freeipa

#9834 KRA installation failure in FIPS mode (rawhide)
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

Installation of the KRA fails in rawhide in FIPS mode.

Steps to Reproduce

  1. Create a rawhide Vm booted in FIPS mode
  2. Install freeipa-server-dns package
  3. Install ipa server with a KRA:
# ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --forwarder 10.11.5.160 -a Secret123 -p Secret123 --setup-kra -U
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
Version 4.12.2
This includes:
  * Configure a stand-alone CA (dogtag) for certificate management
  * Configure the NTP client (chronyd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)
  * Configure KRA (dogtag) for secret management
  * Configure DNS (bind)
  * Configure SID generation
  * Configure the KDC to enable PKINIT
Warning: skipping DNS resolution of host server.ipa.test
Checking DNS domain ipa.test., please wait ...
Checking DNS forwarders, please wait ...
Trust is configured but no NetBIOS domain name found, setting it now.
The IPA Master Server will be configured with:
Hostname:       server.ipa.test
IP address(es): 10.0.186.213
Domain name:    ipa.test
Realm name:     IPA.TEST
The CA will be configured with:
Subject DN:   CN=Certificate Authority,O=IPA.TEST
Subject base: O=IPA.TEST
Chaining:     self-signed
BIND DNS server will be configured to serve IPA domain with:
Forwarders:       10.11.5.160
Forward policy:   only
Reverse zone(s):  No reverse zone
Disabled p11-kit-proxy
Synchronizing time
No SRV records of NTP servers found and no NTP server or pool address was provided.
Using default chrony configuration.
Attempting to sync time with chronyc.
Process chronyc waitsync failed to sync time!
Unable to sync time with chrony server, assuming the time is in sync. Please check that 123 UDP port is opened, and any time server is on network.
Warning: IPA was unable to sync time with chrony!
         Time synchronization is required for IPA to work correctly
Configuring directory server (dirsrv). Estimated time: 30 seconds
  [1/42]: creating directory server instance
Validate installation settings ...
Create file system structures ...
Perform SELinux labeling ...
Create database backend: dc=ipa,dc=test ...
Perform post-installation tasks ...
  [2/42]: adding default schema
  [3/42]: enabling memberof plugin
  [4/42]: enabling winsync plugin
  [5/42]: configure password logging
  [6/42]: configuring replication version plugin
  [7/42]: enabling IPA enrollment plugin
  [8/42]: configuring uniqueness plugin
  [9/42]: configuring uuid plugin
  [10/42]: configuring modrdn plugin
  [11/42]: configuring DNS plugin
  [12/42]: enabling entryUSN plugin
  [13/42]: configuring lockout plugin
  [14/42]: configuring graceperiod plugin
  [15/42]: configuring topology plugin
  [16/42]: creating indices
  [17/42]: enabling referential integrity plugin
  [18/42]: configuring certmap.conf
  [19/42]: configure new location for managed entries
  [20/42]: configure dirsrv ccache and keytab
  [21/42]: enabling SASL mapping fallback
  [22/42]: restarting directory server
  [23/42]: adding sasl mappings to the directory
  [24/42]: adding default layout
  [25/42]: adding delegation layout
  [26/42]: creating container for managed entries
  [27/42]: configuring user private groups
  [28/42]: configuring netgroups from hostgroups
  [29/42]: creating default Sudo bind user
  [30/42]: creating default Auto Member layout
  [31/42]: adding range check plugin
  [32/42]: creating default HBAC rule allow_all
  [33/42]: adding entries for topology management
  [34/42]: initializing group membership
  [35/42]: adding master entry
  [36/42]: initializing domain level
  [37/42]: configuring Posix uid/gid generation
  [38/42]: adding replication acis
  [39/42]: activating sidgen plugin
  [40/42]: activating extdom plugin
  [41/42]: configuring directory to start on boot
  [42/42]: restarting directory server
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc)
  [1/11]: adding kerberos container to the directory
  [2/11]: configuring KDC
  [3/11]: initialize kerberos container
  [4/11]: adding default ACIs
  [5/11]: creating a keytab for the directory
  [6/11]: creating a keytab for the machine
  [7/11]: adding the password extension to the directory
  [8/11]: creating anonymous principal
  [9/11]: starting the KDC
  [10/11]: configuring KDC to start on boot
  [11/11]: enable PAC ticket signature support
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin 
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa-custodia
  [1/5]: Making sure custodia container exists
  [2/5]: Generating ipa-custodia config file
  [3/5]: Generating ipa-custodia keys
  [4/5]: starting ipa-custodia 
  [5/5]: configuring ipa-custodia to start on boot
Done configuring ipa-custodia.
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
  [1/32]: configuring certificate server instance
  [2/32]: stopping certificate server instance to update CS.cfg
  [3/32]: backing up CS.cfg
  [4/32]: Add ipa-pki-wait-running
Set start up timeout of pki-tomcatd service to 90 seconds
  [5/32]: secure AJP connector
  [6/32]: reindex attributes
  [7/32]: exporting Dogtag certificate store pin
  [8/32]: disabling nonces
  [9/32]: set up CRL publishing
  [10/32]: enable PKIX certificate path discovery and validation
  [11/32]: authorizing RA to modify profiles
  [12/32]: authorizing RA to manage lightweight CAs
  [13/32]: Ensure lightweight CAs container exists
  [14/32]: Enable lightweight CA monitor
  [15/32]: Ensuring backward compatibility
  [16/32]: updating IPA configuration
  [17/32]: starting certificate server instance
  [18/32]: configure certmonger for renewals
  [19/32]: requesting RA certificate from CA
  [20/32]: publishing the CA certificate
  [21/32]: adding RA agent as a trusted user
  [22/32]: configure certificate renewals
  [23/32]: Configure HTTP to proxy connections
  [24/32]: enabling CA instance
  [25/32]: importing IPA certificate profiles
  [26/32]: migrating certificate profiles to LDAP
  [27/32]: adding default CA ACL
  [28/32]: adding 'ipa' CA entry
  [29/32]: Recording random serial number state
  [30/32]: Recording HSM configuration state
  [31/32]: configuring certmonger renewal for lightweight CAs
  [32/32]: deploying ACME service
Done configuring certificate server (pki-tomcatd).
Configuring directory server (dirsrv)
  [1/3]: configuring TLS for DS instance
  [2/3]: adding CA certificate entry
  [3/3]: restarting directory server
Done configuring directory server (dirsrv).
Configuring ipa-otpd
  [1/2]: starting ipa-otpd 
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Configuring the web interface (httpd)
  [1/21]: stopping httpd
  [2/21]: backing up ssl.conf
  [3/21]: configuring mod_ssl certificate paths
  [4/21]: setting mod_ssl protocol list
  [5/21]: configuring mod_ssl log directory
  [6/21]: disabling mod_ssl OCSP
  [7/21]: adding URL rewriting rules
  [8/21]: configuring httpd
  [9/21]: setting up httpd keytab
  [10/21]: configuring Gssproxy
  [11/21]: setting up ssl
  [12/21]: configure certmonger for renewals
  [13/21]: publish CA cert
  [14/21]: clean up any existing httpd ccaches
  [15/21]: enable ccache sweep
  [16/21]: configuring SELinux for httpd
  [17/21]: create KDC proxy config
  [18/21]: enable KDC proxy
  [19/21]: starting httpd
  [20/21]: configuring httpd to start on boot
  [21/21]: enabling oddjobd
Done configuring the web interface (httpd).
Configuring Kerberos KDC (krb5kdc)
  [1/1]: installing X509 Certificate for PKINIT
Done configuring Kerberos KDC (krb5kdc).
Applying LDAP updates
Upgrading IPA:. Estimated time: 1 minute 30 seconds
  [1/10]: stopping directory server
  [2/10]: saving configuration
  [3/10]: disabling listeners
  [4/10]: enabling DS global lock
  [5/10]: disabling Schema Compat
  [6/10]: starting directory server
  [7/10]: upgrading server
  [8/10]: stopping directory server
  [9/10]: restoring configuration
  [10/10]: starting directory server
Done.
Restarting the KDC
Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes
  [1/9]: configuring KRA instance
Failed to configure KRA instance
See the installation logs and the following files/directories for more information:
  /var/log/pki/pki-tomcat
  [error] RuntimeError: KRA configuration failed.
KRA configuration failed.
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Version/Release/Distribution

