11:28 a.m.
Hi FreeIPA users,
Please help find wat's going wrong while reinstalling freeipa...
2018-02-16T16:41:30Z DEBUG response body '<html>\n<head>\n<meta
http-equiv="Content-Type"
content="text/html;charset=utf-8"/>\n<title>Error
405 HTTP method POST is not supported by this URL</title$
2018-02-16T16:41:30Z DEBUG The CA status is: check interrupted due to
error: Retrieving CA status failed with status 405
2018-02-16T16:41:30Z DEBUG Waiting for CA to start...
2018-02-16T16:41:31Z DEBUG request POST http://
<hostname>:8080/ca/admin/ca/getStatus
2018-02-16T16:41:31Z DEBUG request body ''
2018-02-16T16:41:31Z DEBUG response status 405
2018-02-16T16:41:31Z DEBUG response headers Date: Fri, 16 Feb 2018 16:41:31
GMT
Cache-Control: must-revalidate,no-cache,no-store
Content-Type: text/html;charset=iso-8859-1
Content-Length: 408
Server: Jetty(9.3.z-SNAPSHOT)
CA did not start in 300.0s
CRITICAL Failed to restart the Dogtag instance.See the installation log for
details.
ERROR Unable to retrieve CA chain: Retrieving CA cert chain failed: list
index out of range
Also in log:
2018-02-16T16:35:12Z DEBUG stderr=
2018-02-16T16:35:12Z DEBUG Loading StateFile from
'/var/lib/ipa/sysrestore/sysrestore.state'
2018-02-16T16:35:12Z DEBUG Saving StateFile to
'/var/lib/ipa/sysrestore/sysrestore.state'
2018-02-16T16:35:12Z DEBUG Starting external process
2018-02-16T16:35:12Z DEBUG args=/bin/systemctl disable krb5kdc.service
2018-02-16T16:35:12Z DEBUG Process finished, return code=0
2018-02-16T16:35:12Z DEBUG stdout=
2018-02-16T16:35:12Z DEBUG stderr=
2018-02-16T16:35:12Z DEBUG duration: 0 seconds
2018-02-16T16:35:12Z DEBUG Done configuring Kerberos KDC (krb5kdc).
2018-02-16T16:35:12Z DEBUG Loading StateFile from
'/var/lib/ipa/sysrestore/sysrestore.state'
2018-02-16T16:35:12Z DEBUG Loading Index file from
'/var/lib/ipa/sysrestore/sysrestore.index'
2018-02-16T16:35:12Z DEBUG Configuring kadmin
2018-02-16T16:35:12Z DEBUG [1/2]: starting kadmin
2018-02-16T16:35:12Z DEBUG Starting external process
2018-02-16T16:35:12Z DEBUG args=/bin/systemctl is-active kadmin.service
2018-02-16T16:35:12Z DEBUG Process finished, return code=3
2018-02-16T16:35:12Z DEBUG stdout=failed
In /var/log/pki/pki-tomcat/ca/debug
[16/Feb/2018:16:35:22][localhost-startStop-1]: LdapBoundConnFactory: init
Property internaldb.ldapconn.port missing value
...
[16/Feb/2018:16:36:20][http-bio-8443-exec-3]:
CertificateAuthority:initSigUnit: ca.signing.cert not found
Property ca.signing.cacertnickname missing value
...
[16/Feb/2018:16:36:20][http-bio-8443-exec-3]: CA signing unit inited
[16/Feb/2018:16:36:20][http-bio-8443-exec-3]: cachainNum= 0
Could not get or build CA chain. Error
java.security.cert.CertificateException: Certificate is not a PKCS #11
certificate
...
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]:
CertificateAuthority:initSigUnit: ca cert found
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: CertificateAuthority:
initSigUnit 1- setting mIssuerObj and mSubjectObj
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: ca.signing Signing Unit
nickname caSigningCert cert-pki-ca
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: Got token Internal Key
Storage Token by name
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: Found cert by nickname:
'caSigningCert cert-pki-ca' with serial number: 1
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: converted to x509CertImpl
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: Got private key from cert
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: Got public key from cert
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: got signing algorithm
RSASignatureWithSHA256Digest
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: CA signing unit inited
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: cachainNum= 0
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: in init - got CA chain from
JSS.
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: ca.ocsp_signing Signing Unit
nickname ocspSigningCert cert-pki-ca
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: Got token Internal Key
Storage Token by name
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: Unable to find certificate
ocspSigningCert cert-pki-ca
[16/Feb/2018:16:36:23][http-bio-8443-exec-3]: SigningUnit: Certificate
object not found
Regards,
Andrey