Issue

When running the install, I am hit with this:
[10/29]: requesting RA certificate from CA
[error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR Certificate issuance failed (CA_UNREACHABLE)
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Steps to Reproduce

1. yum install freeipa-server
2. ipa-server-install

Actual behavior

Installer stops at step 10/29 (Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes)

Expected behavior

Installer to complete.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.5.0-21.el7_4.2.2.x86_64
ipa-client-4.5.0-21.el7_4.2.2.x86_64
389-ds-base-1.3.6.1-21.el7_4.x86_64
pki-ca-10.4.1-13.el7_4.noarch
krb5-server-1.15.1-8.el7.x86_64

Operating System:
Red Hat Enterprise Linux Server release 7.4 (Maipo)

Additional info:

After the failed install:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:749 0.0.0.0: LISTEN 27091/kadmind
tcp 0 0 0.0.0.0:111 0.0.0.0: LISTEN 1/systemd
tcp 0 0 0.0.0.0:464 0.0.0.0: LISTEN 27091/kadmind
tcp 0 0 0.0.0.0:22 0.0.0.0: LISTEN 981/sshd
tcp 0 0 0.0.0.0:88 0.0.0.0: LISTEN 27062/krb5kdc
tcp6 0 0 :::749 ::: LISTEN 27091/kadmind
tcp6 0 0 :::111 ::: LISTEN 1/systemd
tcp6 0 0 :::464 ::: LISTEN 27091/kadmind
tcp6 0 0 :::22 ::: LISTEN 981/sshd
tcp6 0 0 :::88 ::: LISTEN 27062/krb5kdc
tcp6 0 0 :::389 :::* LISTEN 26937/ns-slapd

I'll paste the pertinent part of the log here. Sorry if this is deemed messy, I thought it would make it faster to view. I can attach the full log if needed. Just ask.

2017-11-24T05:55:36Z DEBUG [10/29]: requesting RA certificate from CA
2017-11-24T05:55:36Z DEBUG Starting external process
2017-11-24T05:55:36Z DEBUG args=/usr/bin/openssl pkcs7 -inform DER -print_certs -out /var/lib/ipa/tmpj78oEt
2017-11-24T05:55:36Z DEBUG Process finished, return code=0
2017-11-24T05:55:36Z DEBUG stdout=
2017-11-24T05:55:36Z DEBUG stderr=
2017-11-24T05:55:38Z DEBUG certmonger request is in state dbus.String(u'NEWLY_ADDED_READING_KEYINFO', variant_level=1)
2017-11-24T05:55:44Z DEBUG certmonger request is in state dbus.String(u'SUBMITTING', variant_level=1)
2017-11-24T05:55:51Z DEBUG certmonger request is in state dbus.String(u'SUBMITTING', variant_level=1)
2017-11-24T05:55:56Z DEBUG certmonger request is in state dbus.String(u'CA_UNREACHABLE', variant_level=1)
2017-11-24T05:55:56Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 861, in __request_ra_certificate
storage="FILE")
File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py", line 317, in request_and_wait_for_cert
raise RuntimeError("Certificate issuance failed ({})".format(state))
RuntimeError: Certificate issuance failed (CA_UNREACHABLE)

2017-11-24T05:55:56Z DEBUG [error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
2017-11-24T05:55:56Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 368, in run
self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 392, in execute
for _nothing in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
for _nothing in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init.py", line 578, in main
master_install(self)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 248, in decorated
func(installer)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 798, in install
ca.install_step_0(False, None, options)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 284, in install_step_0
use_ldaps=standalone)
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 447, in configure_instance
self.start_creation(runtime=runtime)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 861, in __request_ra_certificate
storage="FILE")
File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py", line 317, in request_and_wait_for_cert
raise RuntimeError("Certificate issuance failed ({})".format(state))

2017-11-24T05:55:56Z DEBUG The ipa-server-install command failed, exception: RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
2017-11-24T05:55:56Z ERROR Certificate issuance failed (CA_UNREACHABLE)
2017-11-24T05:55:56Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information