# rpm -q freeipa-server 389-ds-base dogtag-pki-server krb5-server
freeipa-server-4.12.2-14.fc43.x86_64
389-ds-base-3.1.3-3.fc43.x86_64
dogtag-pki-server-11.6.0-0.3.alpha1.fc43.2.noarch
krb5-server-1.21.3-6.fc43.x86_64

Additional info:

Extract from /var/log/ipaserver-install.log:

2025-07-28T06:47:06Z DEBUG   [1/9]: configuring KRA instance
2025-07-28T06:47:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2025-07-28T06:47:06Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2025-07-28T06:47:06Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2025-07-28T06:47:06Z DEBUG Trying to find the certificate for the admin user
2025-07-28T06:47:07Z DEBUG Contents of pkispawn configuration file (/tmp/tmppc5jjaoh):
[KRA]
pki_admin_cert_file = /root/.dogtag/pki-tomcat/ca_admin.cert
pki_admin_cert_request_type = pkcs10
pki_admin_dualkey = False
pki_admin_email = root@localhost
pki_admin_name = admin
pki_admin_nickname = ipa-ca-agent
pki_admin_password = XXXXXXXX
pki_admin_subject_dn = cn=ipa-ca-agent,O=IPA.TEST
pki_admin_uid = admin
pki_ajp_secret = 0SqSOcokGtL4P455QSvpJ5OcJ610q7z6hYvq9KVuKJYf
pki_audit_group = pkiaudit
pki_audit_signing_key_algorithm = SHA256withRSA
pki_audit_signing_key_size = 2048
pki_audit_signing_key_type = rsa
pki_audit_signing_nickname = auditSigningCert cert-pki-kra
pki_audit_signing_signing_algorithm = SHA256withRSA
pki_audit_signing_subject_dn = cn=KRA Audit,O=IPA.TEST
pki_audit_signing_token = internal
pki_backup_keys = True
pki_backup_password = XXXXXXXX
pki_ca_hostname = server.ipa.test
pki_ca_port = 443
pki_ca_signing_cert_path = 
pki_ca_signing_nickname = caSigningCert cert-pki-ca
pki_cert_chain_nickname = caSigningCert External CA
pki_cert_chain_path = 
pki_client_admin_cert_p12 = /tmp/tmp4f21mpus
pki_client_database_dir = /var/lib/ipa/tmp-t2ot_62_
pki_client_database_password = XXXXXXXX
pki_client_database_purge = True
pki_client_dir = /root/.dogtag/pki-tomcat
pki_client_pkcs12_password = XXXXXXXX
pki_configuration_path = /etc/pki
pki_dns_domainname = ipa.test
pki_ds_base_dn = o=kra,o=ipaca
pki_ds_bind_dn = cn=Directory Manager
pki_ds_create_new_db = False
pki_ds_database = ipaca
pki_ds_hostname = server.ipa.test
pki_ds_ldap_port = 389
pki_ds_ldaps_port = 636
pki_ds_password = XXXXXXXX
pki_ds_remove_data = True
pki_ds_secure_connection = True
pki_ds_secure_connection_ca_nickname = Directory Server CA certificate
pki_ds_secure_connection_ca_pem_file = /etc/ipa/ca.crt
pki_enable_proxy = True
pki_existing = False
pki_external_step_two = False
pki_group = pkiuser
pki_hostname = server.ipa.test
pki_hsm_enable = False
pki_hsm_libfile = 
pki_hsm_modulename = 
pki_import_admin_cert = False
pki_instance_configuration_path = /etc/pki/pki-tomcat
pki_instance_name = pki-tomcat
pki_issuing_ca = https://server.ipa.test:443
pki_issuing_ca_hostname = server.ipa.test
pki_issuing_ca_https_port = 443
pki_issuing_ca_uri = https://server.ipa.test:443
pki_key_id_generator = legacy
pki_kra_ephemeral_requests = True
pki_pkcs12_password = 
pki_pkcs12_path = 
pki_replication_password = 
pki_request_id_generator = legacy
pki_san_for_server_cert = 
pki_san_inject = False
pki_security_domain_hostname = server.ipa.test
pki_security_domain_https_port = 443
pki_security_domain_name = IPA
pki_security_domain_password = XXXXXXXX
pki_security_domain_user = admin
pki_self_signed_token = internal
pki_share_db = True
pki_share_dbuser_dn = uid=pkidbuser,ou=people,o=ipaca
pki_skip_configuration = False
pki_skip_ds_verify = False
pki_skip_installation = False
pki_skip_sd_verify = False
pki_sslserver_key_algorithm = SHA256withRSA
pki_sslserver_key_size = 2048
pki_sslserver_key_type = rsa
pki_sslserver_nickname = Server-Cert cert-pki-ca
pki_sslserver_subject_dn = cn=server.ipa.test,O=IPA.TEST
pki_sslserver_token = internal
pki_standalone = False
pki_status_request_timeout = 15
pki_storage_key_algorithm = SHA256withRSA
pki_storage_key_size = 2048
pki_storage_key_type = rsa
pki_storage_nickname = storageCert cert-pki-kra
pki_storage_signing_algorithm = SHA256withRSA
pki_storage_subject_dn = cn=KRA Storage Certificate,O=IPA.TEST
pki_storage_token = internal
pki_subsystem = KRA
pki_subsystem_key_algorithm = SHA256withRSA
pki_subsystem_key_size = 2048
pki_subsystem_key_type = rsa
pki_subsystem_nickname = subsystemCert cert-pki-ca
pki_subsystem_subject_dn = cn=CA Subsystem,O=IPA.TEST
pki_subsystem_token = internal
pki_subsystem_type = kra
pki_token_name = internal
pki_transport_key_algorithm = SHA256withRSA
pki_transport_key_size = 2048
pki_transport_key_type = rsa
pki_transport_nickname = transportCert cert-pki-kra
pki_transport_signing_algorithm = SHA256withRSA
pki_transport_subject_dn = cn=KRA Transport Certificate,O=IPA.TEST
pki_transport_token = internal
pki_use_oaep_rsa_keywrap = True
pki_user = pkiuser
2025-07-28T06:47:07Z DEBUG Starting external process
2025-07-28T06:47:07Z DEBUG args=['/usr/sbin/pkispawn', '-s', 'KRA', '-f', '/tmp/tmppc5jjaoh', '--debug', '--log-file', '/var/log/pki/pki-kra-spawn.20250728024707.log']
2025-07-28T06:47:11Z DEBUG Process finished, return code=1
2025-07-28T06:47:11Z DEBUG stdout=Loading deployment configuration from /tmp/tmppc5jjaoh.
Installation log: /var/log/pki/pki-kra-spawn.20250728024707.log
Installing KRA into /var/lib/pki/pki-tomcat.
Installation failed: Command failed: pki -d /var/lib/pki/pki-tomcat/conf/alias -f /var/lib/pki/pki-tomcat/conf/password.conf -U https://server.ipa.test:443 --ignore-cert-status UNTRUSTED_ISSUER,UNKNOWN_ISSUER --ignore-banner ca-cert-signing-export --pkcs7 --debug
Please check pkispawn logs in /var/log/pki/pki-kra-spawn.20250728024707.log
2025-07-28T06:47:11Z DEBUG stderr=WARNING: The 'pki_existing' in [KRA] is no longer used. This parameter can be safely removed.
WARNING: The 'pki_ds_hostname' in [KRA] has been deprecated. Use 'pki_ds_url' instead.
WARNING: The 'pki_ds_ldap_port' in [KRA] has been deprecated. Use 'pki_ds_url' instead.
WARNING: The 'pki_ds_ldaps_port' in [KRA] has been deprecated. Use 'pki_ds_url' instead.
WARNING: The 'pki_ds_secure_connection' in [KRA] has been deprecated. Use 'pki_ds_url' instead.
DEBUG: 
=====================================================
    DISPLAY CONTENTS OF PKI MASTER DICTIONARY
=====================================================
DEBUG: {   0: None,
    'CATALINA_HOME': '/usr/share/tomcat',
    'JAVA_HOME': '/usr/lib/jvm/jre-21-openjdk',
    '__name__': 'PKI Master Dictionary',
    'application_version': '11.6.0',
    'home_dir': '/root',
    'java_home': '/usr/lib/jvm/jre-21-openjdk',
    'nss_default_db_type': 'sql',
    'pki_admin_cert_file': '/root/.dogtag/pki-tomcat/ca_admin.cert',
    'pki_admin_cert_path': '',
    'pki_admin_cert_request_type': 'pkcs10',
    'pki_admin_csr_path': '',
    'pki_admin_dualkey': 'False',
    'pki_admin_email': 'root@localhost',
    'pki_admin_key_algorithm': 'SHA256withRSA',
    'pki_admin_key_size': '2048',
    'pki_admin_key_type': 'rsa',
    'pki_admin_keysize': '2048',
    'pki_admin_name': 'admin',
    'pki_admin_nickname': 'ipa-ca-agent',
    'pki_admin_password': 'XXXXXXXX',
    'pki_admin_profile_id': 'caAdminCert',
    'pki_admin_setup': 'True',
    'pki_admin_subject_dn': 'cn=ipa-ca-agent,O=IPA.TEST',
    'pki_admin_uid': 'admin',
    'pki_ajp_host': 'localhost4',
    'pki_ajp_host_ipv4': 'localhost4',
    'pki_ajp_host_ipv6': 'localhost6',
    'pki_ajp_port': '8009',
    'pki_ajp_secret': '0SqSOcokGtL4P455QSvpJ5OcJ610q7z6hYvq9KVuKJYf',
    'pki_architecture': 64,
    'pki_audit_group': 'pkiaudit',
    'pki_audit_signing_cert_path': '',
    'pki_audit_signing_csr_path': '',
