FreeIPA-users May 2025

freeipa-users@lists.fedorahosted.org

27 participants
39 discussions

Re: [EXTERNAL] Re: It ain't easy to dig a user's last login time info out of IdM/FreeIPA
by Shane Frasier 12 Jun '25

12 Jun '25

Hello, Apologies for reviving an old thread, but I was wondering if there is any way to turn this replication on for our local FreeIPA cluster? I'd like to use the krbLastAuthentication data to disable inactive users, but the timestamps are reset every time I upgrade the cluster. Thank you, Shane Frasier (maverick(a)maverickdolphin.com)

3 5

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 10 Jun '25

10 Jun '25

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

3 4

After upgrad to 9.6 FreeIPA don't start
by Günther J. Niederwimmer 09 Jun '25

09 Jun '25

Hallo Liste, I'm running Oracle 9.5, but since updating to 9.6, FreeIPA hasn't worked anymore. The replica server survived the upgrade. I've tried it three times now, restoring a backup and updating to 9.6, with the same result. The IPA server is the older installation, around 9.2. How can I fix this? Any help is appreciated. -- mit freundlichen Grüßen / best regards Günther J. Niederwimmer

4 8

Assing UID/GID to the user folder
by Daniel Ruiz 04 Jun '25

04 Jun '25

Hello, First of all, sorry if my question is very simple but I'm new in Free-IPA. I want to migrate my current NIS configuration (ypserv+ypbind) with shared NFS home folders. I have a script to add all my NIS users to IPA assigning 6th field from /etc/passwd as "--homedir". In my scenario, all users log in computers that acts as "YP clients", so when they log in, $HOME folders has been created before in my NFS server and have UID/GID assigned correctly. Now, with Free-IPA, if I create a new user in the server, I need to create before his/her folder, because that user will log in in a Free-IPA client computer and user folders are mounted using NFS. So my question is: when I create that folder in the server, what uid/gid must I assign if user is not already created? I have read in some webs that if user folders are shared in a NFS environment, that users folders must be created before user first login... but if I create user folder before "ipa user-add", how can I know gid/uid that I must apply in "ipa user-add" command? I have read that uid/gid from system are not the same that uid/gid I can check with "ipa user-show". Thanks. But that all users already exist before installation of Free-IPA, so no

3 5

Re: freeIPA fails update 4.12.2-5.el9 t 4.12.2-9.el9
by Vicente Quintans 03 Jun '25

03 Jun '25

We found this issue today, upgrading from Fedora 40 to Fedora 41. In dogtagpki the /ca/rest/account/login endpoint (actually all /ca/rest endpoints) was moved to /ca/v1 in this commit: https://github.com/dogtagpki/pki/commit/850e6b9e5128264a471e57b70ab8d970cf9… We were able to complete the upgrade succesfully modifying the file /usr/lib/python3.13/site-packages/ipaserver/plugins/dogtag.py changing al "/rest" to "/v1". With this modification ipa-server-upgrade completed successfully. It seems there is some kind of version mismatch. Greetings, Vicente Quintáns.

10 35

Re: IPA Replica installation is failing - Missing certificate Server-Cert cert-pki-ca a
by Rob Crittenden 29 May '25

