) are not running

ie, pki-tomcatd wasn't running.

I did a restart of it, is it working now?

@kevin : thanks .. that's what I initially asked to verify ..
Anyway, thanks, it's now working so can be closed : 

centos-cert -u arrfab -r STG.FEDORAPROJECT.ORG -f https://fasjson.stg.fedoraproject.org
[+] 20250729-18:23 centos-cert -> Validating user [arrfab] with realm [STG.FEDORAPROJECT.ORG] against https://fasjson.stg.fedoraproject.org
[+] 20250729-18:23 centos-cert -> We can reach [https://fasjson.stg.fedoraproject.org] with realm [arrfab@STG.FEDORAPROJECT.ORG], so now asking for TLS cert ...
Generating CSR...
Uploading CSR for signature...
Certificate generated, signed and written to /home/arrfab/.centos-arrfab.crt

Metadata Update from @arrfab:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Strange, I checked the pki-tomcatd systemd service and that was running. Next time I need to try ipactl status as well.

Yeah, I couldn't find anything in the logs... it only showed when I restarted it. ;(

I think ipactl status does more than confirm the service is running? ie, it does some kind of ping to make sure it's also processing?
Metadata

Needs investigation medium-gain ops staging

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.