    'pki_audit_signing_key_algorithm': 'SHA256withRSA',
    'pki_audit_signing_key_size': '2048',
    'pki_audit_signing_key_type': 'rsa',
    'pki_audit_signing_nickname': 'auditSigningCert cert-pki-kra',
    'pki_audit_signing_opFlags': '',
    'pki_audit_signing_opFlagsMask': '',
    'pki_audit_signing_signing_algorithm': 'SHA256withRSA',
    'pki_audit_signing_subject_dn': 'cn=KRA Audit,O=IPA.TEST',
    'pki_audit_signing_token': 'internal',
    'pki_backup_file': '',
    'pki_backup_keys': 'True',
    'pki_backup_password': 'XXXXXXXX',
    'pki_ca_hostname': 'server.ipa.test',
    'pki_ca_port': '443',
    'pki_ca_signing_cert_path': '',
    'pki_ca_signing_nickname': 'caSigningCert cert-pki-ca',
    'pki_ca_signing_token': 'internal',
    'pki_cert_chain_nickname': 'caSigningCert External CA',
    'pki_cert_chain_path': '',
    'pki_certificate_timestamp': '2025-07-28 02:47:07',
    'pki_client_admin_cert': '/root/.dogtag/pki-tomcat/kra_admin.cert',
    'pki_client_admin_cert_p12': '/tmp/tmp4f21mpus',
    'pki_client_database_dir': '/var/lib/ipa/tmp-t2ot_62_',
    'pki_client_database_password': 'XXXXXXXX',
    'pki_client_database_purge': 'True',
    'pki_client_dir': '/root/.dogtag/pki-tomcat',
    'pki_client_password_conf': '/root/.dogtag/pki-tomcat/kra/password.conf',
    'pki_client_pkcs12_password': 'XXXXXXXX',
    'pki_client_pkcs12_password_conf': '/root/.dogtag/pki-tomcat/kra/pkcs12_password.conf',
    'pki_client_subsystem_dir': '/root/.dogtag/pki-tomcat/kra',
    'pki_clone': 'False',
    'pki_clone_pkcs12_password': 'XXXXXXXX',
    'pki_clone_pkcs12_path': '',
    'pki_clone_reindex_data': 'False',
    'pki_clone_replicate_schema': 'True',
    'pki_clone_replication_clone_port': '',
    'pki_clone_replication_master_port': '',
    'pki_clone_replication_security': 'None',
    'pki_clone_setup_replication': 'True',
    'pki_clone_uri': 'https://server.ipa.test:8443',
    'pki_configuration_path': '/etc/pki',
    'pki_deployed_instance_name': None,
    'pki_deployment_executable': 'pkispawn.py',
    'pki_dns_domainname': 'ipa.test',
    'pki_ds_base_dn': 'o=kra,o=ipaca',
    'pki_ds_bind_dn': 'cn=Directory Manager',
    'pki_ds_create_new_db': 'False',
    'pki_ds_database': 'ipaca',
    'pki_ds_hostname': 'server.ipa.test',
    'pki_ds_ldap_port': '389',
    'pki_ds_ldaps_port': '636',
    'pki_ds_password': 'XXXXXXXX',
    'pki_ds_remove_data': 'True',
    'pki_ds_secure_connection': 'True',
    'pki_ds_secure_connection_ca_nickname': 'Directory Server CA certificate',
    'pki_ds_secure_connection_ca_pem_file': '/etc/ipa/ca.crt',
    'pki_ds_setup': 'True',
    'pki_enable_access_log': 'True',
    'pki_enable_java_debugger': 'False',
    'pki_enable_on_system_boot': 'True',
    'pki_enable_proxy': 'True',
    'pki_existing': 'False',
    'pki_external': 'false',
    'pki_external_admin_cert_path': '',
    'pki_external_admin_csr_path': '',
    'pki_external_audit_signing_cert_path': '',
    'pki_external_audit_signing_csr_path': '',
    'pki_external_ca_cert_chain_nickname': 'caSigningCert External CA',
    'pki_external_ca_cert_chain_path': '',
    'pki_external_ca_cert_path': '',
    'pki_external_sslserver_cert_path': '',
    'pki_external_sslserver_csr_path': '',
    'pki_external_step_two': 'False',
    'pki_external_storage_cert_path': '',
    'pki_external_storage_csr_path': '',
    'pki_external_subsystem_cert_path': '',
    'pki_external_subsystem_csr_path': '',
    'pki_external_transport_cert_path': '',
    'pki_external_transport_csr_path': '',
    'pki_group': 'pkiuser',
    'pki_hostname': 'server.ipa.test',
    'pki_hsm_enable': 'False',
    'pki_hsm_libfile': '',
    'pki_hsm_modulename': '',
    'pki_http_enable': 'True',
    'pki_http_port': '8080',
    'pki_https_port': '8443',
    'pki_import_admin_cert': 'False',
    'pki_install_time': 'Mon Jul 28 02:47:07 2025',
    'pki_instance_configuration_path': '/etc/pki/pki-tomcat',
    'pki_instance_name': 'pki-tomcat',
    'pki_instance_path': '/var/lib/pki/pki-tomcat',
    'pki_issuing_ca': 'https://server.ipa.test:443',
    'pki_issuing_ca_hostname': 'server.ipa.test',
    'pki_issuing_ca_https_port': '443',
    'pki_issuing_ca_uri': 'https://server.ipa.test:443',
    'pki_key_id_generator': 'legacy',
    'pki_key_id_length': '128',
    'pki_kra_ephemeral_requests': 'True',
    'pki_master_hostname': 'server.ipa.test',
    'pki_master_https_port': '8443',
    'pki_ocsp_signing_token': 'internal',
    'pki_pin': 'XXXXXXXX',
    'pki_pkcs12_password': 'XXXXXXXX',
    'pki_pkcs12_path': '',
    'pki_proxy_http_port': '80',
    'pki_proxy_https_port': '443',
    'pki_random_ajp_secret': 'dqq4q9QPclo5yhuOZOZUGifzk',
    'pki_registry_enable': 'True',
    'pki_replication_password': 'XXXXXXXX',
    'pki_req_ext_add': 'false',
    'pki_request_id_generator': 'legacy',
    'pki_request_id_length': '128',
    'pki_san_for_server_cert': '',
    'pki_san_inject': 'False',
    'pki_security_domain_hostname': 'server.ipa.test',
    'pki_security_domain_https_port': '443',
    'pki_security_domain_name': 'IPA',
    'pki_security_domain_password': 'XXXXXXXX',
    'pki_security_domain_setup': 'True',
    'pki_security_domain_type': 'existing',
    'pki_security_domain_uri': 'https://server.ipa.test:443',
    'pki_security_domain_user': 'admin',
    'pki_security_manager': 'true',
    'pki_self_signed_nickname': 'temp Server-Cert cert-pki-ca',
    'pki_self_signed_token': 'internal',
    'pki_server_external_certs_path': '',
    'pki_server_pkcs12_password': 'XXXXXXXX',
    'pki_server_pkcs12_path': '',
    'pki_share_db': 'True',
    'pki_share_dbuser_dn': 'uid=pkidbuser,ou=people,o=ipaca',
    'pki_skip_configuration': 'False',
    'pki_skip_ds_verify': 'False',
    'pki_skip_installation': 'False',
    'pki_skip_sd_verify': 'False',
    'pki_ssl_server_key_algorithm': 'SHA256withRSA',
    'pki_ssl_server_key_size': '2048',
    'pki_ssl_server_key_type': 'rsa',
    'pki_ssl_server_nickname': 'Server-Cert cert-pki-tomcat',
    'pki_ssl_server_subject_dn': 'cn=server.ipa.test,ou=pki-tomcat,o=IPA',
    'pki_ssl_server_token': '',
    'pki_sslserver_cert_path': '',
    'pki_sslserver_csr_path': '',
    'pki_sslserver_key_algorithm': 'SHA256withRSA',
    'pki_sslserver_key_size': '2048',
    'pki_sslserver_key_type': 'rsa',
    'pki_sslserver_nickname': 'Server-Cert cert-pki-ca',
    'pki_sslserver_opFlags': '',
    'pki_sslserver_opFlagsMask': '',
    'pki_sslserver_signing_algorithm': 'SHA256withRSA',
    'pki_sslserver_subject_dn': 'cn=server.ipa.test,O=IPA.TEST',
    'pki_sslserver_token': 'internal',
    'pki_standalone': 'false',
    'pki_status_request_timeout': '15',
    'pki_storage_cert_path': '',
    'pki_storage_csr_path': '',
    'pki_storage_key_algorithm': 'SHA256withRSA',
    'pki_storage_key_size': '2048',
    'pki_storage_key_type': 'rsa',
    'pki_storage_nickname': 'storageCert cert-pki-kra',
    'pki_storage_opFlags': '',
    'pki_storage_opFlagsMask': '',
    'pki_storage_signing_algorithm': 'SHA256withRSA',
    'pki_storage_subject_dn': 'cn=KRA Storage Certificate,O=IPA.TEST',
    'pki_storage_token': 'internal',
    'pki_subordinate': 'false',
    'pki_subsystem': 'KRA',
    'pki_subsystem_cert_path': '',
    'pki_subsystem_csr_path': '',
    'pki_subsystem_key_algorithm': 'SHA256withRSA',
    'pki_subsystem_key_size': '2048',
    'pki_subsystem_key_type': 'rsa',
    'pki_subsystem_name': 'KRA server.ipa.test 8443',
    'pki_subsystem_nickname': 'subsystemCert cert-pki-ca',
    'pki_subsystem_opFlags': '',
    'pki_subsystem_opFlagsMask': '',
    'pki_subsystem_signing_algorithm': 'SHA256withRSA',
    'pki_subsystem_subject_dn': 'cn=CA Subsystem,O=IPA.TEST',
    'pki_subsystem_token': 'internal',
    'pki_subsystem_type': 'kra',
    'pki_systemd_service_create': 'True',
    'pki_timestamp': '20250728024707',
    'pki_token_name': 'internal',
    'pki_token_password': 'XXXXXXXX',
    'pki_tomcat_bin_path': '/usr/share/tomcat/bin',
    'pki_tomcat_lib_path': '/usr/share/tomcat/lib',
    'pki_tomcat_server_port': '8005',
    'pki_transport_cert_path': '',
    'pki_transport_csr_path': '',
    'pki_transport_key_algorithm': 'SHA256withRSA',
    'pki_transport_key_size': '2048',
    'pki_transport_key_type': 'rsa',
    'pki_transport_nickname': 'transportCert cert-pki-kra',
    'pki_transport_opFlags': '',
    'pki_transport_opFlagsMask': '',
    'pki_transport_signing_algorithm': 'SHA256withRSA',
    'pki_transport_subject_dn': 'cn=KRA Transport Certificate,O=IPA.TEST',
    'pki_transport_token': 'internal',
    'pki_use_oaep_rsa_keywrap': 'True',
    'pki_use_pss_rsa_signing_algorithm': 'False',
    'pki_user': 'pkiuser',
    'pki_user_deployment_cfg': '/tmp/tmppc5jjaoh',
    'sensitive_parameters': '\n'
                            'pki_admin_password\n'
                            'pki_backup_password\n'
                            'pki_client_database_password\n'
                            'pki_client_pin\n'
                            'pki_client_pkcs12_password\n'
                            'pki_clone_pkcs12_password\n'
                            'pki_ds_password\n'
                            'pki_external_pkcs12_password\n'
                            'pki_pkcs12_password\n'
                            'pki_one_time_pin\n'
                            'pki_pin\n'
                            'pki_replication_password\n'
                            'pki_security_domain_password\n'
                            'pki_server_database_password\n'
                            'pki_server_pkcs12_password\n'
                            'pki_token_password\n'
                            'acme_database_bind_password\n'
                            'acme_database_password\n'
                            'acme_issuer_password\n'
                            'acme_realm_bind_password\n'
                            'acme_realm_password\n'
                            'est_realm_bind_password\n'
                            'est_realm_password\n'
                            'est_ca_password'}
INFO: Loading instance type: pki-tomcatd
INFO: Loading instance: pki-tomcat
INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf
INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf
INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf
INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg
INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
DEBUG: - user: pkiuser
DEBUG: - group: pkiuser
INFO: Connecting to LDAP server at ldaps://server.ipa.test:636
INFO: Connecting to LDAP server at ldaps://server.ipa.test:636
INFO: Connecting to security domain at https://server.ipa.test:443
INFO: Getting security domain info
DEBUG: Starting new HTTPS connection (1): server.ipa.test:443
DEBUG: https://server.ipa.test:443 "GET /ca/rest/securityDomain/domainInfo HTTP/1.1" 200 221
DEBUG: Response:
{
    "subsystemArray": [
        {
            "hosts": {
                "CA server.ipa.test 443": {
                    "id": "CA server.ipa.test 443",
                    "Hostname": "server.ipa.test",
                    "Port": "80",
                    "SecurePort": "443",
                    "SecureEEClientAuthPort": "443",
                    "SecureAgentPort": "443",
                    "SecureAdminPort": "443",
                    "Clone": "FALSE",
                    "SubsystemName": "CA server.ipa.test 8443",
                    "DomainManager": "TRUE"
                }
            },
            "hostArray": [
                {
                    "id": "CA server.ipa.test 443",
                    "Hostname": "server.ipa.test",
                    "Port": "80",
                    "SecurePort": "443",
                    "SecureEEClientAuthPort": "443",
                    "SecureAgentPort": "443",
                    "SecureAdminPort": "443",
                    "Clone": "FALSE",
                    "SubsystemName": "CA server.ipa.test 8443",
                    "DomainManager": "TRUE"
                }
            ],
            "id": "CA"
        }
    ],
    "id": "IPA",
    "subsystems": {
        "CA": {
            "hosts": {
                "CA server.ipa.test 443": {
                    "id": "CA server.ipa.test 443",
                    "Hostname": "server.ipa.test",
                    "Port": "80",
                    "SecurePort": "443",
                    "SecureEEClientAuthPort": "443",
                    "SecureAgentPort": "443",
                    "SecureAdminPort": "443",
                    "Clone": "FALSE",
                    "SubsystemName": "CA server.ipa.test 8443",
                    "DomainManager": "TRUE"
                }
            },
            "hostArray": [
                {
                    "id": "CA server.ipa.test 443",
                    "Hostname": "server.ipa.test",
                    "Port": "80",
                    "SecurePort": "443",
                    "SecureEEClientAuthPort": "443",
                    "SecureAgentPort": "443",
                    "SecureAdminPort": "443",
                    "Clone": "FALSE",
                    "SubsystemName": "CA server.ipa.test 8443",
                    "DomainManager": "TRUE"
                }
            ],
            "id": "CA"
        }
    }
}
INFO: Logging into security domain IPA
DEBUG: https://server.ipa.test:443 "GET /ca/rest/account/login HTTP/1.1" 200 180
INFO: BEGIN spawning KRA subsystem in pki-tomcat instance
INFO: Loading instance: pki-tomcat
INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf
INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf
INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf
INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg
INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
DEBUG: - user: pkiuser
DEBUG: - group: pkiuser
INFO: Reusing pkiuser group (GID: 17)
INFO: Reusing pkiuser user (UID: 17)
DEBUG: Retrieving UID for 'pkiuser'
DEBUG: UID of 'pkiuser' is 17
DEBUG: Retrieving GID for 'pkiuser'
DEBUG: GID of 'pkiuser' is 17
INFO: Initialization
INFO: Setting up infrastructure
INFO: Preparing pki-tomcat instance
INFO: Loading instance: pki-tomcat
INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf
INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf
INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf
INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg
INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
DEBUG: - user: pkiuser
DEBUG: - group: pkiuser
INFO: Reusing /var/lib/pki/pki-tomcat
INFO: Reusing /var/lib/pki/pki-tomcat/bin
INFO: Reusing /etc/pki/pki-tomcat
INFO: Reusing /var/lib/pki/pki-tomcat/conf
INFO: Reusing /var/log/pki/pki-tomcat
INFO: Reusing /var/lib/pki/pki-tomcat/logs
INFO: Reusing /var/lib/pki/pki-tomcat/lib
INFO: Reusing /var/lib/pki/pki-tomcat/common
INFO: Reusing /var/lib/pki/pki-tomcat/common/lib
INFO: Reusing /var/lib/pki/pki-tomcat/temp
INFO: Reusing /var/lib/pki/pki-tomcat/work
INFO: Reusing /var/lib/pki/pki-tomcat/conf/certs
INFO: Reusing /var/lib/pki/pki-tomcat/conf/server.xml
INFO: Updating AccessLogValve
INFO: Configuring Tomcat admin port
INFO: Reusing PKIListener
INFO: Configuring HTTP connector
