Debugging hint re: replica 'rndc sign' fail -> ipa-dnskeysyncd fail
by Harry G. Coin
I was going to ask for help for a very perplexing problem. The symptoms
seemed to have very little to do with the solution, so searching online
led nowhere. Hopefully, by posting this the next person to hit this
will find this answer.
In short, the answer is, on the replica:
dsconf -D "cn=Directory Manager" ldap://localhost config replace
nsslapd-ioblocktimeout=40000
And here is the shaggy dog story description of the problem, mostly for
the benefit of search engines.
I need(ed) help with where to look next for a strange replica-dns
blocking freeipa problem.
Using fedora 34 latest with a fresh simple master/replica install of
ipa-server with dns: I'm getting normal operations on the master and
ipa-dnskeysyncd.service: Main process exited, code=exited, status=1/FAILURE
on the replica. The master has good dnssec operation on a few zones as
reported on the master (you can check for example quietfountain.com
yourself). But on the replica it fails to reply at all.
ipa-healthcheck reports the same thing on both the slave an the replica,
what appears to be a known and mostly ignored problem to do with KRA not
working on the replica.
[root@registry1 etc]# ipa-healthcheck
Internal error testing KRA clone. KRA clone problem detected Host:
registry2.1.quietfountain.com Port: 443
[
{
"source": "pki.server.healthcheck.clones.connectivity_and_data",
"check": "ClonesConnectivyAndDataCheck",
"result": "ERROR",
"uuid": "7cd8344e-1fff-45c8-a613-893a1baf5cf9",
"when": "20210827172132Z",
"duration": "11.141044",
"kw": {
"status": "ERROR: pki-tomcat : Internal error testing KRA clone.
Host: registry2.1.quietfountain.com Port: 443"
}
}
]
[root@registry1 etc]#
On both the master and the replica, all services are running:
*[root@registry1 ~]# systemctl is-system-running
running
*
[root@registry2 ~]# systemctl is-system-running
running
Now, here's the clue I need help with where to go from here:
On the master we have this normal set of two commands:
[root@registry1 ~]# rndc status
version: BIND 9.16.20-RH (Extended Support Version) <id:26db37f>
running on registry1.1.quietfountain.com: Linux x86_64
5.13.12-200.fc34.x86_64 #1 SMP Wed Aug 18 13:27:18 UTC 2021
boot time: Fri, 27 Aug 2021 17:55:31 GMT
last configured: Fri, 27 Aug 2021 17:55:33 GMT
configuration file: /etc/named.conf
CPUs found: 4
worker threads: 4
UDP listeners per interface: 4
number of zones: 301 (94 automatic)
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is ON
recursive clients: 0/900/1000
tcp clients: 0/150
TCP high-water: 11
server is up and running
[root@registry1 ~]# rndc zonestatus quietfountain.com.
name: quietfountain.com.
type: primary
files: dyndb-ldap/ipa/master/quietfountain.com/raw
serial: 2021082484
signed serial: 2021082494
nodes: 29
last loaded: Fri, 27 Aug 2021 17:57:06 GMT
secure: yes
inline signing: yes
key maintenance: automatic
next key event: Fri, 27 Aug 2021 18:59:22 GMT
next resign node: quietfountain.com/NS
next resign time: Sat, 28 Aug 2021 04:20:04 GMT
dynamic: yes
frozen: no
reconfigurable via modzone: no
[root@registry1 ~]#
But on the replica... it fails really oddly, and the failure breaks
ipa-dnskeysyncd
[root@registry2 ~]# rndc status
version: BIND 9.16.20-RH (Extended Support Version) <id:26db37f>
running on registry2.1.quietfountain.com: Linux x86_64
5.13.12-200.fc34.x86_64 #1 SMP Wed Aug 18 13:27:18 UTC 2021
boot time: Fri, 27 Aug 2021 17:43:59 GMT
last configured: Fri, 27 Aug 2021 17:44:01 GMT
configuration file: /etc/named.conf
CPUs found: 4
worker threads: 4
UDP listeners per interface: 4
number of zones: 302 (95 automatic)
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is ON
recursive clients: 9/900/1000
tcp clients: 0/150
TCP high-water: 5
server is up and running
[root@registry2 ~]# rndc zonestatus quietfountain.com
rndc: 'zonestatus' failed: not found
no matching zone 'quietfountain.com' in any view
[root@registry2 ~]#
What really gets me is, if you point a dig at each named daemon for the
'allegedly missing zone' -- both the master and the replica report
correctly.
