And just to make sure my certs are ok, I used katello-certs-check tool and got:
Validating the certificate subject=XXXXXX Check private key matches the certificate: [OK] Check ca bundle verifies the cert file: [OK] Validation succeeded. piektdiena, 2016. gada 8. jūlijs 13:26:55 UTC+2, Edgars M. rakstīja: > > sudo systemctl start httpd > Job for httpd.service failed because the control process exited with > error code. See "systemctl status httpd.service" and "journalctl -xe" for > details. > > sudo journalctl -xn > -- Logs begin at Thu 2016-07-07 11:09:00 CEST, end at Fri 2016-07-08 13:19 > :56 CEST. -- > Jul 08 13:19:44 katello.tld polkitd[1437]: Registered Authentication Agent > for unix-process:13638:8287367 (system bus name :1.285 [/usr/bin/pkttyagent > --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/ > Authenti > Jul 08 13:19:44 katello.tld systemd[1]: Starting The Apache HTTP Server... > -- Subject: Unit httpd.service has begun start-up > -- Defined-By: systemd > -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel > -- > -- Unit httpd.service has begun starting up. > Jul 08 13:19:44 katello.tld systemd[1]: httpd.service: main process exited > , code=exited, status=1/FAILURE > Jul 08 13:19:44 katello.tld kill[13645]: kill: cannot find process "" > Jul 08 13:19:44 katello.tld systemd[1]: httpd.service: control process > exited, code=exited status=1 > Jul 08 13:19:44 katello.tld systemd[1]: Failed to start The Apache HTTP > Server. > -- Subject: Unit httpd.service has failed > -- Defined-By: systemd > -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel > -- > -- Unit httpd.service has failed. > -- > -- The result is failed. > Jul 08 13:19:44 katello.tld systemd[1]: Unit httpd.service entered failed > state. > Jul 08 13:19:44 katello.tld systemd[1]: httpd.service failed. > Jul 08 13:19:44 katello.tld polkitd[1437]: Unregistered Authentication > Agent for unix-process:13638:8287367 (system bus name :1.285, object path > /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) ( > disconnecte > Jul 08 13:19:56 katello.tld sudo[13649]: edgars : TTY=pts/0 ; PWD= > /home/edgars ; USER=root ; COMMAND=/bin/journalctl -xn > > > piektdiena, 2016. gada 8. jūlijs 13:09:31 UTC+2, Eric Helms rakstīja: >> >> Can you run: >> >> systemctl start httpd >> journalctl -xn >> On Jul 8, 2016 7:05 AM, "Edgars M." <[email protected]> wrote: >> >>> Hi >>> >>> Here it is: >>> >>> sudo /bin/systemctl start httpd.service >>> Job for httpd.service failed because the control process exited with >>> error code. See "systemctl status httpd.service" and "journalctl -xe" >>> for details. >>> >>> sudo /bin/systemctl status httpd.service >>> ● httpd.service - The Apache HTTP Server >>> Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; >>> vendor preset: disabled) >>> Active: failed (Result: exit-code) since Fri 2016-07-08 10:57:44 CEST >>> ; 6s ago >>> Docs: man:httpd(8) >>> man:apachectl(8) >>> Process: 13510 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, >>> status=1/FAILURE) >>> Process: 13508 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code= >>> exited, status=1/FAILURE) >>> Main PID: 13508 (code=exited, status=1/FAILURE) >>> >>> >>> Jul 08 10:57:44 katello.tld systemd[1]: Starting The Apache HTTP Server >>> ... >>> Jul 08 10:57:44 katello.tld systemd[1]: httpd.service: main process >>> exited, code=exited, status=1/FAILURE >>> Jul 08 10:57:44 katello.tld kill[13510]: kill: cannot find process "" >>> Jul 08 10:57:44 katello.tld systemd[1]: httpd.service: control process >>> exited, code=exited status=1 >>> Jul 08 10:57:44 katello.tld systemd[1]: Failed to start The Apache HTTP >>> Server. >>> Jul 08 10:57:44 katello.tld systemd[1]: Unit httpd.service entered >>> failed state. >>> Jul 08 10:57:44 