INFO: Updating HTTPS connector
INFO: Updating SSL host configuration
INFO: Updating SSL certificate configuration
INFO: Reusing /var/lib/pki/pki-tomcat/conf/Catalina
INFO: Reusing /var/lib/pki/pki-tomcat/conf/Catalina/localhost
INFO: Reusing /var/lib/pki/pki-tomcat/conf/Catalina/localhost/rewrite.config
INFO: Adding AJP connector for IPv4
INFO: Adding AJP connector for IPv6
INFO: Updating AccessLogValve
INFO: Reusing /var/lib/pki/pki-tomcat/conf/catalina.properties
INFO: Reusing /var/lib/pki/pki-tomcat/conf/context.xml
INFO: Reusing /var/lib/pki/pki-tomcat/conf/logging.properties
INFO: Reusing /var/lib/pki/pki-tomcat/conf/web.xml
INFO: Reusing server NSS database password
INFO: Using specified internal database password
INFO: Reusing replication manager password
INFO: Updating /var/lib/pki/pki-tomcat/conf/password.conf
INFO: Reusing /var/lib/pki/pki-tomcat/conf/alias
INFO: Reusing /var/lib/pki/pki-tomcat/alias
INFO: Reusing /etc/sysconfig/pki-tomcat
INFO: Reusing /var/lib/pki/pki-tomcat/conf/tomcat.conf
INFO: Reusing ROOT web application
INFO: Reusing pki web application
INFO: Reusing /etc/sysconfig/pki/tomcat/pki-tomcat
INFO: Reusing /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
INFO: Installing pki-tomcat instance
INFO: Creating KRA subsystem
INFO: Creating /var/lib/pki/pki-tomcat/kra
DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/kra
INFO: Linking /var/lib/pki/pki-tomcat/kra/registry to /etc/sysconfig/pki/tomcat/pki-tomcat
DEBUG: Command: ln -s /etc/sysconfig/pki/tomcat/pki-tomcat /var/lib/pki/pki-tomcat/kra/registry
INFO: Creating /var/lib/pki/pki-tomcat/conf/kra
DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/conf/kra
INFO: Linking /var/lib/pki/pki-tomcat/kra/conf to /var/lib/pki/pki-tomcat/conf/kra
DEBUG: Command: ln -s /var/lib/pki/pki-tomcat/conf/kra /var/lib/pki/pki-tomcat/kra/conf
INFO: Storing subsystem config: /var/lib/pki/pki-tomcat/conf/kra/CS.cfg
INFO: Copying /usr/share/pki/kra/conf/registry.cfg to /var/lib/pki/pki-tomcat/conf/kra/registry.cfg
INFO: Creating /var/lib/pki/pki-tomcat/logs/kra
DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/logs/kra
INFO: Linking /var/lib/pki/pki-tomcat/kra/logs to /var/lib/pki/pki-tomcat/logs/kra
DEBUG: Command: ln -s /var/lib/pki/pki-tomcat/logs/kra /var/lib/pki/pki-tomcat/kra/logs
INFO: Creating /var/lib/pki/pki-tomcat/logs/kra/archive
DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/logs/kra/archive
INFO: Creating /var/lib/pki/pki-tomcat/logs/kra/signedAudit
DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/logs/kra/signedAudit
INFO: Linking /var/lib/pki/pki-tomcat/kra/alias to /var/lib/pki/pki-tomcat/alias
DEBUG: Command: ln -s /var/lib/pki/pki-tomcat/alias /var/lib/pki/pki-tomcat/kra/alias
INFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat/kra
DEBUG: Command: mkdir /etc/sysconfig/pki/tomcat/pki-tomcat/kra
INFO: Copying /usr/share/pki/server/etc/default.cfg to /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg
DEBUG: Command: cp /usr/share/pki/server/etc/default.cfg /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg
INFO: Creating /tmp/tmp2n2nfk_x/CS.cfg
DEBUG: Command: cp /usr/share/pki/kra/conf/CS.cfg /tmp/tmp2n2nfk_x/CS.cfg
INFO: Loading instance: pki-tomcat
INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf
INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf
INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf
INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/kra/CS.cfg
INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
DEBUG: - user: pkiuser
DEBUG: - group: pkiuser
INFO: Enabling HTTP proxy
INFO: Setting proxy.securePort to 443
INFO: Setting proxy.unsecurePort to 80
INFO: Setting preop.ca.type to sdca
DEBUG: PKISubsystem.get_subsystem_cert(transport)
DEBUG: PKISubsystem.get_cert_info(transport)
INFO: Setting kra.transport.nickname to transportCert cert-pki-kra
INFO: Setting kra.transport.tokenname to internal
INFO: Setting kra.cert.transport.nickname to transportCert cert-pki-kra
INFO: Setting kra.transportUnit.signingAlgorithm to SHA256withRSA
DEBUG: PKISubsystem.get_subsystem_cert(storage)
DEBUG: PKISubsystem.get_cert_info(storage)
INFO: Setting kra.storage.nickname to storageCert cert-pki-kra
INFO: Setting kra.storage.tokenname to internal
INFO: Setting kra.cert.storage.nickname to storageCert cert-pki-kra
DEBUG: PKISubsystem.get_subsystem_cert(sslserver)
DEBUG: PKISubsystem.get_cert_info(sslserver)
INFO: Setting kra.sslserver.nickname to Server-Cert cert-pki-ca
INFO: Setting kra.sslserver.tokenname to internal
INFO: Setting kra.cert.sslserver.nickname to Server-Cert cert-pki-ca
DEBUG: PKISubsystem.get_subsystem_cert(subsystem)
DEBUG: PKISubsystem.get_cert_info(subsystem)
INFO: Setting kra.subsystem.nickname to subsystemCert cert-pki-ca
INFO: Setting kra.subsystem.tokenname to internal
INFO: Setting kra.cert.subsystem.nickname to subsystemCert cert-pki-ca
DEBUG: PKISubsystem.get_subsystem_cert(audit_signing)
DEBUG: PKISubsystem.get_cert_info(audit_signing)
INFO: Setting kra.audit_signing.nickname to auditSigningCert cert-pki-kra
INFO: Setting kra.audit_signing.tokenname to internal
INFO: Setting kra.cert.audit_signing.nickname to auditSigningCert cert-pki-kra
INFO: Setting kra.storageUnit.nickName to storageCert cert-pki-kra
INFO: Setting kra.transportUnit.nickName to transportCert cert-pki-kra
INFO: Setting log.instance.SignedAudit.signedAuditCertNickname to auditSigningCert cert-pki-kra
INFO: Injecting SAN: False
INFO: SSL server cert SAN: 
INFO: Storing subsystem config: /var/lib/pki/pki-tomcat/conf/kra/CS.cfg
INFO: Storing registry config: /var/lib/pki/pki-tomcat/conf/kra/registry.cfg
INFO: Checking DS CA cert: Directory Server CA certificate
DEBUG: NSSDatabase.get_cert(Directory Server CA certificate) begins
DEBUG: Command: certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f /tmp/tmpkgn9beiz/password.txt -n Directory Server CA certificate -a
DEBUG: stdout: -1
DEBUG: NSSDatabase: stderr:
certutil: Could not find cert: Directory Server CA certificate
: PR_FILE_NOT_FOUND_ERROR: File not found
DEBUG: Cert not found: Directory Server CA certificate
INFO: Importing DS CA cert
DEBUG: NSSDatabase.import_cert_chain(Directory Server CA certificate) begins
DEBUG: NSSDatabase: Cert chain:
-----BEGIN CERTIFICATE-----
MIIERDCCAqygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMREwDwYDVQQKDAhJUEEu
VEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTI1MDcyODA2
NDQwMFoXDTQ1MDcyODA2NDQwMFowMzERMA8GA1UECgwISVBBLlRFU1QxHjAcBgNV
BAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTCCAaIwDQYJKoZIhvcNAQEBBQADggGP
ADCCAYoCggGBAKc36dQN8V9XyCTYDVYcOM1HnNG62hedFkpMvTcTpVpqKH3ric96
DlqXS+MAEgLNNvS+6+9Bdp6gwrBppXod3AQSjL4SDN9TOIPg9zgnwan7Oqy2Wd3B
BmuJIskxRp1iaaUwMlGYEOYCoBJ+MY8oVYUomYkitv1kPg6TMZXuk4cW1YbIywvT
xKOCs8RUgKuyhblWIk03lUJ0///nZICXf3+UrfaziwwzAqgWFPpWiRx15WpLIELY
PbGXmuw2GqDD6iSntpevkNwNN9CVOAVQEu75SaExo3WUrLkGqk0q3KYelbRJ8Dd7
D03PeHr60c3pfPE6cAEvMxUOT9SU9zzZMZPmKvQ94swamL/FGTzmKbPhxBN0oP6Y
srSVx4rKHVX6rA+KXlVey9jH3NjMFzDqrLP+3nwFqWVad0n/EurOkBm1kMlcSy2k
Zz2VMc3EozaHqPv3n/nhMKqlQBEVBMItCIEcXZtOnMKtGcgIEflwIJfzi0yYNiG+
46F3izIdPR7WVwIDAQABo2MwYTAdBgNVHQ4EFgQUY5II60EIdJDYbwla2ufPkotY
Y1EwHwYDVR0jBBgwFoAUY5II60EIdJDYbwla2ufPkotYY1EwDwYDVR0TAQH/BAUw
AwEB/zAOBgNVHQ8BAf8EBAMCAcYwDQYJKoZIhvcNAQELBQADggGBAJL8ks6U4hfH
TVYaCr6LclgGLsmZ67GMpl1A3w8YPuwV1eGTUG/gs6l7YmGEXkWChIryOOH2tR0q
WiTpLKKjuESGYNO4d86WpIvJS/0gPMdyn1GPAgXvo2vZJdqa1XsgARp8ZKHTgiqM
D5VqJnfEM0mgHOblT750xGN0eNTD8yhcsocRf7Va91KvajxcfH69tMz2OxcITnlS
i1euATplca5dBax6+8qAdMgiyOb1WTuHiZtpkG7MylwuCKltf8rC5nnK0pQ5jhJ6
uKXrWMFDioBaVTCW3SENmgbQSVjMU7CPJMnMYlaE8c7wUnHUdU//rmB9nAVLONhS