29 May '25

Jhon Torres wrote: > Thanks!, I attached the file log What does this command give you: # pki securitydomain-show WARNING: UNKNOWN_ISSUER encountered on 'CN=ipa.example.test,O=EXAMPLE.TEST' indicates an unknown CA cert 'CN=Certificate Authority,O=EXAMPLE.TEST' Trust this certificate (y/N)? y Domain: IPA CA Subsystem: Host ID: CA ipa.example.test 443 Hostname: ipa.example.test Port: 80 Secure Port: 443 Domain Manager: TRUE KRA Subsystem: Host ID: KRA ipa.example.test 443 Hostname: ipa.example.test Port: 80 Secure Port: 443 Domain Manager: FALSE It looks to me like no CA is registered within the securitydomain. rob > > El mié, 28 may 2025 a las 12:40, Rob Crittenden (<rcritten(a)redhat.com > <mailto:rcritten@redhat.com>>) escribió: > > John Tor via FreeIPA-users wrote: > > Hi, > > > > I had tried many times to install free-ipa-replica, but I always > have the same error at this step: > > > > DEBUG: NSSDatabase.get_cert(Server-Cert cert-pki-ca) begins > > DEBUG: Command: certutil -L -d /var/lib/pki/pki-tomcat/conf/alias > -f /tmp/tmpxotjk756/password.txt -n Server-Cert cert-pki-ca -a > > DEBUG: stdout: -1 > > DEBUG: NSSDatabase: stderr: > > certutil: Could not find cert: Server-Cert cert-pki-ca > > : PR_FILE_NOT_FOUND_ERROR: File not found > > > > DEBUG: Cert not found: Server-Cert cert-pki-ca > > ^^ is fine and not causing any issues. > > > INFO: Updating /var/lib/pki/pki-tomcat/conf/serverCertNick.conf > > INFO: Updating serverCertNickFile in server.xml > > INFO: Joining security domain at https://master.example.com:443 > > ERROR: KeyError: 'CA' > > For ^^ we'd need to see the full /var/log/ipareplicata-install.log to > try to determine what is going on. > > rob > > > File "/usr/lib/python3.9/site-packages/pki/server/pkispawn.py", > line 594, in main > > deployer.spawn() > > File > "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line > 5986, in spawn > > scriptlet.spawn(self) > > File > "/usr/lib/python3.9/site-packages/pki/server/deployment/scriptlets/configuration.py", > line 76, in spawn > > deployer.setup_security_domain(subsystem) > > File > "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line > 2854, in setup_security_domain > > self.join_security_domain() > > File > "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line > 2795, in join_security_domain > > sd_subsystem = self.domain_info.subsystems['CA'] > > > > > > Failed to configure CA instance > > See the installation logs and the following files/directories for > more information: > > /var/log/pki/pki-tomcat > > Traceback (most recent call last): > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", > line 688, in start_creation > > run_step(full_msg, method) > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", > line 674, in run_step > > method() > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/cainstance.py", > line 685, in __spawn_instance > > DogtagInstance.spawn_instance( > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", > line 227, in spawn_instance > > self.handle_setup_error(e) > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", > line 643, in handle_setup_error > > raise RuntimeError( > > RuntimeError: CA configuration failed. > > > > [error] RuntimeError: CA configuration failed. > > [error] RuntimeError: CA configuration failed. > > Removing /root/.dogtag/pki-tomcat/ca > > Your system may be partly configured. > > Run /usr/sbin/ipa-server-install --uninstall to clean up. > > > > File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", > line 219, in execute > > return_value = self.run() > > File > "/usr/lib/python3.9/site-packages/ipapython/install/cli.py", line > 343, in run > > return cfgr.run() > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 360, in run > > return self.execute() > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 386, in execute > > for rval in self._executor(): > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 435, in __runner > > exc_handler(exc_info) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 468, in _handle_execute_exception > > self._handle_exception(exc_info) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 458, in _handle_exception > > six.reraise(*exc_info) > > File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise > > raise value > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 425, in __runner > > step() > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 419, in step_next > > return next(self.__gen) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line > 81, in run_generator_with_yield_from > > six.reraise(*exc_info) > > File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise > > raise value > > File > "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line > 59, in run_generator_with_yield_from > > value = gen.send(prev_value) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 663, in _configure > > next(executor) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 435, in __runner > > exc_handler(exc_info) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 468, in _handle_execute_exception > > self._handle_exception(exc_info) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 526, in _handle_exception > > self.__parent._handle_exception(exc_info) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 458, in _handle_exception > > six.reraise(*exc_info) > > File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise > > raise value > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 523, in _handle_exception > > super(ComponentBase, self)._handle_exception(exc_info) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 458, in _handle_exception > > six.reraise(*exc_info) > > File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise > > raise value > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 425, in __runner > > step() > > File > "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line > 419, in step_next > > return next(self.__gen) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line > 81, in run_generator_with_yield_from > > six.reraise(*exc_info) > > File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise > > raise value > > File > "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line > 59, in run_generator_with_yield_from > > value = gen.send(prev_value) > > File > "/usr/lib/python3.9/site-packages/ipapython/install/common.py", line > 65, in _install > > for unused in self._installer(self.parent): > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/server/__init__.py", > line 687, in main > > replica_install(self) > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", > line 387, in decorated > > func(installer) > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", > line 1446, in install > > ca.install(False, config, options, custodia=custodia) > > File "/usr/lib/python3.9/site-packages/ipaserver/install/ca.py", > line 546, in install > > install_step_0(standalone, replica_config, options, > custodia=custodia) > > File "/usr/lib/python3.9/site-packages/ipaserver/install/ca.py", > line 621, in install_step_0 > > ca.configure_instance( > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/cainstance.py", > line 522, in configure_instance > > self.start_creation(runtime=runtime) > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", > line 688, in start_creation > > run_step(full_msg, method) > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", > line 674, in run_step > > method() > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/cainstance.py", > line 685, in __spawn_instance > > DogtagInstance.spawn_instance( > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", > line 227, in spawn_instance > > self.handle_setup_error(e) > > File > "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", > line 643, in handle_setup_error > > raise RuntimeError( > > > > The ipa-replica-install command failed, exception: RuntimeError: > CA configuration failed. > > CA configuration failed. > > The ipa-replica-install command failed. See > /var/log/ipareplica-install.log for more information > > > > I am stuck in a loop, I tried with new server but It didn't work. > I am using AlmaLinux 9.6 fully updated and the command I used was: > > > > ipa-replica-install --setup-dns --forwarder 1.1.1.1 --setup-ca > --verbose > > > > The command ipa-client-install worked perfect. > > > > certutil -L -d sql:/var/lib/pki/pki-tomcat/conf/alias > > > > Certificate Nickname Trust > Attributes > > > SSL,S/MIME,JAR/XPI > > > > caSigningCert cert-pki-ca CTu,Cu,Cu > > ocspSigningCert cert-pki-ca u,u,u > > auditSigningCert cert-pki-ca u,u,u > > subsystemCert cert-pki-ca u,u,u > > > > > > > > I don't know what else to do :/ > > > > Regards > > > > > > -- > Jhon Albert Torres H.

3 6

Re: [EXTERNAL] Re: It ain't easy to dig a user's last login time info out of IdM/FreeIPA
by Shane Frasier 29 May '25

29 May '25

Thanks Rob. I will try that when I upgrade the production cluster - probably next week - and let you know what I find. For what it's worth, I upgraded our staging cluster this morning and the last authentication timestamps all reset/vanished as I have been seeing. That was before I saw your suggestion about the 389 logs, though. Shane

1 0

update-crypto-policies to FUTURE causes server install to fail
by Entrepreneur AJ 29 May '25

