Exception: Invalid instance: pki-tomcat

[Mark Clarke]

Hi All,
After a recent system update freeipa pki-tomcat will not start. I have traced the error to
where freeipa attempts to upgrade pki-tomcat in the service unit.
"ExecStartPre=/usr/sbin/pki-server upgrade %i". I have no idea why it thinks the
instance id is wrong. Anyone else with this problem and know how to fix it?

VERSION: 4.9.10, API_VERSION: 2.251

Feb 24 06:42:16 auth-server.abc.com systemd[1]: Starting PKI Tomcat Server pki-tomcat...
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]: ERROR: Invalid instance: pki-tomcat
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]: Traceback (most recent call last):
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]:   File
"/usr/lib/python3.6/site-packages/pki/server/pkiserver.py", line 41, in
<module>
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]:     cli.execute(sys.argv)
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]:   File
"/usr/lib/python3.6/site-packages/pki/server/cli/__init__.py", line 145, in
execute
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]:     super(PKIServerCLI,
self).execute(args)
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]:   File
"/usr/lib/python3.6/site-packages/pki/cli/__init__.py", line 217, in execute
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]:     module.execute(module_args)
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]:   File
"/usr/lib/python3.6/site-packages/pki/server/cli/upgrade.py", line 135, in
execute
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]:     raise Exception('Invalid
instance: %s' % instance_name)
Feb 24 06:42:16 auth-server.abc.com pki-server[2308]: Exception: Invalid instance:
pki-tomcat

[Mark Clarke]

So tracing the python code the error appears to be on line 884 in 
/usr/lib/python3.6/site-packages/pki/server/instance.py.

        sysconfig_file = os.path.join('/etc/sysconfig', instance_name)

There is no file /etc/sysconfig/pki-tomcat. I am not sure why. I will need to compare it
to another replica to find out if this file exists and what it contains. Any pointers
appreciated.

[Mark Clarke]

After some more investigation, it appears the directory /var/lib/pki/pki-tomcat
doesn't exist and this is the cause of the error. I will compare it to another
installation to see whats missing.

[Rob Crittenden]

Mark Clarke via FreeIPA-users wrote:
>  After some more investigation, it appears the directory
> /var/lib/pki/pki-tomcat doesn't exist and this is the cause of the error. I will
> compare it to another installation to see whats missing. 
This directory is your CA configuration. If it doesn't exist you have no
CA on the machine, despite what IPA may think it should have.

rob