freeipa

#8209 Installation with HSM fails due to timeout at step "configuring certificate renewals"
Closed: insufficientinfo by pcech. Opened by kaspro.

Closed: insufficientinfo
Reopen Issue

Issue

When trying to install a new instance with an HSM inserted (Nitrokey HSM2 - not the fastest), I get a DBUS- Timeout at some stage. The HSM is getting used properly and asks for the user PIN OK.
When the timeout occurs, I can see the HSM led flickering. Depending on the key size, operations can take up to a minute with this device.

cat /etc/redhat-release: Fedora release 30 (Thirty)
ipa-server-install --version: 4.8.3

Steps to Reproduce

  1. sudo ipa-server-install
  2. Install DNS: no
  3. Enter installation details and the HSM- User- PIN a few times...
  4. At point "DEBUG [20/29]: configure certificate renewals" - the HSM led flickers a long time ( > 20 sec), when the installation aborts (and the HSM led continues to flicker another ~20sec)

Actual behavior

The installation breaks with "The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information"

Expected behavior

The installation finishes successfully

Version/Release/Distribution

freeipa-server-4.8.3-1.fc30.x86_64
freeipa-client-4.8.3-1.fc30.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-1.4.1.15-1.fc30.x86_64
pki-ca-10.7.3-3.fc30.noarch
krb5-server-1.17-15.fc30.x86_64

Additional info:

2020-02-29T08:02:28Z DEBUG   [20/29]: configure certificate renewals
2020-02-29T08:02:28Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2020-02-29T08:02:49Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2020-02-29T08:03:14Z DEBUG Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 603, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 589, in run_step
    method()
  File "/usr/lib/python3.7/site-packages/ipaserver/install/dogtaginstance.py", line 344, in configure_renewal
    profile=self.tracking_reqs[nickname],
  File "/usr/lib/python3.7/site-packages/ipalib/install/certmonger.py", line 521, in start_tracking
    result = cm.obj_if.add_request(params)
  File "/usr/lib64/python3.7/site-packages/dbus/proxies.py", line 145, in __call__
    **keywords)
  File "/usr/lib64/python3.7/site-packages/dbus/connection.py", line 651, in call_blocking
    message, timeout)
dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
2020-02-29T08:03:14Z DEBUG   [error] DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
2020-02-29T08:03:14Z DEBUG Removing /root/.dogtag/pki-tomcat/ca
2020-02-29T08:03:14Z DEBUG   File "/usr/lib/python3.7/site-packages/ipapython/admintool.py", line 179, in execute
    return_value = self.run()
  File "/usr/lib/python3.7/site-packages/ipapython/install/cli.py", line 340, in run
    return cfgr.run()
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 360, in run
    return self.execute()
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 386, in execute
    for rval in self._executor():
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 431, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
    raise value
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 421, in __runner
    step()
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 418, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python3.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
    raise value
  File "/usr/lib/python3.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 655, in _configure
    next(executor)
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 431, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
    raise value
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
    raise value
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 421, in __runner
    step()
  File "/usr/lib/python3.7/site-packages/ipapython/install/core.py", line 418, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python3.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python3.7/site-packages/six.py", line 693, in reraise
    raise value
  File "/usr/lib/python3.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python3.7/site-packages/ipapython/install/common.py", line 65, in _install
    for unused in self._installer(self.parent):
  File "/usr/lib/python3.7/site-packages/ipaserver/install/server/__init__.py", line 557, in main
    master_install(self)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/server/install.py", line 255, in decorated
    func(installer)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/server/install.py", line 870, in install
    ca.install_step_0(False, None, options, custodia=custodia)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/ca.py", line 355, in install_step_0
    pki_config_override=options.pki_config_override,
  File "/usr/lib/python3.7/site-packages/ipaserver/install/cainstance.py", line 480, in configure_instance
    self.start_creation(runtime=runtime)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 603, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 589, in run_step
    method()
  File "/usr/lib/python3.7/site-packages/ipaserver/install/dogtaginstance.py", line 344, in configure_renewal
    profile=self.tracking_reqs[nickname],
  File "/usr/lib/python3.7/site-packages/ipalib/install/certmonger.py", line 521, in start_tracking
    result = cm.obj_if.add_request(params)
  File "/usr/lib64/python3.7/site-packages/dbus/proxies.py", line 145, in __call__
    **keywords)
  File "/usr/lib64/python3.7/site-packages/dbus/connection.py", line 651, in call_blocking
    message, timeout)
2020-02-29T08:03:14Z DEBUG The ipa-server-install command failed, exception: DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
2020-02-29T08:03:14Z ERROR org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
2020-02-29T08:03:14Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Please attach the full ipaserver-install.log and any override files you used for the installation. HSM support is still in its infancy.

Hi again,
no override files, attached is the log output.
ipaserver-install.log

There is no pki override and no references to any HSMs that we can see in this log, what makes you think it is an HSM issue?

It is failing trying to get certmonger to track an existing certificate. If this is reproducible it would be interesting to see the system journal to see what certmonger logged.

Closed due to inactivity. Feel free to reach out us again.

Metadata Update from @pcech:
- Issue close_status updated to: insufficientinfo
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.