29 May '25

Cross posted on https://lists.dogtagpki.org/archives/list/users@lists.dogtagpki.org/thread/… but looks like the community there has dwindled: On a fresh install of Alma Linux 9.6 I ran update-crypto-policies --set FUTURE then rebooted my system. I then attempted to install FreeIPA Server which failed due with the following message: 2025-05-29T12:26:11Z DEBUG The ipa-server-install command failed, exception: RuntimeError: CA configuration failed. 2025-05-29T12:26:11Z ERROR CA configuration failed. 2025-05-29T12:26:11Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information I looked further back in the logs to find: INFO: Creating new temp SSL server cert for ipa1.man-gb.eajglobal.net DEBUG: Command: pki -d /var/lib/pki/pki-tomcat/conf/alias -f /var/lib/pki/pki-tomcat/conf/password.conf nss-cert-request --subject cn=ipa1.man-gb.eajglobal.net,o=2025-05-29 13:25:36 --csr /tmp/tmpdvz_k8lc/sslserver.csr --key-type RSA --key-size 2048 --hash SHA256 --debug FINE: Initializing NSS FINE: Logging into internal token FINE: Using internal token FINE: NSSDatabase: Creating RSA key FINE: NSSDatabase: - size: 2048 FINE: CryptoUtil: Generating KRA key pair FINE: CryptoUtil: - temporary: null FINE: CryptoUtil: - sensitive: null FINE: CryptoUtil: - extractable: null FINE: CryptoUtil: generateRSAKeyPair with key usage FINE: CryptoUtil: generateRSAKeyPair with key usage mask FINE: CryptoUtil: - key size: 2048 WARNING: Ignored jss.crypto.Policy violation: unsafe RSA key size of 2048. Policy.RSA_MINIMUM_KEY_SIZE dictates a minimum of 4096 FINE: NSSDatabase: Creating PKCS #10 request FINE: NSSDatabase: - subjecct: cn=ipa1.man-gb.eajglobal.net,o=2025-05-29 13:25:36 FINE: NSSDatabase: - algorithm: SHA256withRSA FINE: CryptoUtil: Creating PKCS #10 request FINE: CryptoUtil: - algorithm: SHA256withRSA java.security.InvalidKeyException: Token exception occurred: Unable to create signing context: (-8011) Unknown error at org.mozilla.jss.provider.java.security.JSSSignatureSpi.engineInitSign(JSSSignatureSpi.java:60) at java.base/java.security.Signature$Delegate.engineInitSign(Signature.java:1370) at java.base/java.security.Signature.initSign(Signature.java:635) at com.netscape.cmsutil.crypto.CryptoUtil.createPKCS10Request(CryptoUtil.java:1124) at org.dogtagpki.nss.NSSDatabase.createPKCS10Request(NSSDatabase.java:1109) at com.netscape.cmstools.nss.NSSCertRequestCLI.execute(NSSCertRequestCLI.java:152) at org.dogtagpki.cli.CommandCLI.execute(CommandCLI.java:58) at org.dogtagpki.cli.CLI.execute(CLI.java:353) at org.dogtagpki.cli.CLI.execute(CLI.java:353) at org.dogtagpki.cli.CLI.execute(CLI.java:353) at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:680) at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:719) Caused by: org.mozilla.jss.crypto.TokenException: Unable to create signing context: (-8011) Unknown error at org.mozilla.jss.pkcs11.PK11Signature.initSigContext(Native Method) at org.mozilla.jss.pkcs11.PK11Signature.engineInitSign(PK11Signature.java:133) at org.mozilla.jss.crypto.Signature.initSign(Signature.java:56) at org.mozilla.jss.provider.java.security.JSSSignatureSpi.engineInitSign(JSSSignatureSpi.java:56) ... 11 more ERROR: CalledProcessError: Command '['runuser', '-u', 'pkiuser', '--', 'pki', '-d', '/var/lib/pki/pki-tomcat/conf/alias', '-f', '/var/lib/pki/pki-tomcat/conf/password.conf', 'nss-cert-request', '--subject', 'cn=ipa1.man-gb.eajglobal.net,o=2025-05-29 13:25:36', '--csr', '/tmp/tmpdvz_k8lc/sslserver.csr', '--key-type', 'RSA', '--key-size', '2048', '--hash', 'SHA256', '--debug']' returned non-zero exit status 255. File "/usr/lib/python3.9/site-packages/pki/server/pkispawn.py", line 594, in main deployer.spawn() File "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line 5986, in spawn scriptlet.spawn(self) File "/usr/lib/python3.9/site-packages/pki/server/deployment/scriptlets/configuration.py", line 114, in spawn deployer.create_temp_sslserver_cert() File "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line 3403, in create_temp_sslserver_cert nssdb.create_request( File "/usr/lib/python3.9/site-packages/pki/nssdb.py", line 1009, in create_request self.__create_request( File "/usr/lib/python3.9/site-packages/pki/nssdb.py", line 1608, in __create_request self.run(cmd, check=True, runas=True) File "/usr/lib/python3.9/site-packages/pki/nssdb.py", line 332, in run result = subprocess.run( File "/usr/lib64/python3.9/subprocess.py", line 528, in run raise CalledProcessError(retcode, process.args, 2025-05-29T12:26:11Z CRITICAL Failed to configure CA instance 2025-05-29T12:26:11Z CRITICAL See the installation logs and the following files/directories for more information: 2025-05-29T12:26:11Z CRITICAL /var/log/pki/pki-tomcat The only log file in /var/log/pki or it's sub directories that had any logs was pki-ca-spawn, the logs are as follows: 2025-05-29 13:25:36 INFO: Connecting to LDAP server at ldap://ipa1.man-gb.eajglobal.net:389 2025-05-29 13:25:36 INFO: Connecting to LDAP server at ldap://ipa1.man-gb.eajglobal.net:389 2025-05-29 13:25:36 INFO: BEGIN spawning CA subsystem in pki-tomcat instance 2025-05-29 13:25:36 INFO: Loading instance: pki-tomcat 2025-05-29 13:25:36 INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf 2025-05-29 13:25:36 INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf 2025-05-29 13:25:36 INFO: Loading external certs from /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: File does not exist: /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: Reusing pkiuser group (GID: 17) 2025-05-29 13:25:36 INFO: Reusing pkiuser user (UID: 17) 2025-05-29 13:25:36 DEBUG: Retrieving UID for 'pkiuser' 2025-05-29 13:25:36 DEBUG: UID of 'pkiuser' is 17 2025-05-29 13:25:36 DEBUG: Retrieving GID for 'pkiuser' 2025-05-29 13:25:36 DEBUG: GID of 'pkiuser' is 17 2025-05-29 13:25:36 INFO: Initialization 2025-05-29 13:25:36 INFO: Setting up infrastructure 2025-05-29 13:25:36 INFO: Preparing pki-tomcat instance 2025-05-29 13:25:36 INFO: Loading instance: pki-tomcat 2025-05-29 13:25:36 INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf 2025-05-29 13:25:36 INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf 2025-05-29 13:25:36 INFO: Loading external certs from /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: File does not exist: /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/bin to /usr/share/tomcat/bin 2025-05-29 13:25:36 DEBUG: Command: ln -s /usr/share/tomcat/bin /var/lib/pki/pki-tomcat/bin 2025-05-29 13:25:36 INFO: Creating /etc/pki/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: mkdir /etc/pki/pki-tomcat 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/conf to /etc/pki/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: ln -s /etc/pki/pki-tomcat /var/lib/pki/pki-tomcat/conf 2025-05-29 13:25:36 INFO: Creating /var/log/pki/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/log/pki/pki-tomcat 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/logs to /var/log/pki/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: ln -s /var/log/pki/pki-tomcat /var/lib/pki/pki-tomcat/logs 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/lib to /usr/share/pki/server/lib 2025-05-29 13:25:36 DEBUG: Command: ln -s /usr/share/pki/server/lib /var/lib/pki/pki-tomcat/lib 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/common 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/common 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/common/lib to /usr/share/pki/server/common/lib 2025-05-29 13:25:36 DEBUG: Command: ln -s /usr/share/pki/server/common/lib /var/lib/pki/pki-tomcat/common/lib 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/temp 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/temp 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/work 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/work 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/certs 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/conf/certs 2025-05-29 13:25:36 INFO: Copying /etc/tomcat/server.xml to /var/lib/pki/pki-tomcat/conf/server.xml 2025-05-29 13:25:36 DEBUG: Command: cp /etc/tomcat/server.xml /var/lib/pki/pki-tomcat/conf/server.xml 2025-05-29 13:25:36 INFO: Removing LockOutRealm 2025-05-29 13:25:36 INFO: Removing UserDatabase 2025-05-29 13:25:36 INFO: Updating AccessLogValve 2025-05-29 13:25:36 INFO: Configuring