So how is it possible for rndc to fail to find a domain when that same
named process quite plainly can give details about it?
The only other clue I have is: the master is quite obviously the
authoritative name server for greekdishesbynausica.com (among others,
just ask dnssec analzers that report all good from the master but can't
reach the replica...) -- but the logs on the replica are filled with
"not authoritative".. ??
Aug 27 12:59:33 registry2.1.quietfountain.com named[1036]: client
@0x7fee142ac528 10.12.127.252#42708: received notify for zone
'greekdishesbynausica.com': not authoritative
Here are the two 'digs':
[root@registry2 ~]# dig @10.12.112.3 DS quietfountain.com.
; <<>> DiG 9.16.20-RH <<>> @10.12.112.3 DS quietfountain.com.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65463
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: bbe4c713019a8d940100000061292addc6ca238f90f7831f (good)
;; QUESTION SECTION:
;quietfountain.com. IN DS
;; ANSWER SECTION:
quietfountain.com. 86337 IN DS 13711 8 2
89F5FD8758CB880C6DE8CCFF9971DEDAEC81BC33FA3CCE092781AD15 6F305F50
;; Query time: 1 msec
;; SERVER: 10.12.112.3#53(10.12.112.3)
;; WHEN: Fri Aug 27 13:11:41 CDT 2021
;; MSG SIZE rcvd: 122
[root@registry2 ~]# dig @10.12.112.2 DS quietfountain.com.
; <<>> DiG 9.16.20-RH <<>> @10.12.112.2 DS quietfountain.com.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14869
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: fe7fe619a7f0fb2b0100000061292ae263bec72b087ad2ce (good)
;; QUESTION SECTION:
;quietfountain.com. IN DS
;; ANSWER SECTION:
quietfountain.com. 86153 IN DS 13711 8 2
89F5FD8758CB880C6DE8CCFF9971DEDAEC81BC33FA3CCE092781AD15 6F305F50
;; Query time: 2 msec
;; SERVER: 10.12.112.2#53(10.12.112.2)
;; WHEN: Fri Aug 27 13:11:46 CDT 2021
;; MSG SIZE rcvd: 122
[root@registry2 ~]#
2 years, 7 months
ipa-healthcheck - ipahealthcheck.ds.replication.ReplicationConflictCheck.idnsname Replication conflict
by Kathy Zhu
Hi List,
When I run ipa-healthcheck on all of our ipa servers, they all reported
following:
[root@ipa0 ~]# ipa-healthcheck --failures-only --output-type human
ERROR:
ipahealthcheck.ds.replication.ReplicationConflictCheck.idnsname=1.1.10.in-addr.arpa.,cn=dns,dc=example,dc=com:
Replication conflict
[root@ipa0 ~]#
[root@ipa0 ~]# ipa-healthcheck --failures-only
[
{
"source": "ipahealthcheck.ds.replication",
"kw": {
"msg": "Replication conflict",
"glue": true,
"conflict": "deletedEntryHasChildren",
"key": "idnsname=1.1.10.in-addr.arpa.,cn=dns,dc=example,dc=com"
},
"uuid": "3027f742-4b7b-4a20-9650-a5a030699480",
"duration": "0.002318",
"when": "20210819234114Z",
"check": "ReplicationConflictCheck",
"result": "ERROR"
}
]
[root@ipa0 ~]#
[root@ipa0 ~]# ipa dnsrecord-find 1.1.10.in-addr.arpa. --sizelimit=99999
--all --structured
dn: idnsname=1.1.10.in-addr.arpa.,cn=dns,dc=example,dc=com
Record name: @
Records:
Record type: NS
Record data: ipa1.example.com.
