Issue

Yesterday I tried migrating a physical machine (ipa1) that was a FreeIPA CA CRL master in my VM cluster. I followed the guide at [1] to migrate che CRL master to another replica (ipa2) and uninstalled the replica ipa1. Then I set up a VM with the same hostname and IP address as the physical machine, and installed Fedora 27.

When I tried setting up the replica with CA, the install seemed to hang indefinitely at:

[4/25]: configuring certificate server instance

And in my /var/log/pki/pki-tomcat/ca/debug I see a bunch of log entries like this, with increasing time stamps:

Unable to read key retriever class from CS.cfg: Property features.authority.keyRetrieverClass missing value
Retrying in 14778 seconds

I checked the /etc/pki/pki-tomcat/ca/CS.cfg file and I don’t actually have that entry at all, I only have:

features.authority.description=Lightweight CAs
features.authority.enabled=true
features.authority.version=1.0

However, if I manually add them by copying the value from the good replica, nothing changes and the installer is still blocked on that line (maybe the CS.cfg file isn’t re-read on each retry).

Moreover, it looks like that file (CS.cfg) is generated by the installer script…

Steps to Reproduce

1.
2.
3.

Actual behavior

Install process hangs indefinitely

Expected behavior

install process should complete successfully or throw an error to the user

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.6.1-3.fc27.x86_64
freeipa-client-4.6.1-3.fc27.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-1.3.7.8-1.fc27.x86_64
pki-ca-10.5.1-1.fc27.noarch
krb5-server-1.15.2-4.fc27.x86_64

Additional info:

I tried reinstalling the VM from scratch, but the problem persisted.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting