freeipa

#7801 Unable to run `ipa-server-install`: Certificate issuance failed (CA_UNREACHABLE)
Closed: duplicate Opened by renmare.

Closed: duplicate
Reopen Issue

Issue

Unable to run ipa-server-install. I'm getting the error Certificate issuance failed (CA_UNREACHABLE)

Steps to Reproduce

  1. Run /usr/sbin/ipa-server-install --admin-password <redacted> --hostname=dc1.ipa.example.com --domain=ipa.example.com --ds-password=<redacted> --realm=IPA.EXAMPLE.COM --forwarder=10.1.224.2 --ip-address="10.1.239.7" --unattended --setup-dns
  2. Wait

Actual behavior

It fails with the following error:

  [6/29]: set up CRL publishing
  [7/29]: enable PKIX certificate path discovery and validation
  [8/29]: starting certificate server instance
  [9/29]: configure certmonger for renewals
  [10/29]: requesting RA certificate from CA
  [error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR    Certificate issuance failed (CA_UNREACHABLE)
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Expected behavior

Should continue without an error

Version/Release/Distribution

   $ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.5.0-22.amzn2.0.1.x86_64
ipa-client-4.5.0-22.amzn2.0.1.x86_64
389-ds-base-1.3.8.4-15.amzn2.0.1.x86_64
pki-ca-10.4.1-13.amzn2.0.2.noarch
krb5-server-1.15.1-20.amzn2.0.1.x86_64

Additional info:

 # cat /var/log/ipaserver-install.log
..
2018-12-09T18:31:33Z DEBUG stderr=
2018-12-09T18:31:33Z DEBUG   duration: 0 seconds
2018-12-09T18:31:33Z DEBUG   [10/29]: requesting RA certificate from CA
2018-12-09T18:31:33Z DEBUG Starting external process
2018-12-09T18:31:33Z DEBUG args=/usr/bin/openssl pkcs7 -inform DER -print_certs -out /var/lib/ipa/tmpAgu9Ut
2018-12-09T18:31:33Z DEBUG Process finished, return code=0
2018-12-09T18:31:33Z DEBUG stdout=
2018-12-09T18:31:33Z DEBUG stderr=
2018-12-09T18:31:33Z DEBUG certmonger request is in state dbus.String(u'NEWLY_ADDED_READING_KEYINFO', variant_level=1)
2018-12-09T18:31:38Z DEBUG certmonger request is in state dbus.String(u'CA_UNREACHABLE', variant_level=1)
2018-12-09T18:31:39Z DEBUG Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
    method()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 861, in __request_ra_certificate
    storage="FILE")
  File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py", line 317, in request_and_wait_for_cert
    raise RuntimeError("Certificate issuance failed ({})".format(state))
RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
2018-12-09T18:31:39Z DEBUG   [error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
2018-12-09T18:31:39Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in run
    cfgr.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 368, in run
    self.execute()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 392, in execute
    for _nothing in self._executor():
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure
    next(executor)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
    for _nothing in self._installer(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 578, in main
    master_install(self)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 248, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 798, in install
    ca.install_step_0(False, None, options)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 284, in install_step_0
    use_ldaps=standalone)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 447, in configure_instance
    self.start_creation(runtime=runtime)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
    method()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 861, in __request_ra_certificate
    storage="FILE")
  File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py", line 317, in request_and_wait_for_cert
    raise RuntimeError("Certificate issuance failed ({})".format(state))
2018-12-09T18:31:39Z DEBUG The ipa-server-install command failed, exception: RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
2018-12-09T18:31:39Z ERROR Certificate issuance failed (CA_UNREACHABLE)
2018-12-09T18:31:39Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

 # journalctl -n 10 -u certmonger
-- Logs begin at Wed 2018-11-28 21:20:16 UTC, end at Sun 2018-12-09 18:46:03 UTC. --
Dec 09 18:29:41 dc1.ipa.example.com systemd[1]: Started Certificate monitoring and PKI enrollment.
Dec 09 18:29:41 dc1.ipa.example.com ipa-submit[9875]: GSSAPI client step 1
Dec 09 18:29:41 dc1.ipa.example.com ipa-submit[9875]: GSSAPI client step 1
Dec 09 18:29:45 dc1.ipa.example.com systemd[1]: Stopping Certificate monitoring and PKI enrollment...
Dec 09 18:29:45 dc1.ipa.example.com systemd[1]: Stopped Certificate monitoring and PKI enrollment.
Dec 09 18:31:33 dc1.ipa.example.com systemd[1]: Starting Certificate monitoring and PKI enrollment...
Dec 09 18:31:33 dc1.ipa.example.com systemd[1]: Started Certificate monitoring and PKI enrollment.
Dec 09 18:31:33 dc1.ipa.example.com ipa-submit[11980]: GSSAPI client step 1
Dec 09 18:31:33 dc1.ipa.example.com ipa-submit[11980]: GSSAPI client step 1
Dec 09 18:31:35 dc1.ipa.example.com certmonger[11953]: 2018-12-09 18:31:35 [11953] Error 58 connecting to https://dc1.ipa.example.com:8443/ca/agent/ca//profileReview: Problem with the local S

 # curl https://dc1.ipa.example.com:8443/ca/agent/ca//profileReview
curl: (60) SSL certificate problem: self signed certificate in certificate chain
....

 # curl -sk https://dc1.ipa.example.com:8443/ca/agent/ca//profileReview | head
<!-- --- BEGIN COPYRIGHT BLOCK ---
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
     the Free Software Foundation; version 2 of the License.
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.

 # cat /etc/os-release
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"

Happy to post any logs/outputs.

So I've narrowed this down. It seems to be an issue with Amazon Linux 2. Running the same commands on RHEL seems to work fine. Any reason this would fail for AL2?

Closing as it's a duplicate of freeipa#7076
Edited by renmare

Metadata Update from @renmare:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.