freeipa

#8296 CentOS 8.1 IPA server 4.8.0 SSL issuance failure, step 12/21
Closed: worksforme by cheimes. Opened by guillemliarte.

Closed: worksforme
Reopen Issue

Issue

IPA server 4.8.0 fails on SSL Certificate issuance step.

[12/21]: setting up ssl
[error] RuntimeError: Certificate issuance failed (CA_REJECTED: None)
Certificate issuance failed (CA_REJECTED: None)

Steps to Reproduce

  1. Install CentOS 8.1
  2. Follow installation as per: https://www.freeipa.org/page/Quick_Start_Guide#Getting_started_with_IPA

Actual behaviour

installation halts at this step:

[10/21]: setting up httpd keytab [11/21]: configuring Gssproxy [12/21]: setting up ssl [error] RuntimeError: Certificate issuance failed (CA_REJECTED: None) Certificate issuance failed (CA_REJECTED: None) The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

The last portion of the installation log containing the error:

2020-04-28T09:30:53Z DEBUG step duration: httpd request_service_keytab 0.21 sec 2020-04-28T09:30:53Z DEBUG [11/21]: configuring Gssproxy 2020-04-28T09:30:53Z DEBUG Starting external process 2020-04-28T09:30:53Z DEBUG args=['/usr/sbin/selinuxenabled'] 2020-04-28T09:30:53Z DEBUG Process finished, return code=1 2020-04-28T09:30:53Z DEBUG stdout= 2020-04-28T09:30:53Z DEBUG stderr= 2020-04-28T09:30:53Z DEBUG Starting external process 2020-04-28T09:30:53Z DEBUG args=['/bin/systemctl', 'restart', 'gssproxy.service'] 2020-04-28T09:30:53Z DEBUG Process finished, return code=0 2020-04-28T09:30:53Z DEBUG stdout= 2020-04-28T09:30:53Z DEBUG stderr= 2020-04-28T09:30:53Z DEBUG Starting external process 2020-04-28T09:30:53Z DEBUG args=['/bin/systemctl', 'is-active', 'gssproxy.service'] 2020-04-28T09:30:53Z DEBUG Process finished, return code=0 2020-04-28T09:30:53Z DEBUG stdout=active

2020-04-28T09:30:53Z DEBUG stderr= 2020-04-28T09:30:53Z DEBUG Restart of gssproxy.service complete 2020-04-28T09:30:53Z DEBUG step duration: httpd configure_gssproxy 0.23 sec 2020-04-28T09:30:53Z DEBUG [12/21]: setting up ssl 2020-04-28T09:30:54Z DEBUG certmonger request is in state dbus.String('NEWLY_ADDED_READING_KEYINFO', variant_level=1) 2020-04-28T09:30:59Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:04Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:09Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:14Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:19Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:24Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:29Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:34Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:39Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:44Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:49Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:54Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:31:59Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:04Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:09Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:14Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:19Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:24Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:29Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:34Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:39Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:44Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:49Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:54Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:32:59Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:33:04Z DEBUG certmonger request is in state dbus.String('SUBMITTING', variant_level=1) 2020-04-28T09:33:09Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:33:09Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:33:09Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:33:19Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:33:24Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:33:24Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:33:24Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:33:34Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:33:39Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:33:39Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:33:39Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:33:49Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:33:54Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:33:54Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:33:54Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:34:04Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:34:09Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:34:09Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:34:09Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:34:19Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:34:24Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:34:24Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:34:24Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:34:34Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:34:39Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:34:39Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:34:39Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:34:49Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:34:54Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:34:54Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:34:54Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:35:04Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:35:09Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:35:09Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:35:09Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:35:19Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:35:24Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:35:24Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:35:24Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:35:34Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:35:39Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:35:39Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:35:39Z DEBUG Sleep and resubmit cert request 20200428093054 2020-04-28T09:35:49Z DEBUG certmonger request is in state dbus.String('GENERATING_CSR', variant_level=1) 2020-04-28T09:35:54Z DEBUG certmonger request is in state dbus.String('CA_REJECTED', variant_level=1) 2020-04-28T09:35:54Z DEBUG Cert request 20200428093054 failed: CA_REJECTED (None) 2020-04-28T09:35:54Z DEBUG Request 20200428093054 reached resubmit dead line 2020-04-28T09:35:54Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 603, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 589, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/httpinstance.py", line 388, in __setup_ssl resubmit_timeout=api.env.replication_wait_timeout File "/usr/lib/python3.6/site-packages/ipalib/install/certmonger.py", line 356, in request_and_wait_for_cert "Certificate issuance failed ({}: {})".format(state, ca_error) RuntimeError: Certificate issuance failed (CA_REJECTED: None)

2020-04-28T09:35:54Z DEBUG [error] RuntimeError: Certificate issuance failed (CA_REJECTED: None) 2020-04-28T09:35:54Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 340, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 557, in main master_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/install.py", line 255, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/install.py", line 909, in install ca_is_configured=setup_ca) File "/usr/lib/python3.6/site-packages/ipaserver/install/httpinstance.py", line 150, in create_instance self.start_creation() File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 603, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 589, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/httpinstance.py", line 388, in __setup_ssl resubmit_timeout=api.env.replication_wait_timeout File "/usr/lib/python3.6/site-packages/ipalib/install/certmonger.py", line 356, in request_and_wait_for_cert "Certificate issuance failed ({}: {})".format(state, ca_error)