756SF7YqsNBLi7kuhWieWfymNQ7QhPXEmLsHGEdsCYkdWMmjn5KhFXzGgZqiH45S
UYoR566tQ680kFxnwYL+nKOwmh3BfTuJZRlRN3sMoJsNDf36l5N/sn393H7rBRSa
h8lMJfRWOl8Wrn1y6/+HqmFBBPSOyPPeZ+YVBqKXc63SsAkMFvMGkg==
-----END CERTIFICATE-----
DEBUG: Importing a single cert
DEBUG: NSSDatabase.add_cert(Directory Server CA certificate)
DEBUG: Command: pki -d /var/lib/pki/pki-tomcat/conf/alias -f /var/lib/pki/pki-tomcat/conf/password.conf nss-cert-import --format PEM --trust CT,CT,CT --debug Directory Server CA certificate
INFO: Initializing NSS
INFO: Logging into internal token
INFO: Using internal token
INFO: NSSDatabase: Importing cert Directory Server CA certificate into NSS FIPS 140-2 User Private Key
DEBUG: NSSDatabase.import_cert_chain(Directory Server CA certificate) ends
DEBUG: Command: mkdir /root/.dogtag/pki-tomcat/kra
INFO: Creating password file: /root/.dogtag/pki-tomcat/kra/password.conf
INFO: Storing PKCS #12 password in /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf
DEBUG: Command: mkdir /var/lib/ipa/tmp-t2ot_62_
DEBUG: Command: certutil -N -d /var/lib/ipa/tmp-t2ot_62_ -f /root/.dogtag/pki-tomcat/kra/password.conf
INFO: Creating SELinux contexts
INFO: Generating system keys
INFO: Loading instance: pki-tomcat
INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf
INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf
INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf
INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/kra/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/kra/registry.cfg
INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
DEBUG: - user: pkiuser
DEBUG: - group: pkiuser
INFO: Fapolicy folder not found. Rule configuration skipped
INFO: Configuring subsystem
INFO: Loading instance: pki-tomcat
INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf
INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf
INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf
INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg
INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/kra/CS.cfg
INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/kra/registry.cfg
INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
DEBUG: - user: pkiuser
DEBUG: - group: pkiuser
INFO: Setting internaldb.ldapconn.secureConn to true
INFO: Setting internaldb.ldapconn.host to server.ipa.test
INFO: Setting internaldb.ldapconn.port to 636
INFO: Setting internaldb.ldapauth.bindDN to cn=Directory Manager
INFO: Setting internaldb.basedn to o=kra,o=ipaca
INFO: Setting internaldb.database to ipaca
INFO: Setting keyWrap.useOAEP to true
INFO: Setting dbs.request.id.generator to legacy
INFO: Setting dbs.beginRequestNumber to 1
INFO: Setting dbs.endRequestNumber to 10000000
INFO: Setting dbs.requestIncrement to 10000000
INFO: Setting dbs.requestLowWaterMark to 2000000
INFO: Setting dbs.requestCloneTransferNumber to 10000
INFO: Setting dbs.requestRangeDN to ou=requests,ou=ranges
INFO: Setting dbs.key.id.generator to legacy
INFO: Setting dbs.beginSerialNumber to 1
INFO: Setting dbs.endSerialNumber to 10000000
INFO: Setting dbs.serialIncrement to 10000000
INFO: Setting dbs.serialLowWaterMark to 2000000
INFO: Setting dbs.serialCloneTransferNumber to 10000
INFO: Setting dbs.serialRangeDN to ou=keyRepository,ou=ranges
DEBUG: Setting ephemeral requests to true
INFO: Setting kra.ephemeralRequests to true
INFO: Storing subsystem config: /var/lib/pki/pki-tomcat/conf/kra/CS.cfg
INFO: Storing registry config: /var/lib/pki/pki-tomcat/conf/kra/registry.cfg
DEBUG: import_system_certs
DEBUG: import_system_cert
DEBUG: import_system_cert
DEBUG: import_system_cert
DEBUG: import_system_cert
DEBUG: import_system_cert
INFO: Checking existing cert chain: caSigningCert External CA
DEBUG: NSSDatabase.get_cert(caSigningCert External CA) begins
DEBUG: Command: certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f /tmp/tmpvk6tnevw/password.txt -n caSigningCert External CA -a
DEBUG: stdout: -1
DEBUG: NSSDatabase: stderr:
certutil: Could not find cert: caSigningCert External CA
: PR_FILE_NOT_FOUND_ERROR: File not found
DEBUG: Cert not found: caSigningCert External CA
INFO: Retrieving cert chain from https://server.ipa.test:443
DEBUG: Command: pki -d /var/lib/pki/pki-tomcat/conf/alias -f /var/lib/pki/pki-tomcat/conf/password.conf -U https://server.ipa.test:443 --ignore-cert-status UNTRUSTED_ISSUER,UNKNOWN_ISSUER --ignore-banner ca-cert-signing-export --pkcs7 --debug
INFO: Connecting to https://server.ipa.test:443
INFO: PKIConnection: Socket factory: org.dogtagpki.client.DefaultSocketFactory
INFO: HTTP request: GET /pki/rest/info HTTP/1.1
FINE: - Authorization: ********
FINE: - Host: server.ipa.test:443
FINE: - Connection: Keep-Alive
FINE: - User-Agent: Apache-HttpClient/4.5.14 (Java/21.0.8)
FINE: Request:
SEVERE: FATAL: SSL alert sent: ILLEGAL_PARAMETER
javax.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request
    at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:317)
    at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:442)
    at org.jboss.resteasy.client.jaxrs.internal.ClientInvocationBuilder.get(ClientInvocationBuilder.java:163)
    at com.netscape.certsrv.client.PKIClient.get(PKIClient.java:248)
    at com.netscape.certsrv.client.Client.get(Client.java:111)
    at com.netscape.certsrv.client.Client.get(Client.java:106)
    at com.netscape.certsrv.client.Client.get(Client.java:102)
    at org.dogtagpki.common.InfoClient.getInfo(InfoClient.java:34)
    at com.netscape.certsrv.client.PKIClient.getInfo(PKIClient.java:304)
    at com.netscape.cmstools.cli.MainCLI.getClient(MainCLI.java:616)
    at org.dogtagpki.cli.CLI.getClient(CLI.java:203)
    at org.dogtagpki.cli.CLI.getClient(CLI.java:203)
    at org.dogtagpki.cli.CLI.getClient(CLI.java:203)
    at com.netscape.cmstools.ca.CACertSigningExportCLI.execute(CACertSigningExportCLI.java:73)
    at org.dogtagpki.cli.CommandCLI.execute(CommandCLI.java:58)
    at org.dogtagpki.cli.CLI.execute(CLI.java:353)
    at org.dogtagpki.cli.CLI.execute(CLI.java:353)
    at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:79)
    at org.dogtagpki.cli.CLI.execute(CLI.java:353)
    at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:680)
    at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:719)
Caused by: java.io.IOException: Unable to write to socket: Failed to write to socket: (-8187) security library: invalid arguments.
    at org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1537)
    at org.mozilla.jss.ssl.SSLOutputStream.write(SSLOutputStream.java:27)
    at org.apache.http.impl.io.AbstractSessionOutputBuffer.flushBuffer(AbstractSessionOutputBuffer.java:160)
    at org.apache.http.impl.io.AbstractSessionOutputBuffer.flush(AbstractSessionOutputBuffer.java:168)
    at org.apache.http.impl.AbstractHttpClientConnection.doFlush(AbstractHttpClientConnection.java:281)
    at org.apache.http.impl.AbstractHttpClientConnection.flush(AbstractHttpClientConnection.java:287)
    at org.apache.http.impl.conn.ManagedClientConnectionImpl.flush(ManagedClientConnectionImpl.java:188)
    at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:241)
    at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:123)
    at org.apache.http.impl.client.DefaultRequestDirector.tryExecute(DefaultRequestDirector.java:679)
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:481)
    at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:836)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
    at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:313)
    ... 20 more