NS Hostname: ipa1.example.com.
idnsallowdynupdate: TRUE
idnsallowquery: any;
idnsallowtransfer: none;
idnssoaexpire: 1209600
idnssoaminimum: 3600
idnssoamname: ipa0.example.com.
idnssoarefresh: 3600
idnssoaretry: 900
idnssoarname: hostmaster
idnssoaserial: 1629023582
idnsupdatepolicy: grant EXAMPLE.COM krb5-subdomain 1.1.10.in-addr.arpa.
PTR; grant dhcp-key wildcard * ANY;
idnszoneactive: FALSE
objectclass: top, idnsrecord, idnszone, glue, extensibleobject
----------------------------
Number of entries returned 1
----------------------------
[root@ipa0 ~]#
Notice above, glue is true! After googling, I found following:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/...
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
The explanation made sense to me. However, I do not know what happened to
get us into this situation.
A good zone displays objectclass like this:
objectclass: top, idnsrecord, idnszone
Note, no "glue, extensibleobject" there.
This zone can not be deleted since "Not allowed on non-leaf entry". Any
ideas to delete this zone?
Thanks.
Kathy.
2 years, 7 months
Cannot add externally-signed IPA CA certificate
by Dmitry Perets
Hi,
I am trying to configure FreeIPA as a SubCA, and the "RootCA" is self-made with openssl. So I've signed the FreeIPA's request with my self-signed "root ca" certificate, but it looks like FreeIPA doesn't like it:
ipa-server-install --external-cert-file=/root/rootca/rootcacert.pem --external-cert-file=/root/rootca/certs/ipacert.pem
<...skipped...>
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR CA certificate CN=RootCA,OU=PRJ,O=COMPANY,L=Bonn,C=DE in /root/rootca/rootcacert.pem, /root/rootca/certs/ipacert.pem is not valid: not a CA certificate
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
The subj above is my self-made root CA cert, so it looks like something is missing in it. But what...?
Here is it below, it has the "Basic Constraint" set with CA:TRUE... What else is required, so that FreeIPA accepts it as a root CA?
Should I add it somewhere first, before running the ipa-server-install?
[root@ipa ~]# openssl x509 -text -noout -in /root/rootca/rootcacert.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA
Validity
Not Before: Oct 24 11:43:13 2018 GMT
Not After : Oct 21 11:43:13 2028 GMT
Subject: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
Modulus:
<...skipped...>
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81
X509v3 Authority Key Identifier:
keyid:B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
<...skipped...>
Thanks!!
2 years, 7 months
Auto add of replica NS records not always appropriate.
by Harry G. Coin
At replica install time: it might be better to add replica NS records
using the domain of the master NS record and not the domain in the
replica's /etc/hosts (assuming the replica has a host entry in the
master NS record domain). Presently I think you get the domain in
/etc/hostname whether or not it is as reachable/routable as the subnet
in the master NS domain.
2 years, 7 months
AD Trust not working after IPA server reinstall
by Vinícius Ferrão
Hello,
I had to reinstall our IPA server since we had Filesystem corruption beyond repair on it.
After the reinstall (with ipa-replica-install) AD Trust does not seems to be working anymore.
I tried to delete the trust and them re add it but there's no effect. Here's the outputs:
[root@idm1 ~]# ipa-adtrust-install --add-agents
The log file for this installation can be found in /var/log/ipaserver-adtrust-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
the IPA Server.
This includes:
* Configure Samba
* Add trust related objects to IPA LDAP server
To accept the default shown in brackets, press the Enter key.
Configuring cross-realm trusts for IPA server requires password for user 'admin'.
This user is a regular system account used for IPA server administration.
admin password:
IPA generated smb.conf detected.
Overwrite smb.conf? [no]: yes
Do you want to enable support for trusted domains in Schema Compatibility plugin?
This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.
