Issue

ipa-replica-install ...
Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes
[1/10]: creating ACIs for admin
[2/10]: creating installation admin user
[3/10]: configuring KRA instance
Enter Password or Pin for "ipa_token":

It is hung up in pkispawn waiting for the token for:

certutil -L -d /etc/pki/pki-tomcat/alias -h internal -f/etc/pki/pki-tomcat/pfile -n 'Directory Server CA certificate'

In pki it looks like this is an existence check. If we add -a to that command it should continue without prompting.

In base/server/python/pki/server/deployment/init.py:

            exists = self.certutil.verify_certificate_exists(
                path=self.instance.nssdb_dir,
                token=self.mdict['pki_self_signed_token'],
                nickname=self.mdict['pki_ds_secure_connection_ca_nickname'],
                password_file=pki_shared_pfile)

freeipa-server-4.12.0-1.fc40.x86_64
dogtag-pki-ca-11.5.0-3.fc40.noarch