freeipa

#9797 Nightly failure in test_installation_TestKRAinstallAfterCertRenew - connection to CA refused
Closed: duplicate by mpolovka. Opened by mpolovka.

Closed: duplicate
Reopen Issue

The nightly test test_installation_TestKRAinstallAfterCertRenew is failing in master nightly selinux pipeline with an error

CalledProcessError(Command ['/bin/systemctl', 'restart', 'ipa.service'] returned non-zero exit status 1: 'Job for ipa.service failed because the control process exited with error code.\nSee "systemctl status ipa.service" and "journalctl -xeu ipa.service" for details.\n')
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

The content of var/log/ipaserver-install.log shows:

2025-04-28T07:45:40Z DEBUG   [26/33]: importing IPA certificate profiles
2025-04-28T07:45:40Z DEBUG Discovery: no 'CA' service found.
2025-04-28T07:45:40Z DEBUG request GET https://master.ufreeipa.test:443/ca/rest/account/login
2025-04-28T07:45:40Z DEBUG request body ''
2025-04-28T07:45:40Z DEBUG httplib request failed:
Traceback (most recent call last):
  File "/usr/lib/python3.13/site-packages/ipapython/dogtag.py", line 271, in _httplib_request
    conn.request(method, path, body=request_body, headers=headers)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.13/http/client.py", line 1338, in request
    self._send_request(method, url, body, headers, encode_chunked)
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.13/http/client.py", line 1384, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.13/http/client.py", line 1333, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.13/http/client.py", line 1093, in _send_output
    self.send(msg)
    ~~~~~~~~~^^^^^
  File "/usr/lib64/python3.13/http/client.py", line 1037, in send
    self.connect()
    ~~~~~~~~~~~~^^
  File "/usr/lib64/python3.13/http/client.py", line 1472, in connect
    super().connect()
    ~~~~~~~~~~~~~~~^^
  File "/usr/lib64/python3.13/http/client.py", line 1003, in connect
    self.sock = self._create_connection(
                ~~~~~~~~~~~~~~~~~~~~~~~^
        (self.host,self.port), self.timeout, self.source_address)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.13/socket.py", line 864, in create_connection
    raise exceptions[0]
  File "/usr/lib64/python3.13/socket.py", line 849, in create_connection
    sock.connect(sa)
    ~~~~~~~~~~~~^^^^
ConnectionRefusedError: [Errno 111] Connection refused
2025-04-28T07:45:40Z DEBUG Overriding CA port: cannot connect to 'https://master.ufreeipa.test:443/ca/rest/account/login': [Errno 111] Connection refused

Potentially relevant part of the log:

2025-04-28T07:45:41Z DEBUG response body (decoded): b'{"Attributes":{"Attribute":[]},"ClassName":"com.netscape.certsrv.base.ConflictingOperationException","Code":409,"Message":"Unable to create profile: Profile already exists"}'
2025-04-28T07:45:41Z DEBUG Error migrating 'caIPAserviceCert': Request failed with status 409: Non-2xx response from CA REST API: 409. Unable to create profile: Profile already exists
2025-04-28T07:45:41Z DEBUG request POST https://master.ufreeipa.test:8443/ca/rest/profiles/caIPAserviceCert?action=disable
2025-04-28T07:45:41Z DEBUG request body ''
2025-04-28T07:45:42Z DEBUG response status 204
2025-04-28T07:45:42Z DEBUG response headers Content-Type: application/json
Date: Mon, 28 Apr 2025 07:45:42 GMT

Links in the next comment.

The log part related to Unable to create profile: Profile already exists can be ignored. The first important error is related to named failing to start:

Done configuring DNS key synchronization service (ipa-dnskeysyncd).
Restarting ipa-dnskeysyncd
Restarting named
named service failed to start
Named service failed to start (CalledProcessError(Command ['/bin/systemctl', 'restart', 'named.service'] returned non-zero exit status 1: 'Job for named.service failed because the control process exited with error code.\nSee "systemctl status named.service" and "journalctl -xeu named.service" for details.\n'))
Updating DNS system records
Configuring SID generation

The journal does not provide a lot of information:

Apr 28 07:48:18 master.ufreeipa.test named[29257]: starting BIND 9.18.35 (Extended Support Version) <id:>
Apr 28 07:48:18 master.ufreeipa.test named[29257]: running on Linux x86_64 6.14.0-63.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Mar 24 19:53:37 UTC 2025
Apr 28 07:48:18 master.ufreeipa.test named[29257]: built with  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/bin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--runstatedir=/run' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--localstatedir=/var' '--with-pic' '--disable-static' '--includedir=/usr/include/bind9' '--with-tuning=large' '--with-libidn2' '--with-maxminddb' '--with-gssapi=yes' '--with-lmdb=yes' '--with-json-c' '--enable-dnstap' '--with-cmocka' '--without-jemalloc' '--enable-fixed-rrset' '--enable-full-report' 'CPPFLAGS= -DOPENSSL_NO_ENGINE=1' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CC=gcc' 'CFLAGS=-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer ' 'LDFLAGS=-Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes ' 'LT_SYS_LIBRARY_PATH=/usr/lib64:' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'
Apr 28 07:48:18 master.ufreeipa.test named[29257]: running as: named -u named -c /etc/named.conf -E pkcs11
Apr 28 07:48:18 master.ufreeipa.test named[29257]: compiled by GCC 15.0.1 20250228 (Red Hat 15.0.1-0)
Apr 28 07:48:18 master.ufreeipa.test named[29257]: compiled with OpenSSL version: OpenSSL 3.2.4 11 Feb 2025
Apr 28 07:48:18 master.ufreeipa.test named[29257]: linked to OpenSSL version: OpenSSL 3.2.4 11 Feb 2025
Apr 28 07:48:18 master.ufreeipa.test named[29257]: compiled with libuv version: 1.50.0
Apr 28 07:48:18 master.ufreeipa.test named[29257]: linked to libuv version: 1.51.0
Apr 28 07:48:18 master.ufreeipa.test named[29257]: compiled with libxml2 version: 2.12.10
Apr 28 07:48:18 master.ufreeipa.test named[29257]: linked to libxml2 version: 21210
Apr 28 07:48:18 master.ufreeipa.test named[29257]: compiled with json-c version: 0.18
Apr 28 07:48:18 master.ufreeipa.test named[29257]: linked to json-c version: 0.18
Apr 28 07:48:18 master.ufreeipa.test named[29257]: compiled with zlib version: 1.3.1.zlib-ng
Apr 28 07:48:18 master.ufreeipa.test named[29257]: linked to zlib version: 1.3.1.zlib-ng
Apr 28 07:48:18 master.ufreeipa.test named[29257]: ----------------------------------------------------
Apr 28 07:48:18 master.ufreeipa.test named[29257]: BIND 9 is maintained by Internet Systems Consortium,
Apr 28 07:48:18 master.ufreeipa.test named[29257]: Inc. (ISC), a non-profit 501(c)(3) public-benefit
Apr 28 07:48:18 master.ufreeipa.test named[29257]: corporation.  Support and training for BIND 9 are
Apr 28 07:48:18 master.ufreeipa.test named[29257]: available at https://www.isc.org/support
Apr 28 07:48:18 master.ufreeipa.test named[29257]: ----------------------------------------------------
Apr 28 07:48:18 master.ufreeipa.test named[29257]: adjusted limit on open files from 524288 to 1048576
Apr 28 07:48:18 master.ufreeipa.test named[29257]: found 2 CPUs, using 2 worker threads
Apr 28 07:48:18 master.ufreeipa.test named[29257]: using 2 UDP listeners per interface
Apr 28 07:48:18 master.ufreeipa.test named[29257]: initializing DST: no engine
Apr 28 07:48:18 master.ufreeipa.test named[29257]: exiting (due to fatal error)
Apr 28 07:48:18 master.ufreeipa.test systemd[1]: named.service: Control process exited, code=exited, status=1/FAILURE
Apr 28 07:48:18 master.ufreeipa.test systemd[1]: named.service: Failed with result 'exit-code'.

Unfortunately the test didn't collect the named logs.

We fixed the integration with OpenSSL with this commit Use OpenSSL provider with BIND for Fedora 42+ and RHEL10+ pushed May 06 into the branch, do you still see the same issue?
If not I would close as duplicate of https://pagure.io/freeipa/issue/9696

Metadata Update from @mpolovka:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)

Duplicate of https://pagure.io/freeipa/issue/9696
Metadata
None

test-failure tests

None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.