Enable trusted domains support in slapi-nis? [no]: yes
The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring CIFS
[1/24]: validate server hostname
[2/24]: stopping smbd
[3/24]: creating samba domain object
Samba domain object already exists
[4/24]: retrieve local idmap range
[5/24]: writing samba config file
[6/24]: creating samba config registry
[7/24]: adding cifs Kerberos principal
[8/24]: adding cifs and host Kerberos principals to the adtrust agents group
[9/24]: check for cifs services defined on other replicas
[10/24]: adding cifs principal to S4U2Proxy targets
cifs principal already targeted, nothing to do.
[11/24]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
[12/24]: adding RID bases
RID bases already set, nothing to do
[13/24]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
[14/24]: activating CLDAP plugin
CLDAP plugin already configured, nothing to do
[15/24]: activating sidgen task
Sidgen task plugin already configured, nothing to do
[16/24]: map BUILTIN\Guests to nobody group
[17/24]: configuring smbd to start on boot
[18/24]: enabling trusted domains support for older clients via Schema Compatibility plugin
[19/24]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
[20/24]: adding fallback group
Fallback group already set, nothing to do
[21/24]: adding Default Trust View
Default Trust View already exists.
[22/24]: setting SELinux booleans
[23/24]: starting CIFS services
[24/24]: restarting smbd
Done configuring CIFS.
=============================================================================
Setup complete
You must make sure these network ports are open:
TCP Ports:
* 135: epmap
* 138: netbios-dgm
* 139: netbios-ssn
* 445: microsoft-ds
* 1024..1300: epmap listener range
* 3268: msft-gc
UDP Ports:
* 138: netbios-dgm
* 139: netbios-ssn
* 389: (C)LDAP
* 445: microsoft-ds
See the ipa-adtrust-install(1) man page for more details
=============================================================================
Doing the trust add since the last command didn't added it:
[root@idm1 ~]# ipa trust-add win.versatushpc.com.br<http://win.versatushpc.com.br>
Active Directory domain administrator: Administrator
Active Directory domain administrator's password:
---------------------------------------------------------------
Added Active Directory trust for realm "win.versatushpc.com.br<http://win.versatushpc.com.br>"
---------------------------------------------------------------
Realm name: win.versatushpc.com.br<http://win.versatushpc.com.br>
Domain NetBIOS name: VersatusHPC
Domain Security Identifier: S-1-5-21-3644117338-1171143469-618167831
Trust direction: Trusting forest
Trust type: Active Directory domain
Trust status: Established and verified
Fetch domains return 0:
[root@idm1 ~]# ipa trust-fetch-domains win.versatushpc.com.br<http://win.versatushpc.com.br>
----------------------------------------------------------------------------------------
List of trust domains successfully refreshed. Use trustdomain-find command to list them.
----------------------------------------------------------------------------------------
----------------------------
Number of entries returned 0
----------------------------
But trustdomain-find is able to find the domain:
[root@idm1 ~]# ipa trustdomain-find
Realm name: win.versatushpc.com.br<http://win.versatushpc.com.br>
Domain name: win.versatushpc.com.br<http://win.versatushpc.com.br>
Domain NetBIOS name: VersatusHPC
Domain Security Identifier: S-1-5-21-3644117338-1171143469-618167831
Domain enabled: True
----------------------------
Number of entries returned 1
----------------------------
Healthcheck complains about those issues:
[root@idm1 ~]# ipa-healthcheck --all --output-type human | grep -v SUCCESS
WARNING: ipahealthcheck.ipa.trust.IPATrustCatalogCheck.S-1-5-21-3644117338-1171143469-618167831: Look up of S-1-5-21-3644117338-1171143469-618167831 returned nothing
ERROR: ipahealthcheck.ipa.trust.IPATrustCatalogCheck.AD Global Catalog: AD Global Catalog not found in /usr/sbin/sssctl 'domain-status' output: Active servers:
IPA: idm1.nix.versatushpc.com.br<http://idm1.nix.versatushpc.com.br>
ERROR: ipahealthcheck.ipa.trust.IPATrustCatalogCheck.AD Domain Controller: AD Domain Controller not found in /usr/sbin/sssctl 'domain-status' output: Active servers:
IPA: idm1.nix.versatushpc.com.br<http://idm1.nix.versatushpc.com.br>
And finally we had an DNA Range issue, but I was able to solve it with this guide: https://rcritten.wordpress.com/2015/01/05/freeipa-and-no-dna-range/
[root@idm2 ~]# ipa-replica-manage dnarange-show
idm1.nix.versatushpc.com.br<http://idm1.nix.versatushpc.com.br>: 1278400006-1278499999
idm2.nix.versatushpc.com.br<http://idm2.nix.versatushpc.com.br>: 1278400000-1278499999
Seems to be OK, I think...
I'm running IPA on RHEL 8.4.
If it's easier to just remove IPA and reinstall from scratch, that's OK. This is a development system, the same goes for the Windows domain.
Thank you all.
2 years, 7 months
ldapsearch for compat tree does not display the AD trust users
by iulian roman
Hello,
I try to run some ldapsearch queries on the compat tree from some old clients. Unfortunately it does display only the Idm posix users, not the AD trust users. The query I am running for a particular AD user :
ldapsearch -Y GSSAPI -h ipaserver01.ipa.example.com -b "cn=compat,dc=ipa,dc=example,dc=com" "uid=aduser(a)example.com"
Any idea how to debug or where to look into ?
2 years, 7 months
ldap provider variables for AD trust
by iulian roman
Hello,
I have some old clients (sssd 1.9) for which I need to use ldap provider in sssd.conf. Does anyone know how ldap_search_base variables should look like in order to resolve the AD users ?
With the default settings, it does resolve the posix users/groups from IPA but not the AD users.
2 years, 7 months
ipa-healthcheck - ipahealthcheck.ipa.dna.IPADNARangeCheck: no matching entry found
by Kathy Zhu
Hello,
ipa-healthcheck is a great tool! Really appreciate Rob to make it working
for Centos.
When I ran it on all of our IPA servers, one server reported:
[root@ipa2 ~]# ipa-healthcheck --failures-only --output-type human
CRITICAL: ipahealthcheck.ipa.dna.IPADNARangeCheck: no matching entry found
[root@ipa2 ~]#
I created a user and a group on this server then deleted them,
rerun ipa-healthcheck, I still get the same error. Here is the jason format
of it:
{
"source": "ipahealthcheck.ipa.dna",
"kw": {
"exception": "no matching entry found"
},
"uuid": "aaf4da70-64ca-435f-8011-b40da74b874e",
"duration": "0.136489",
"when": "20210819224225Z",
"check": "IPADNARangeCheck",
"result": "CRITICAL"
}
We have 7 ipa servers, this is the only server with this error.
The success one looks like below:
{
"source": "ipahealthcheck.ipa.dna",
"kw": {
"range_start": 1889601184,
"next_start": 0,
"next_max": 0,
"range_max": 1889625999
},
"uuid": "1ce671b9-76cf-46ce-b7d2-d5eec4079d63",
"duration": "0.309565",
"when": "20210630231006Z",
"check": "IPADNARangeCheck",
"result": "SUCCESS"
}
Any suggestions/ideas to fix it?
Thank you!
Kathy
2 years, 8 months
UI can't list certs on fedora latest. Java bug?
by Harry G. Coin
What causes "IPA Error 4301: CertificateOperationError" / "Certificate
operation cannot be completed: Unable to communicate with CMS (500)"
on latest fedora 34 freeipa, running on two hosts, master/master?
Usually I'd expect 'ipa cert-show 1' to fail, but it works, and
'systemctl' reports everything is running, and all the UI and other
functions appear to be normal (even dnssec !).