2020-04-28T09:35:54Z DEBUG The ipa-server-install command failed, exception: RuntimeError: Certificate issuance failed (CA_REJECTED: None) 2020-04-28T09:35:54Z ERROR Certificate issuance failed (CA_REJECTED: None) 2020-04-28T09:35:54Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Expected behaviour

The installation to succeed.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 ipa-client-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 389-ds-base-1.4.1.3-7.module_el8.1.0+234+96aec258.x86_64 pki-ca-10.7.3-1.module_el8.1.0+238+005506d1.noarch krb5-server-1.17-9.el8.x86_64

CentOS Linux release 8.1.1911 (Core)

Additional info:

We found also issues with /usr/libexec/ipa/ipa-pki-wait-running. Despite the test passing if we would invoke it manually with nc, it would fail to test on 8080:

Apr 27 14:35:07 XXXX ipa-pki-wait-running[12372]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='xxxxx, port=8080): Read timed out. (read timeout=1.0)

We managed to advance on the installation by overriding that part, but probably something else is wrong somewhere else and we fail to identify it.

I have looked through the Troubleshooting guide, nothing matches our issue.
We can submit the entire log.

Should we try an older version?

Any help will be greatly appreciated.

During installation, before the failure from ipa-server-install.log, we see this:

==> /var/log/pki/pki-tomcat/ca/debug.2020-04-28.log <== 2020-04-28 10:35:42 [main] SEVERE: Unable to create socket: java.net.ConnectException: Connection timed out (Connection timed out) java.net.ConnectException: Connection timed out (Connection timed out) at java.net.PlainSocketImpl.socketConnect(Native Method) at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) at java.net.Socket.connect(Socket.java:607) at java.net.Socket.connect(Socket.java:556) at java.net.Socket.<init>(Socket.java:452) at java.net.Socket.<init>(Socket.java:262) at com.netscape.cmscore.ldapconn.PKISocketFactory.makeSSLSocket(PKISocketFactory.java:97) at com.netscape.cmscore.ldapconn.PKISocketFactory.makeSocket(PKISocketFactory.java:134) at netscape.ldap.LDAPConnSetupMgr.connectServer(Unknown Source) at netscape.ldap.LDAPConnSetupMgr.openSerial(Unknown Source) at netscape.ldap.LDAPConnSetupMgr.connect(Unknown Source) at netscape.ldap.LDAPConnSetupMgr.openConnection(Unknown Source) at netscape.ldap.LDAPConnThread.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at com.netscape.cmscore.ldapconn.LdapBoundConnection.<init>(LdapBoundConnection.java:104) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory$BoundConnection.<init>(LdapBoundConnFactory.java:667) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:286) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:262) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:225) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:194) at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:665) at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:817) at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:684) at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:675) at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:457) at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:105) at javax.servlet.GenericServlet.init(GenericServlet.java:158) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123) at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1112) at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1079) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:971) at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4788) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5100) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:742) at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:130) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:151) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:141) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:716) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:703) at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:630) at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1839) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:112) at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:525) at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:424) at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1585) at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:308) at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:123) at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:424) at org.apache.catalina.util.LifecycleBase.setState(LifecycleBase.java:367) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:966) at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:839) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1427) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1417) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:134) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:943) at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:258) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardService.startInternal(StandardService.java:422) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:770) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.startup.Catalina.start(Catalina.java:682) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:350) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:492)

I don't understand your comment about ipa-pki-wait-running. This doesn't wait for a port to become available, it uses the PKI python API to determine when the service is actually running. The CA is a series of Java applications so tomcat being running does not mean the CA is ready to accept requests. That is what ipa-pki-wait-running handles.

So what do you mean by overriding that part?

I'd also look for OOM errors in case the kernel is killing it as it starts.

Hello.

With override I mean that we cheated the script to not run the test and let us go further.

So, We managed to make it work, but we are not sure if the situation is the correct. This is what happened:

We are running it in an instance in AWS. We requested a PTR so the forward and backward resolution agree.

BUT using that public IP does NOT seem to work well. Only the local private IP is taken into consideration. Doing the obvious in /etc/hosts makes the installer to succeed.

Now my question:

  • Are we likely to run into problems given that the external DNS resolution for the hostname is using the PUBLIC IP but for the host, the same name is used by the private IP?

  • And more generally, given that lots of deployments may happen in public or private cloud environments, would it not make sense to have a provision for situations where the local configured IP is not the one associated with the hostname?

If i was to follow the instructions as they are, I would have to think that what I just did is a cheat.

ldap.example.com is seen externally as 1.2.3.4 but internally is 10.0.0.3. Is that OK for IPA?

Also, leaving all that aside, NONE of the errors seen or obtained in logs or in stout pointed out the IP 'mismatch' as the source of the issue. There was only an early WARNING that did not stop the process. Even more, most of the configuration succeeds without any problems.

What do you think?

I have successfully installed IPA on a CentOS 8 box with all latest updates today. The packages are:

ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64
ipa-client-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64
389-ds-base-1.4.1.3-7.module_el8.1.0+234+96aec258.x86_64
pki-ca-10.7.3-1.module_el8.1.0+238+005506d1.noarch
krb5-server-1.17-9.el8.x86_64

You might be running into issues with DNS, FQDNs and IP addresses. IPA is very picky when it comes to correct DNS setup. Which warning message did you see?

I'm closing the ticket because there was no activity in a month. Please reopen the ticket if you are still having issues.

Metadata Update from @cheimes:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.