Tomcat admin port 2025-05-29 13:25:36 INFO: Removing AprLifecycleListener 2025-05-29 13:25:36 INFO: Adding PKIListener 2025-05-29 13:25:36 INFO: Configuring HTTP connector 2025-05-29 13:25:36 INFO: Adding HTTPS connector 2025-05-29 13:25:36 INFO: Adding SSL host configuration 2025-05-29 13:25:36 INFO: Adding SSL certificate configuration 2025-05-29 13:25:36 INFO: Adding RewriteValve 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/Catalina 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/conf/Catalina 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/Catalina/localhost 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/conf/Catalina/localhost 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/conf/Catalina/localhost/rewrite.config to /usr/share/pki/server/conf/Catalina/localhost/rewrite.config 2025-05-29 13:25:36 DEBUG: Command: ln -s /usr/share/pki/server/conf/Catalina/localhost/rewrite.config /var/lib/pki/pki-tomcat/conf/Catalina/localhost/rewrite.config 2025-05-29 13:25:36 INFO: Adding AJP connector for IPv4 2025-05-29 13:25:36 INFO: Adding AJP connector for IPv6 2025-05-29 13:25:36 INFO: Updating AccessLogValve 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/conf/catalina.properties to /usr/share/pki/server/conf/catalina.properties 2025-05-29 13:25:36 DEBUG: Command: ln -s /usr/share/pki/server/conf/catalina.properties /var/lib/pki/pki-tomcat/conf/catalina.properties 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/conf/context.xml to /etc/tomcat/context.xml 2025-05-29 13:25:36 DEBUG: Command: ln -s /etc/tomcat/context.xml /var/lib/pki/pki-tomcat/conf/context.xml 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/conf/logging.properties to /usr/share/pki/server/conf/logging.properties 2025-05-29 13:25:36 DEBUG: Command: ln -s /usr/share/pki/server/conf/logging.properties /var/lib/pki/pki-tomcat/conf/logging.properties 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/conf/web.xml to /etc/tomcat/web.xml 2025-05-29 13:25:36 DEBUG: Command: ln -s /etc/tomcat/web.xml /var/lib/pki/pki-tomcat/conf/web.xml 2025-05-29 13:25:36 INFO: Using specified server NSS database password 2025-05-29 13:25:36 INFO: Using specified internal database password 2025-05-29 13:25:36 INFO: Generating random replication manager password 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/password.conf 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/alias 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/conf/alias 2025-05-29 13:25:36 INFO: Creating NSS database: /var/lib/pki/pki-tomcat/conf/alias 2025-05-29 13:25:36 DEBUG: Command: certutil -N -d /var/lib/pki/pki-tomcat/conf/alias -f /tmp/tmp2c_5a4u2/internal_password.txt 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/alias to /var/lib/pki/pki-tomcat/conf/alias 2025-05-29 13:25:36 DEBUG: Command: ln -s /var/lib/pki/pki-tomcat/conf/alias /var/lib/pki/pki-tomcat/alias 2025-05-29 13:25:36 INFO: Creating /etc/sysconfig/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/server/conf/tomcat.conf /etc/sysconfig/pki-tomcat 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/tomcat.conf 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/server/conf/tomcat.conf /var/lib/pki/pki-tomcat/conf/tomcat.conf 2025-05-29 13:25:36 INFO: Deploying ROOT web application 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/Catalina/localhost/ROOT.xml 2025-05-29 13:25:36 INFO: Deploying pki web application 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/Catalina/localhost/pki.xml 2025-05-29 13:25:36 INFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: mkdir /etc/sysconfig/pki/tomcat/pki-tomcat 2025-05-29 13:25:36 INFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/setup/pkidaemon_registry /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat 2025-05-29 13:25:36 INFO: Creating /etc/systemd/system/pki-tomcatd(a)pki-tomcat.service.d 2025-05-29 13:25:36 DEBUG: Command: mkdir /etc/systemd/system/pki-tomcatd(a)pki-tomcat.service.d 2025-05-29 13:25:36 DEBUG: Command: systemctl daemon-reload 2025-05-29 13:25:36 INFO: Linking /etc/systemd/system/pki-tomcatd.target.wants/pki-tomcatd(a)pki-tomcat.service to /lib/systemd/system/pki-tomcatd@.service 2025-05-29 13:25:36 DEBUG: Command: ln -s /lib/systemd/system/pki-tomcatd@.service /etc/systemd/system/pki-tomcatd.target.wants/pki-tomcatd(a)pki-tomcat.service 2025-05-29 13:25:36 INFO: Creating CA subsystem 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/ca 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/ca 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/ca/registry to /etc/sysconfig/pki/tomcat/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: ln -s /etc/sysconfig/pki/tomcat/pki-tomcat /var/lib/pki/pki-tomcat/ca/registry 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/ca 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/conf/ca 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/ca/conf to /var/lib/pki/pki-tomcat/conf/ca 2025-05-29 13:25:36 DEBUG: Command: ln -s /var/lib/pki/pki-tomcat/conf/ca /var/lib/pki/pki-tomcat/ca/conf 2025-05-29 13:25:36 INFO: Storing subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/conf/registry.cfg to /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/registry.cfg /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/logs/ca 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/logs/ca 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/ca/logs to /var/lib/pki/pki-tomcat/logs/ca 2025-05-29 13:25:36 DEBUG: Command: ln -s /var/lib/pki/pki-tomcat/logs/ca /var/lib/pki/pki-tomcat/ca/logs 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/logs/ca/archive 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/logs/ca/archive 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/logs/ca/signedAudit 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/logs/ca/signedAudit 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/ca/alias to /var/lib/pki/pki-tomcat/alias 2025-05-29 13:25:36 DEBUG: Command: ln -s /var/lib/pki/pki-tomcat/alias /var/lib/pki/pki-tomcat/ca/alias 2025-05-29 13:25:36 INFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat/ca 2025-05-29 13:25:36 DEBUG: Command: mkdir /etc/sysconfig/pki/tomcat/pki-tomcat/ca 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/server/etc/default.cfg to /etc/sysconfig/pki/tomcat/pki-tomcat/ca/default.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/server/etc/default.cfg /etc/sysconfig/pki/tomcat/pki-tomcat/ca/default.cfg 2025-05-29 13:25:36 INFO: Creating /tmp/tmpmh3m7z49/CS.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/CS.cfg /tmp/tmpmh3m7z49/CS.cfg 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/emails to /var/lib/pki/pki-tomcat/conf/ca/emails 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/conf/ca/emails 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/ExpiredUnpublishJob /var/lib/pki/pki-tomcat/conf/ca/emails/ExpiredUnpublishJob 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/ExpiredUnpublishJobItem /var/lib/pki/pki-tomcat/conf/ca/emails/ExpiredUnpublishJobItem 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/certIssued_CA /var/lib/pki/pki-tomcat/conf/ca/emails/certIssued_CA 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/certIssued_CA.html /var/lib/pki/pki-tomcat/conf/ca/emails/certIssued_CA.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/certIssued_RA /var/lib/pki/pki-tomcat/conf/ca/emails/certIssued_RA 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/certIssued_RA.html /var/lib/pki/pki-tomcat/conf/ca/emails/certIssued_RA.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/certRequestRejected.html /var/lib/pki/pki-tomcat/conf/ca/emails/certRequestRejected.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/certRevoked_CA /var/lib/pki/pki-tomcat/conf/ca/emails/certRevoked_CA 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/certRevoked_CA.html /var/lib/pki/pki-tomcat/conf/ca/emails/certRevoked_CA.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/certRevoked_RA /var/lib/pki/pki-tomcat/conf/ca/emails/certRevoked_RA 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/certRevoked_RA.html /var/lib/pki/pki-tomcat/conf/ca/emails/certRevoked_RA.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/euJob1.html /var/lib/pki/pki-tomcat/conf/ca/emails/euJob1.