detail:
[root@registry1 ~]# ipa cert-show 1
Issuing CA: ipa
Certificate:
MIIEozCCAwugAwIBAgIBATANBgkqhkiG9w0BAQsFADA+MRwwGgYDVQQKDBMxLlFVSUVURk9VTlRBSU4uQ09NMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMjEwNjEzMTkwNjA1WhcNNDEwNjEzMTkwNjA1WjA+MRwwGgYDVQQKDBMxLlFVSUVURk9VTlRBSU4uQ09NMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDGSq+Nim03HfChgq4uLuYh9JRZcGZQO08iUNGJRzFkBKehS1sZwbXlACSYC32SbqyHBiRXE4VlLmMuKwNzp0/HgLojgA+Cfx6/Ta+eiGq0M7qX2y2rKoZOGtrWo23uYqx02Xs/UKBzZ8EHZFc9rqDsU7muvCDcuniTH6r3Nc6aJyJs9ksa66BkSsEu3KnmTTvvu8Vfl5Wu8ZQwwaEEpLNDagNrN3dICD6zr+ysm4nr6cJlU+884ayUGdgyQRQXI28z173b14M1JhUbFeLsLpTOYIXAn0eQa5uaSrIi7YF5FUH6fczwt7PACzyPy5c7W8ayYgosKZCWKdo456ingv2kNbDh8lX5qmaK8163b3nqnk6VkO11FtwGwQQzzkMDUEkIDOxqisjqDtgNzRWx3XC/F1zojZjVKCQ6sRM2G26fY+qRHxxhPzeWrh6TD3HJLvVDBpMFAONrLSJeXXmaj+zkob4uBv7X8TYdVO8xPKVC1p+t9OqhFoE5r9pXD5SaWGUCAwEAAaOBqzCBqDAfBgNVHSMEGDAWgBRdbkmF2QnMBkVl/2zHw1FyAEtvmzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBxjAdBgNVHQ4EFgQUXW5JhdkJzAZFZf9sx8NRcgBLb5swRQYIKwYBBQUHAQEEOTA3MDUGCCsGAQUFBzABhilodHRwOi8vaXBhLWNhLjEucXVpZXRmb3VudGFpbi5jb20vY2Evb2NzcDANBgkqhkiG9w0BAQsFAAOCAYEAq86t5DfFgXEKWTyOH0TgGIW2fVNVoeThc7emUx3P0wxkFK05grDlAW+sTbNe8aw4h8BowixIfDQ8hfwZVn7LIXqbOohNs0AMPaRc5XYOqU/ciG11YiI6jgEMhtC5fBlT3Ni4U7JQlikI7xcLlpWleSQTp+KX2sEFnASxHWkzlX0iWOwIZAr9CHpo06HH1yukfvosIsfRpdbpXPRcLaZ1pUlCUlviDEsI+HIkU/5N8Jja13BSguT5daCMywtFTwtzWgWSKtMC2AoH2y7+Dufu3/YDpR0WhdzJSS0ZztJULUJw6DGKO03EtuIvGVwoOqDSo10GYPxwF4HQHXQBNzed9tRKkpbBCNNx1L6hHbH+OutGNGDc9Dl9PWRHu3OP0ME5NdAq0rW6+Ibao+Dv5R3jxV8R0ky+08jyqMSVzzYYGz10y5DWFkyQfFO2daX6DBlWPRIf7hZJv4NW9Dd3KQZKIduZMGScvBKy1QaPu1WJVftNU5J6F67xiTUBxFXfM+hm
Subject: CN=Certificate Authority,O=1.QUIETFOUNTAIN.COM
Issuer: CN=Certificate Authority,O=1.QUIETFOUNTAIN.COM
Not Before: Sun Jun 13 19:06:05 2021 UTC
Not After: Thu Jun 13 19:06:05 2041 UTC
Serial number: 1
Serial number (hex): 0x1
Revoked: False
[root@registry1 ~]# systemctl is-system-running
running
[root@registry1 ~]#
notice /var/log/pki/pki-tomcat/ca/debug.2021-08-18.log
ends with:
2021-08-18 16:42:16 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] INFO:
DBVirtualList: dn: cn=2000,ou=certificateRepository,ou=ca,o=ipaca
2021-08-18 16:42:16 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] SEVERE:
Operation Error - class netscape.ldap.LDAPException cannot be cast to
class netscape.ldap.LDAPEntry (netscape.ldap.LDAPException and
netscape.ldap.LDAPEntry are in unnamed module of loader
java.net.URLClassLoader @5fcfe4b2)
java.lang.ClassCastException: class netscape.ldap.LDAPException cannot
be cast to class netscape.ldap.LDAPEntry (netscape.ldap.LDAPException
and netscape.ldap.LDAPEntry are in unnamed module of loader
java.net.URLClassLoader @5fcfe4b2)
at
com.netscape.cmscore.dbs.DBVirtualList.getEntries(DBVirtualList.java:477)
at
com.netscape.cmscore.dbs.DBVirtualList.getPage(DBVirtualList.java:610)
at
com.netscape.cmscore.dbs.DBVirtualList.getPage(DBVirtualList.java:602)
at
com.netscape.cmscore.dbs.DBVirtualList.getElementAt(DBVirtualList.java:754)
at
com.netscape.cmscore.dbs.CertRecordList.getCertRecord(CertRecordList.java:110)
at
org.dogtagpki.server.ca.rest.CertService.searchCerts(CertService.java:474)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native
Method)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:236)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:406)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:213)
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:228)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)
at jdk.internal.reflect.GeneratedMethodAccessor55.invoke(Unknown
Source)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
at java.base/java.security.AccessController.doPrivileged(Native
Method)
at
java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:550)
at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:221)
at
org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:146)
at java.base/java.security.AccessController.doPrivileged(Native
Method)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
at
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
at jdk.internal.reflect.GeneratedMethodAccessor49.invoke(Unknown
Source)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