Caused by: org.mozilla.jss.ssl.SSLSocketException: Failed to write to socket: (-8187) security library: invalid arguments.
    at org.mozilla.jss.ssl.SSLSocket.socketWrite(Native Method)
    at org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1533)
    ... 34 more
ERROR: CalledProcessError: Command '['pki', '-d', '/var/lib/pki/pki-tomcat/conf/alias', '-f', '/var/lib/pki/pki-tomcat/conf/password.conf', '-U', 'https://server.ipa.test:443', '--ignore-cert-status', 'UNTRUSTED_ISSUER,UNKNOWN_ISSUER', '--ignore-banner', 'ca-cert-signing-export', '--pkcs7', '--debug']' returned non-zero exit status 255.
  File "/usr/lib/python3.14/site-packages/pki/server/pkispawn.py", line 594, in main
    deployer.spawn()
    ~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.14/site-packages/pki/server/deployment/__init__.py", line 5887, in spawn
    scriptlet.spawn(self)
    ~~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib/python3.14/site-packages/pki/server/deployment/scriptlets/configuration.py", line 65, in spawn
    deployer.import_system_certs(nssdb, subsystem)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/pki/server/deployment/__init__.py", line 2576, in import_system_certs
    self.import_cert_chain(nssdb, subsystem)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/pki/server/deployment/__init__.py", line 2510, in import_cert_chain
    cert_chain = self.get_ca_signing_cert(url)
  File "/usr/lib/python3.14/site-packages/pki/server/deployment/__init__.py", line 4399, in get_ca_signing_cert
    output = subprocess.check_output(cmd)
  File "/usr/lib64/python3.14/subprocess.py", line 472, in check_output
    return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
           ~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
               **kwargs).stdout
               ^^^^^^^^^
  File "/usr/lib64/python3.14/subprocess.py", line 577, in run
    raise CalledProcessError(retcode, process.args,
                             output=stdout, stderr=stderr)
2025-07-28T06:47:11Z CRITICAL Failed to configure KRA instance
2025-07-28T06:47:11Z CRITICAL See the installation logs and the following files/directories for more information:
2025-07-28T06:47:11Z CRITICAL   /var/log/pki/pki-tomcat
2025-07-28T06:47:11Z DEBUG Traceback (most recent call last):
  File "/usr/lib/python3.14/site-packages/ipaserver/install/service.py", line 688, in start_creation
    run_step(full_msg, method)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/service.py", line 674, in run_step
    method()
    ~~~~~~^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/krainstance.py", line 245, in __spawn_instance
    DogtagInstance.spawn_instance(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        self, cfg_file,
        ^^^^^^^^^^^^^^^
        nolog_list=nolog_list
        ^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/dogtaginstance.py", line 254, in spawn_instance
    self.handle_setup_error(e)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/dogtaginstance.py", line 671, in handle_setup_error
    raise RuntimeError(
        "%s configuration failed." % self.subsystem
    ) from None
RuntimeError: KRA configuration failed.
2025-07-28T06:47:11Z DEBUG   [error] RuntimeError: KRA configuration failed.
2025-07-28T06:47:11Z DEBUG Removing /var/lib/ipa/tmp-t2ot_62_
2025-07-28T06:47:11Z DEBUG Removing /root/.dogtag/pki-tomcat/kra
2025-07-28T06:47:11Z DEBUG   File "/usr/lib/python3.14/site-packages/ipapython/admintool.py", line 219, in execute
    return_value = self.run()
  File "/usr/lib/python3.14/site-packages/ipapython/install/cli.py", line 343, in run
    return cfgr.run()
           ~~~~~~~~^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 360, in run
    return self.execute()
           ~~~~~~~~~~~~^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 386, in execute
    for rval in self._executor():
                ~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 435, in __runner
    exc_handler(exc_info)
    ~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception
    self._handle_exception(exc_info)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 458, in _handle_exception
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 425, in __runner
    step()
    ~~~~^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 419, in step_next
    return next(self.__gen)
  File "/usr/lib/python3.14/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.14/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 663, in _configure
    next(executor)
    ~~~~^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 435, in __runner
    exc_handler(exc_info)
    ~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception
    self._handle_exception(exc_info)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 526, in _handle_exception
    self.__parent._handle_exception(exc_info)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 458, in _handle_exception
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 523, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 458, in _handle_exception
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 425, in __runner
    step()
    ~~~~^^
  File "/usr/lib/python3.14/site-packages/ipapython/install/core.py", line 419, in step_next
    return next(self.__gen)
  File "/usr/lib/python3.14/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.14/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python3.14/site-packages/ipapython/install/common.py", line 65, in _install
    for unused in self._installer(self.parent):
                  ~~~~~~~~~~~~~~~^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/server/__init__.py", line 654, in main
    master_install(self)
    ~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/server/install.py", line 278, in decorated
    func(installer)
    ~~~~^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/server/install.py", line 1017, in install
    kra.install(api, None, options, custodia=custodia)
    ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/kra.py", line 162, in install
    kra.configure_instance(
    ~~~~~~~~~~~~~~~~~~~~~~^
        realm_name, host_name, dm_password, dm_password,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ...<6 lines>...
        token_password=options.token_password
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/krainstance.py", line 148, in configure_instance
    self.start_creation(runtime=120)
    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/service.py", line 688, in start_creation
    run_step(full_msg, method)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/service.py", line 674, in run_step
    method()
    ~~~~~~^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/krainstance.py", line 245, in __spawn_instance
    DogtagInstance.spawn_instance(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        self, cfg_file,
        ^^^^^^^^^^^^^^^
        nolog_list=nolog_list
        ^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/dogtaginstance.py", line 254, in spawn_instance
    self.handle_setup_error(e)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/dogtaginstance.py", line 671, in handle_setup_error
    raise RuntimeError(
        "%s configuration failed." % self.subsystem
    ) from None
2025-07-28T06:47:11Z DEBUG The ipa-server-install command failed, exception: RuntimeError: KRA configuration failed.
2025-07-28T06:47:11Z ERROR KRA configuration failed.
2025-07-28T06:47:11Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Extract from /var/log/pki/pki-kra-spawn.log:

2025-07-28 02:47:10 INFO: Checking existing cert chain: caSigningCert External CA
2025-07-28 02:47:10 DEBUG: NSSDatabase.get_cert(caSigningCert External CA) begins
2025-07-28 02:47:10 DEBUG: Command: certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f /tmp/tmpvk6tnevw/password.txt -n caSigningCert External CA -a
2025-07-28 02:47:10 DEBUG: stdout: -1
2025-07-28 02:47:10 DEBUG: NSSDatabase: stderr:
certutil: Could not find cert: caSigningCert External CA
: PR_FILE_NOT_FOUND_ERROR: File not found
2025-07-28 02:47:10 DEBUG: Cert not found: caSigningCert External CA
2025-07-28 02:47:10 INFO: Retrieving cert chain from https://server.ipa.test:443
2025-07-28 02:47:10 DEBUG: Command: pki -d /var/lib/pki/pki-tomcat/conf/alias -f /var/lib/pki/pki-tomcat/conf/password.conf -U https://server.ipa.test:443 --ignore-cert-status UNTRUSTED_ISSUER,UNKNOWN_ISSUER --ignore-banner ca-cert-signing-export --pkcs7 --debug

IPA server installation calls pkispawn, which internally calls pki ca-cert-signing-export and fails.

Companion issue in PKI project: https://github.com/dogtagpki/pki/issues/5161

Metadata Update from @frenaud:
- Issue tagged with: tracker

Fixed with dogtag-pki-server-11.8.0-0.6.beta6.fc44.noarch and nss-3.116.0-1.fc44.x86_64

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

fips test-failure tracker

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.