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/euJob1Item.html /var/lib/pki/pki-tomcat/conf/ca/emails/euJob1Item.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/publishCerts.html /var/lib/pki/pki-tomcat/conf/ca/emails/publishCerts.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/publishCertsItem.html /var/lib/pki/pki-tomcat/conf/ca/emails/publishCertsItem.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/reqInQueue_CA /var/lib/pki/pki-tomcat/conf/ca/emails/reqInQueue_CA 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/reqInQueue_CA.html /var/lib/pki/pki-tomcat/conf/ca/emails/reqInQueue_CA.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/reqInQueue_RA /var/lib/pki/pki-tomcat/conf/ca/emails/reqInQueue_RA 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/reqInQueue_RA.html /var/lib/pki/pki-tomcat/conf/ca/emails/reqInQueue_RA.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/riq1Item.html /var/lib/pki/pki-tomcat/conf/ca/emails/riq1Item.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/riq1Summary.html /var/lib/pki/pki-tomcat/conf/ca/emails/riq1Summary.html 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/rnJob1.txt /var/lib/pki/pki-tomcat/conf/ca/emails/rnJob1.txt 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/rnJob1Item.txt /var/lib/pki/pki-tomcat/conf/ca/emails/rnJob1Item.txt 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/emails/rnJob1Summary.txt /var/lib/pki/pki-tomcat/conf/ca/emails/rnJob1Summary.txt 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/ca/emails to /var/lib/pki/pki-tomcat/conf/ca/emails 2025-05-29 13:25:36 DEBUG: Command: ln -s /var/lib/pki/pki-tomcat/conf/ca/emails /var/lib/pki/pki-tomcat/ca/emails 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/profiles to /var/lib/pki/pki-tomcat/conf/ca/profiles 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/conf/ca/profiles 2025-05-29 13:25:36 DEBUG: Command: mkdir /var/lib/pki/pki-tomcat/conf/ca/profiles/ca 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/DomainController.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/DomainController.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/ECAdminCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/ECAdminCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/acmeServerCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/acmeServerCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caAdminCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caAdminCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caAgentFileSigning.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caAgentFileSigning.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caAgentServerCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caAgentServerCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caAuditSigningCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caAuditSigningCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCACert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCACert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCECUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCECUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCECserverCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCECserverCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCECserverCertWithCRLDP.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCECserverCertWithCRLDP.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCECsubsystemCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCECsubsystemCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCauditSigningCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCauditSigningCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCcaCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCcaCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCcaIssuanceProtectionCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCcaIssuanceProtectionCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCkraStorageCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCkraStorageCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCkraTransportCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCkraTransportCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCocspCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCocspCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCserverCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCserverCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCserverCertWithCRLDP.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCserverCertWithCRLDP.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCMCsubsystemCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCMCsubsystemCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caCrossSignedCACert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caCrossSignedCACert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caDirBasedDualCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caDirBasedDualCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caDirPinUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caDirPinUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caDirUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caDirUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caDirUserRenewal.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caDirUserRenewal.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caDualCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caDualCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caDualRAuserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caDualRAuserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECAdminCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECAdminCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECAgentServerCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECAgentServerCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECDirPinUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECDirPinUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECDirUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECDirUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECDualCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECDualCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECFullCMCSharedTokenCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECFullCMCSharedTokenCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECFullCMCUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECFullCMCUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECFullCMCUserSignedCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECFullCMCUserSignedCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECInternalAuthServerCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECInternalAuthServerCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECInternalAuthSubsystemCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECInternalAuthSubsystemCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECServerCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECServerCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECServerCertWithCRLDP.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECServerCertWithCRLDP.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECServerCertWithSCT.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECServerCertWithSCT.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECSimpleCMCUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECSimpleCMCUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECSubsystemCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECSubsystemCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caECUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caECUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caEncECUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caEncECUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caEncUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caEncUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caFullCMCSharedTokenCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caFullCMCSharedTokenCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caFullCMCUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caFullCMCUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caFullCMCUserSignedCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caFullCMCUserSignedCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caIPAserviceCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caIPAserviceCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caInstallCACert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caInstallCACert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caInternalAuthAuditSigningCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caInternalAuthAuditSigningCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caInternalAuthDRMstorageCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caInternalAuthDRMstorageCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caInternalAuthOCSPCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caInternalAuthOCSPCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caInternalAuthServerCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caInternalAuthServerCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caInternalAuthSubsystemCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caInternalAuthSubsystemCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caInternalAuthTransportCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caInternalAuthTransportCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caJarSigningCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caJarSigningCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caManualRenewal.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caManualRenewal.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caOCSPCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caOCSPCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caOtherCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caOtherCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caRACert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caRACert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caRARouterCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caRARouterCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caRAagentCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caRAagentCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caRAserverCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caRAserverCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caRouterCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caRouterCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caSSLClientSelfRenewal.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caSSLClientSelfRenewal.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caServerCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caServerCertWithCRLDP.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerCertWithCRLDP.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caServerCertWithSCT.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerCertWithSCT.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caServerKeygen_DirUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerKeygen_DirUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caServerKeygen_UserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caServerKeygen_UserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caSignedLogCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caSignedLogCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caSigningECUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caSigningECUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caSigningUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caSigningUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caSimpleCMCUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caSimpleCMCUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caStorageCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caStorageCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caSubsystemCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caSubsystemCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTPSCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTPSCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTempTokenDeviceKeyEnrollment.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTempTokenDeviceKeyEnrollment.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTempTokenUserEncryptionKeyEnrollment.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTempTokenUserEncryptionKeyEnrollment.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTempTokenUserSigningKeyEnrollment.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTempTokenUserSigningKeyEnrollment.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTokenDeviceKeyEnrollment.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTokenDeviceKeyEnrollment.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTokenMSLoginEnrollment.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTokenMSLoginEnrollment.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTokenUserAuthKeyRenewal.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTokenUserAuthKeyRenewal.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTokenUserDelegateAuthKeyEnrollment.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTokenUserDelegateAuthKeyEnrollment.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTokenUserDelegateSigningKeyEnrollment.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTokenUserDelegateSigningKeyEnrollment.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTokenUserEncryptionKeyEnrollment.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTokenUserEncryptionKeyEnrollment.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTokenUserEncryptionKeyRenewal.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTokenUserEncryptionKeyRenewal.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTokenUserSigningKeyEnrollment.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTokenUserSigningKeyEnrollment.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTokenUserSigningKeyRenewal.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTokenUserSigningKeyRenewal.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caTransportCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caTransportCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caUUIDdeviceCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caUUIDdeviceCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caUserCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caUserCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/caUserSMIMEcapCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caUserSMIMEcapCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/estServiceCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/estServiceCert.cfg 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/profiles/ca/AdminCert.cfg /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/AdminCert.cfg 2025-05-29 13:25:36 INFO: Linking /var/lib/pki/pki-tomcat/ca/profiles to /var/lib/pki/pki-tomcat/conf/ca/profiles 2025-05-29 13:25:36 DEBUG: Command: ln -s /var/lib/pki/pki-tomcat/conf/ca/profiles /var/lib/pki/pki-tomcat/ca/profiles 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/conf/flatfile.txt to /var/lib/pki/pki-tomcat/conf/ca/flatfile.txt 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/flatfile.txt /var/lib/pki/pki-tomcat/conf/ca/flatfile.txt 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/conf/rsaAdminCert.profile to /var/lib/pki/pki-tomcat/conf/ca/adminCert.profile 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/rsaAdminCert.profile /var/lib/pki/pki-tomcat/conf/ca/adminCert.profile 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/conf/caAuditSigningCert.profile to /var/lib/pki/pki-tomcat/conf/ca/caAuditSigningCert.profile 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/caAuditSigningCert.profile /var/lib/pki/pki-tomcat/conf/ca/caAuditSigningCert.profile 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/conf/caCert.profile to /var/lib/pki/pki-tomcat/conf/ca/caCert.profile 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/caCert.profile /var/lib/pki/pki-tomcat/conf/ca/caCert.profile 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/conf/caOCSPCert.profile to /var/lib/pki/pki-tomcat/conf/ca/caOCSPCert.profile 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/caOCSPCert.profile /var/lib/pki/pki-tomcat/conf/ca/caOCSPCert.profile 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/conf/rsaServerCert.profile to /var/lib/pki/pki-tomcat/conf/ca/serverCert.profile 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/rsaServerCert.profile /var/lib/pki/pki-tomcat/conf/ca/serverCert.profile 2025-05-29 13:25:36 INFO: Copying /usr/share/pki/ca/conf/rsaSubsystemCert.profile to /var/lib/pki/pki-tomcat/conf/ca/subsystemCert.profile 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/rsaSubsystemCert.profile /var/lib/pki/pki-tomcat/conf/ca/subsystemCert.profile 2025-05-29 13:25:36 INFO: Creating /var/lib/pki/pki-tomcat/conf/ca/proxy.conf 2025-05-29 13:25:36 DEBUG: Command: cp /usr/share/pki/ca/conf/proxy.conf /var/lib/pki/pki-tomcat/conf/ca/proxy.conf 2025-05-29 13:25:36 INFO: Loading instance: pki-tomcat 2025-05-29 13:25:36 INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf 2025-05-29 13:25:36 INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf 2025-05-29 13:25:36 INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf 2025-05-29 13:25:36 INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf 2025-05-29 13:25:36 INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg 2025-05-29 13:25:36 INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:25:36 INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat 2025-05-29 13:25:36 DEBUG: - user: pkiuser 2025-05-29 13:25:36 DEBUG: - group: pkiuser 2025-05-29 13:25:36 INFO: Loading external certs from /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: File does not exist: /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: Enabling HTTP proxy 2025-05-29 13:25:36 INFO: Setting proxy.securePort to 443 2025-05-29 13:25:36 INFO: Setting proxy.unsecurePort to 80 2025-05-29 13:25:36 INFO: Setting subsystem.1.class to com.netscape.cmscore.profile.LDAPProfileSubsystem 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_subsystem_cert(signing) 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_cert_info(signing) 2025-05-29 13:25:36 INFO: Setting ca.signing.nickname to caSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.signing.tokenname to internal 2025-05-29 13:25:36 INFO: Setting ca.cert.signing.nickname to caSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.signing.defaultSigningAlgorithm to SHA256withRSA 2025-05-29 13:25:36 INFO: Setting ca.crl.MasterCRL.signingAlgorithm to SHA256withRSA 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_subsystem_cert(ocsp_signing) 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_cert_info(ocsp_signing) 2025-05-29 13:25:36 INFO: Setting ca.ocsp_signing.nickname to ocspSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.ocsp_signing.tokenname to internal 2025-05-29 13:25:36 INFO: Setting ca.cert.ocsp_signing.nickname to ocspSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.ocsp_signing.defaultSigningAlgorithm to SHA256withRSA 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_subsystem_cert(sslserver) 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_cert_info(sslserver) 2025-05-29 13:25:36 INFO: Setting ca.sslserver.nickname to Server-Cert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.sslserver.tokenname to internal 2025-05-29 13:25:36 INFO: Setting ca.cert.sslserver.nickname to Server-Cert cert-pki-ca 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_subsystem_cert(subsystem) 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_cert_info(subsystem) 2025-05-29 13:25:36 INFO: Setting ca.subsystem.nickname to subsystemCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.subsystem.tokenname to internal 2025-05-29 13:25:36 INFO: Setting ca.cert.subsystem.nickname to subsystemCert cert-pki-ca 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_subsystem_cert(audit_signing) 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_cert_info(audit_signing) 2025-05-29 13:25:36 INFO: Setting ca.audit_signing.nickname to auditSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.audit_signing.tokenname to internal 2025-05-29 13:25:36 INFO: Setting ca.cert.audit_signing.nickname to auditSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.signing.certnickname to caSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.signing.cacertnickname to caSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.ocsp_signing.certnickname to ocspSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.ocsp_signing.cacertnickname to ocspSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting log.instance.SignedAudit.signedAuditCertNickname to auditSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Injecting SAN: False 2025-05-29 13:25:36 INFO: SSL server cert SAN: 2025-05-29 13:25:36 INFO: Storing subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg 2025-05-29 13:25:36 INFO: Storing registry config: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:25:36 DEBUG: Command: mkdir /root/.dogtag 2025-05-29 13:25:36 DEBUG: Command: mkdir /root/.dogtag/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: mkdir /root/.dogtag/pki-tomcat/ca 2025-05-29 13:25:36 INFO: Creating password file: /root/.dogtag/pki-tomcat/ca/password.conf 2025-05-29 13:25:36 INFO: Storing PKCS #12 password in /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf 2025-05-29 13:25:36 DEBUG: Command: mkdir /root/.dogtag/pki-tomcat/ca/alias 2025-05-29 13:25:36 DEBUG: Command: certutil -N -d /root/.dogtag/pki-tomcat/ca/alias -f /root/.dogtag/pki-tomcat/ca/password.conf 2025-05-29 13:25:36 INFO: Creating SELinux contexts 2025-05-29 13:25:36 DEBUG: Command: /usr/sbin/restorecon -R -v /var/lib/pki/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: /usr/sbin/restorecon -R -v /var/log/pki 2025-05-29 13:25:36 DEBUG: Command: /usr/sbin/restorecon -R -v /var/log/pki/pki-tomcat 2025-05-29 13:25:36 DEBUG: Command: /usr/sbin/restorecon -R -v /etc/pki/pki-tomcat 2025-05-29 13:25:36 INFO: Generating system keys 2025-05-29 13:25:36 INFO: Loading instance: pki-tomcat 2025-05-29 13:25:36 INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf 2025-05-29 13:25:36 INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf 2025-05-29 13:25:36 INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf 2025-05-29 13:25:36 INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf 2025-05-29 13:25:36 INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg 2025-05-29 13:25:36 INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:25:36 INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat 2025-05-29 13:25:36 DEBUG: - user: pkiuser 2025-05-29 13:25:36 DEBUG: - group: pkiuser 2025-05-29 13:25:36 INFO: Loading external certs from /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: File does not exist: /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: Fapolicy folder not found. Rule configuration skipped 2025-05-29 13:25:36 INFO: Configuring subsystem 2025-05-29 13:25:36 INFO: Loading instance: pki-tomcat 2025-05-29 13:25:36 INFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf 2025-05-29 13:25:36 INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf 2025-05-29 13:25:36 INFO: Loading instance Tomcat config: /var/lib/pki/pki-tomcat/conf/tomcat.conf 2025-05-29 13:25:36 INFO: Loading password config: /var/lib/pki/pki-tomcat/conf/password.conf 2025-05-29 13:25:36 INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg 2025-05-29 13:25:36 INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:25:36 INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat 2025-05-29 13:25:36 DEBUG: - user: pkiuser 2025-05-29 13:25:36 DEBUG: - group: pkiuser 2025-05-29 13:25:36 INFO: Loading external certs from /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: File does not exist: /var/lib/pki/pki-tomcat/conf/external_certs.conf 2025-05-29 13:25:36 INFO: Setting internaldb.ldapconn.secureConn to false 2025-05-29 13:25:36 INFO: Setting internaldb.ldapconn.host to ipa1.man-gb.eajglobal.net 2025-05-29 13:25:36 INFO: Setting internaldb.ldapconn.port to 389 2025-05-29 13:25:36 INFO: Setting internaldb.ldapauth.bindDN to cn=Directory Manager 2025-05-29 13:25:36 INFO: Setting internaldb.basedn to o=ipaca 2025-05-29 13:25:36 INFO: Setting internaldb.database to ipaca 2025-05-29 13:25:36 INFO: Setting dbs.request.id.generator to legacy 2025-05-29 13:25:36 INFO: Setting dbs.beginRequestNumber to 1 2025-05-29 13:25:36 INFO: Setting dbs.endRequestNumber to 10000000 2025-05-29 13:25:36 INFO: Setting dbs.requestIncrement to 10000000 2025-05-29 13:25:36 INFO: Setting dbs.requestLowWaterMark to 2000000 2025-05-29 13:25:36 INFO: Setting dbs.requestCloneTransferNumber to 10000 2025-05-29 13:25:36 INFO: Setting dbs.beginRequestNumber to 1 2025-05-29 13:25:36 INFO: Setting dbs.endRequestNumber to 10000000 2025-05-29 13:25:36 INFO: Setting dbs.requestRangeDN to ou=requests,ou=ranges 2025-05-29 13:25:36 INFO: Setting dbs.cert.id.generator to legacy 2025-05-29 13:25:36 INFO: Setting dbs.beginSerialNumber to 1 2025-05-29 13:25:36 INFO: Setting dbs.endSerialNumber to 10000000 2025-05-29 13:25:36 INFO: Setting dbs.serialIncrement to 10000000 2025-05-29 13:25:36 INFO: Setting dbs.serialLowWaterMark to 2000000 2025-05-29 13:25:36 INFO: Setting dbs.serialCloneTransferNumber to 10000 2025-05-29 13:25:36 INFO: Setting dbs.randomSerialNumberCounter to 0 2025-05-29 13:25:36 INFO: Setting dbs.beginSerialNumber to 1 2025-05-29 13:25:36 INFO: Setting dbs.endSerialNumber to 10000000 2025-05-29 13:25:36 INFO: Setting dbs.serialRangeDN to ou=certificateRepository,ou=ranges 2025-05-29 13:25:36 INFO: Setting dbs.beginReplicaNumber to 1 2025-05-29 13:25:36 INFO: Setting dbs.endReplicaNumber to 100 2025-05-29 13:25:36 INFO: Setting ca.defaultOcspUri to http://ipa-ca.eajglobal.uk/ca/ocsp 2025-05-29 13:25:36 INFO: Storing subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg 2025-05-29 13:25:36 INFO: Storing registry config: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:25:36 DEBUG: PKIDeployer.import_system_certs() 2025-05-29 13:25:36 DEBUG: import_system_cert 2025-05-29 13:25:36 DEBUG: import_system_cert 2025-05-29 13:25:36 DEBUG: import_system_cert 2025-05-29 13:25:36 DEBUG: import_system_cert 2025-05-29 13:25:36 DEBUG: import_system_cert 2025-05-29 13:25:36 INFO: Checking existing cert chain: caSigningCert External CA 2025-05-29 13:25:36 DEBUG: NSSDatabase.get_cert(caSigningCert External CA) begins 2025-05-29 13:25:36 DEBUG: Command: certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f /tmp/tmpvynqogd4/password.txt -n caSigningCert External CA -a 2025-05-29 13:25:36 DEBUG: stdout: -1 2025-05-29 13:25:36 DEBUG: NSSDatabase: stderr: certutil: Could not find cert: caSigningCert External CA : PR_FILE_NOT_FOUND_ERROR: File not found 2025-05-29 13:25:36 DEBUG: Cert not found: caSigningCert External CA 2025-05-29 13:25:36 INFO: Updating system certs 2025-05-29 13:25:36 INFO: Setting ca.signing.cacertnickname to caSigningCert cert-pki-ca 2025-05-29 13:25:36 INFO: Setting ca.signing.defaultSigningAlgorithm to SHA256withRSA 2025-05-29 13:25:36 INFO: Setting ca.ocsp_signing.defaultSigningAlgorithm to SHA256withRSA 2025-05-29 13:25:36 INFO: Setting ca.audit_signing.defaultSigningAlgorithm to SHA256withRSA 2025-05-29 13:25:36 INFO: Storing subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg 2025-05-29 13:25:36 INFO: Storing registry config: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_subsystem_cert(sslserver) 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_cert_info(sslserver) 2025-05-29 13:25:36 DEBUG: PKISubsystem.get_nssdb_cert_info(sslserver) 2025-05-29 13:25:36 DEBUG: NSSDatabase.get_cert_info(Server-Cert cert-pki-ca) begins 2025-05-29 13:25:36 DEBUG: NSSDatabase.get_cert(Server-Cert cert-pki-ca) begins 2025-05-29 13:25:36 DEBUG: Command: certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f /tmp/tmpngg9k4eu/password.txt -n Server-Cert cert-pki-ca -a 2025-05-29 13:25:36 DEBUG: stdout: -1 2025-05-29 13:25:36 DEBUG: NSSDatabase: stderr: certutil: Could not find cert: Server-Cert cert-pki-ca : PR_FILE_NOT_FOUND_ERROR: File not found 2025-05-29 13:25:36 DEBUG: Cert not found: Server-Cert cert-pki-ca 2025-05-29 13:25:36 INFO: Updating /var/lib/pki/pki-tomcat/conf/serverCertNick.conf 2025-05-29 13:25:36 INFO: Updating serverCertNickFile in server.xml 2025-05-29 13:25:36 INFO: Creating new security domain 2025-05-29 13:25:36 INFO: Setting securitydomain.host to ipa1.man-gb.eajglobal.net 2025-05-29 13:25:36 INFO: Setting securitydomain.httpport to 8080 2025-05-29 13:25:36 INFO: Setting securitydomain.httpsadminport to 8443 2025-05-29 13:25:36 INFO: Storing subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg 2025-05-29 13:25:36 INFO: Storing registry config: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:25:36 INFO: Removing existing database 2025-05-29 13:25:36 DEBUG: Command: /usr/sbin/runuser -u pkiuser -- /usr/lib/jvm/jre-17-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI ca-db-remove --force --debug 2025-05-29 13:25:38 INFO: Creating database 2025-05-29 13:25:38 DEBUG: Command: /usr/sbin/runuser -u pkiuser -- /usr/lib/jvm/jre-17-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI ca-db-create --debug 2025-05-29 13:25:40 INFO: Initializing database 2025-05-29 13:25:40 DEBUG: Command: /usr/sbin/runuser -u pkiuser -- /usr/lib/jvm/jre-17-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI ca-db-init --debug 2025-05-29 13:26:00 DEBUG: Command: /usr/sbin/runuser -u pkiuser -- /usr/lib/jvm/jre-17-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI ca-db-access-grant --debug uid=pkidbuser,ou=people,o=ipaca 2025-05-29 13:26:01 DEBUG: Command: /usr/sbin/runuser -u pkiuser -- /usr/lib/jvm/jre-17-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI ca-db-index-add --debug 2025-05-29 13:26:03 DEBUG: Command: /usr/sbin/runuser -u pkiuser -- /usr/lib/jvm/jre-17-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI ca-db-vlv-add --debug 2025-05-29 13:26:05 DEBUG: Command: /usr/sbin/runuser -u pkiuser -- /usr/lib/jvm/jre-17-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI ca-db-vlv-reindex --debug 2025-05-29 13:26:07 DEBUG: Command: /usr/sbin/runuser -u pkiuser -- /usr/lib/jvm/jre-17-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI ca-profile-import --input-folder /usr/share/pki/ca/profiles/ca --debug 2025-05-29 13:26:09 INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/conf/ca/CS.cfg 2025-05-29 13:26:09 INFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2025-05-29 13:26:09 INFO: Request ID generator: legacy 2025-05-29 13:26:09 INFO: Enabling CA subsystem 2025-05-29 13:26:09 INFO: Deploying ca web application 2025-05-29 13:26:09 INFO: Creating /var/lib/pki/pki-tomcat/conf/Catalina/localhost/ca.xml 2025-05-29 13:26:09 INFO: Creating temporary SSL server cert 2025-05-29 13:26:09 INFO: Updating /var/lib/pki/pki-tomcat/conf/serverCertNick.conf 2025-05-29 13:26:09 INFO: Updating serverCertNickFile in server.xml 2025-05-29 13:26:09 INFO: Checking existing temp SSL server cert: temp Server-Cert cert-pki-ca 2025-05-29 13:26:09 DEBUG: NSSDatabase.get_cert(temp Server-Cert cert-pki-ca) begins 2025-05-29 13:26:09 DEBUG: Command: certutil -L -d /var/lib/pki/pki-tomcat/conf/alias -f /tmp/tmp9l_1_dt_/password.txt -n temp Server-Cert cert-pki-ca -a 2025-05-29 13:26:09 DEBUG: stdout: -1 2025-05-29 13:26:09 DEBUG: NSSDatabase: stderr: certutil: Could not find cert: temp Server-Cert cert-pki-ca : PR_FILE_NOT_FOUND_ERROR: File not found 2025-05-29 13:26:09 DEBUG: Cert not found: temp Server-Cert cert-pki-ca 2025-05-29 13:26:09 INFO: Creating new temp SSL server cert for ipa1.man-gb.eajglobal.net 2025-05-29 13:26:09 DEBUG: Command: pki -d /var/lib/pki/pki-tomcat/conf/alias -f /var/lib/pki/pki-tomcat/conf/password.conf nss-cert-request --subject cn=ipa1.man-gb.eajglobal.net,o=2025-05-29 13:25:36 --csr /tmp/tmpdvz_k8lc/sslserver.csr --key-type RSA --key-size 2048 --hash SHA256 --debug Restoring a snapshot prior to freeipa-server-install and setting update-crypto-policies --set DEFAULT and rebooting allows the install to run without issue.

2 2

Re: [EXTERNAL] Re: It ain't easy to dig a user's last login time info out of IdM/FreeIPA
by Shane Frasier 28 May '25

28 May '25

The mailing list doesn't appear to have attached my message to the old thread. Here is the old thread I was referencing: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Shane

1 0

Re: [EXTERNAL] Re: It ain't easy to dig a user's last login time info out of IdM/FreeIPA
by Shane Frasier 28 May '25

28 May '25

FWIW, here is the script I am currently using to disable inactive users: https://github.com/cisagov/ansible-role-freeipa-server/blob/develop/files/d… Shane

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2025