at java.base/java.security.AccessController.doPrivileged(Native
Method)
at
java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:550)
at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
at
org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:146)
at java.base/java.security.AccessController.doPrivileged(Native
Method)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542)
at
com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at
org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357)
at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:433)
at
org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at
org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)
at
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at
java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at
java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:829)
2021-08-18 16:42:16 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] SEVERE: Unable
to search for certificates: java.lang.ClassCastException: class
netscape.ldap.LDAPException cannot be cast to class
netscape.ldap.LDAPEntry (netscape.ldap.LDAPException and
netscape.ldap.LDAPEntry are in unnamed module of loader
java.net.URLClassLoader @5fcfe4b2)
java.lang.RuntimeException: java.lang.ClassCastException: class
netscape.ldap.LDAPException cannot be cast to class
netscape.ldap.LDAPEntry (netscape.ldap.LDAPException and
netscape.ldap.LDAPEntry are in unnamed module of loader
java.net.URLClassLoader @5fcfe4b2)
at
com.netscape.cmscore.dbs.DBVirtualList.getEntries(DBVirtualList.java:523)
at
com.netscape.cmscore.dbs.DBVirtualList.getPage(DBVirtualList.java:610)
at
com.netscape.cmscore.dbs.DBVirtualList.getPage(DBVirtualList.java:602)
at
com.netscape.cmscore.dbs.DBVirtualList.getElementAt(DBVirtualList.java:754)
at
com.netscape.cmscore.dbs.CertRecordList.getCertRecord(CertRecordList.java:110)
at
org.dogtagpki.server.ca.rest.CertService.searchCerts(CertService.java:474)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native
Method)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:236)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:406)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:213)
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:228)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)
at jdk.internal.reflect.GeneratedMethodAccessor55.invoke(Unknown
Source)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
at java.base/java.security.AccessController.doPrivileged(Native
Method)
at
java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:550)
at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:221)
at
org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:146)
at java.base/java.security.AccessController.doPrivileged(Native
Method)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
at
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
at jdk.internal.reflect.GeneratedMethodAccessor49.invoke(Unknown
Source)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
at java.base/java.security.AccessController.doPrivileged(Native
Method)
at
java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:550)
at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
at
org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:146)
at java.base/java.security.AccessController.doPrivileged(Native
Method)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542)
at
com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at
org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357)
at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:433)
at
org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at
org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)
at
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at
java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at
java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.ClassCastException: class
netscape.ldap.LDAPException cannot be cast to class
netscape.ldap.LDAPEntry (netscape.ldap.LDAPException and
netscape.ldap.LDAPEntry are in unnamed module of loader
java.net.URLClassLoader @5fcfe4b2)
at
com.netscape.cmscore.dbs.DBVirtualList.getEntries(DBVirtualList.java:477)
... 62 more
2 years, 8 months