katello.tld systemd[1]: httpd.service failed. >>> >>> sudo cat /var/log/httpd/error_log >>> [Fri Jul 08 10:48:00.407263 2016] [core:notice] [pid 13049] SELinux >>> policy enabled; httpd running as context system_u:system_r:httpd_t:s0 >>> [Fri Jul 08 10:48:00.407385 2016] [mime_magic:error] [pid 13049] (2)No >>> such file or directory: AH01515: mod_mime_magic: can't read magic file >>> /etc/httpd/NEVER_EVER_USE >>> [Fri Jul 08 10:48:00.480310 2016] [ssl:emerg] [pid 13049] AH02311: Fatal >>> error initialising mod_ssl, exiting. See /var/log/httpd/crane_error_ssl.log >>> for more information >>> [Fri Jul 08 10:57:44.170768 2016] [core:notice] [pid 13508] SELinux >>> policy enabled; httpd running as context system_u:system_r:httpd_t:s0 >>> [Fri Jul 08 10:57:44.170854 2016] [mime_magic:error] [pid 13508] (2)No >>> such file or directory: AH01515: mod_mime_magic: can't read magic file / >>> etc/httpd/NEVER_EVER_USE >>> [Fri Jul 08 10:57:44.197505 2016] [ssl:emerg] [pid 13508] AH02311: Fatal >>> error initialising mod_ssl, exiting. See /var/log/httpd/crane_error_ssl.log >>> for more information >>> >>> sudo cat /var/log/httpd/crane_error_ssl.log >>> [Fri Jul 08 10:48:00.480289 2016] [ssl:emerg] [pid 13049] AH01903: >>> Failed to configure CA certificate chain! >>> [Fri Jul 08 10:57:44.197492 2016] [ssl:emerg] [pid 13508] AH01903: >>> Failed to configure CA certificate chain! >>> >>> sudo cat /etc/httpd/conf.d/03-crane.conf >>> # ************************************ >>> # Vhost template in module puppetlabs-apache >>> # Managed by Puppet >>> # ************************************ >>> >>> >>> <VirtualHost *:5000> >>> ServerName katello.tld >>> >>> >>> ## Vhost docroot >>> DocumentRoot "/usr/share/crane/" >>> >>> >>> ## Directories, there should at least be a declaration for >>> /usr/share/crane/ >>> >>> >>> <Directory "/usr/share/crane/"> >>> Options Indexes FollowSymLinks MultiViews >>> AllowOverride None >>> Require all granted >>> </Directory> >>> >>> >>> ## Logging >>> ErrorLog "/var/log/httpd/crane_error_ssl.log" >>> ServerSignature Off >>> CustomLog "/var/log/httpd/crane_access_ssl.log" combined >>> >>> >>> ## SSL directives >>> SSLEngine on >>> SSLCertificateFile "/etc/pki/katello/certs/katello-apache.crt" >>> SSLCertificateKeyFile "/etc/pki/katello/private/katello-apache.key" >>> SSLCertificateChainFile "/etc/pki/katello/certs/katello-default-ca.crt >>> " >>> SSLCACertificatePath "/etc/pki/tls/certs" >>> SSLCACertificateFile "/etc/pki/katello/certs/katello-default-ca.crt >>> " >>> SSLVerifyClient optional >>> SSLVerifyDepth 3 >>> SSLOptions +StdEnvVars +ExportCertData +FakeBasicAuth >>> >>> >>> # SSL Proxy directives >>> SSLProxyEngine On >>> WSGIScriptAlias / "/usr/share/crane/crane.wsgi" >>> </VirtualHost> >>> >>> >>> >>> >>> piektdiena, 2016. gada 8. jūlijs 12:58:40 UTC+2, Eric Helms rakstīja: >>>> >>>> What is the journal -xn output after you try to start httpd manually? >>>> On Jul 8, 2016 5:12 AM, "Edgars M." <[email protected]> wrote: >>>> >>>>> No, there is nothing special about our certificates. No wildcard, no >>>>> even SAN. 2048 bits. >>>>> >>>>> Why is Crane needed? Can I disable it? Can I disable everything >>>>> related to Puppet as we don't need that functionality? >>>>> >>>>> I just tested it and it failed again, here is my full install command: >>>>> >>>>> sudo foreman-installer --scenario katello \ >>>>> --certs-server-cert="/etc/pki/tls/certs/katello.tld.crt" \ >>>>> --certs-server-cert-req="/etc/pki/tls/csr/katello.tld.csr" \ >>>>> --certs-server-key="/etc/pki/tls/private/katello.tld.key" \ >>>>> --certs-server-ca-cert="/etc/pki/tls/certs/CompanyInternalCA.crt" \ >>>>> --foreman-admin-email="[email protected]" \ >>>>> --foreman-admin-first-name="Name" \ >>>>> --foreman-admin-last-name="LastName" \ >>>>> --foreman-admin-password="SomeCustomPassword" \ >>>>> --foreman-initial-organization="Company" \ >>>>> --katello-num-pulp-workers="24" \ >>>>> --katello-proxy-url="http://corporate.proxy.tld"; \ >>>>> --katello-proxy-port="8080" \ >>>>> --verbose >>>>> >>>>> >>>>> Errors: >>>>> [ERROR 2016-07-08 10:48:00 verbose] Could not start Service[httpd]: >>>>> Execution of >>>>> '/usr/share/katello-installer-base/modules/service_wait/bin/service-wait >>>>> start httpd' returned 1: Redirecting to /bin/systemctl start httpd. >>>>> service >>>>> [ INFO 2016-07-08 10:48:00 verbose] Job for httpd.service failed >>>>> because the control process exited with error code. See "systemctl >>>>> status httpd.service" and "journalctl -xe" for details. >>>>> [ERROR 2016-07-08 10:48:00 verbose] /Stage[main]/Apache::Service/ >>>>> Service[httpd]/ensure: change from stopped to running failed: Could >>>>> not start Service[httpd]: Execution of >>>>> '/usr/share/katello-installer-base/modules/service_wait/bin/service-wait >>>>> start httpd' returned 1: Redirecting to /bin/systemctl start httpd. >>>>> service >>>>> [ERROR 2016-07-08 10:48:18 verbose] /Stage[main]/Foreman::Database/ >>>>> Foreman::Rake[db:seed]/Exec[foreman-rake-db:seed]: Failed to call >>>>> refresh: /usr/sbin/foreman-rake db:seed returned 1 instead of one of [ >>>>> 0] >>>>> [ERROR 2016-07-08 10:48:18 verbose] /Stage[main]/Foreman::Database/ >>>>> Foreman::Rake[db:seed]/Exec[foreman-rake-db:seed]: /usr/sbin/foreman-rake >>>>> db:seed returned 1 instead of one of [0] >>>>> [ERROR 2016-07-08 10:49:15 verbose] /Stage[main]/Foreman_proxy:: >>>>> Register/Foreman_smartproxy[katello.tld]: Failed to call refresh: >>>>> Proxy katello.tld cannot be registered (Could not load data from https >>>>> ://katello.tld >>>>> [ INFO 2016-07-08 10:49:15 verbose] - is your server down? >>>>> [ INFO 2016-07-08 10:49:15 verbose] - was rake apipie:cache run when >>>>> using apipie cache? (typical production settings)): N/A >>>>> [ERROR 2016-07-08 10:49:15 verbose] /Stage[main]/Foreman_proxy:: >>>>> Register/Foreman_smartproxy[katello.tld]: Proxy katello.tld cannot be >>>>> registered (Could not load data from https://katello.tld >>>>> [ INFO 2016-07-08 10:49:15 verbose] - is your server down? >>>>> [ INFO 2016-07-08 10:49:15 verbose] - was rake apipie:cache run when >>>>> using apipie cache? (typical production settings)): N/A >>>>> [ INFO 2016-07-08 10:49:15 verbose] /usr/share/ruby/vendor_ruby/puppet >>>>> /util/errors.rb:106:in `fail' >>>>> [ INFO 2016-07-08 10:49:19 verbose] Executing hooks in group post >>>>> Something went wrong! Check the log for ERROR-level output >>>>> >>>>> sudo cat /var/log/httpd/crane_error_ssl.log >>>>> [Fri Jul 08 10:48:00.480289 2016] [ssl:emerg] [pid 13049] AH01903: >>>>> Failed to configure CA certificate chain! >>>>> [Fri Jul 08 10:57:44.197492 2016] [ssl:emerg] [pid 13508] AH01903: >>>>> Failed to configure CA certificate chain! >>>>> >>>>> Edgars >>>>> >>>>> ceturtdiena, 2016. gada 7. jūlijs 20:26:43 UTC+2, Eric Helms rakstīja: >>>>>> >>>>>> Edgars, >>>>>> >>>>>> I tested this scenario today and could not duplicate your results. Is >>>>>> there anything special about your custom certificates? Wildcard? >>>>>> Attributes >>>>>> special to them? This is my test scenario: >>>>>> >>>>>> https://github.com/Katello/forklift/pull/247/files >>>>>> >>>>>> On Thu, Jul 7, 2016 at 8:07 AM, Eric D Helms <[email protected]> >>>>>> wrote: >>>>>> >>>>>>> Edgars, >>>>>>> >>>>>>> I will test this today and report back to you. >>>>>>> >>>>>>> >>>>>>> Eric >>>>>>> >>>>>>> On Thu, Jul 7, 2016 at 5:53 AM, Edgars M. <[email protected]> >>>>>>> wrote: >>>>>>> >>>>>>>> Hi >>>>>>>> >>>>>>>> I still cannot install new Katello because of this issue: >>>>>>>> http://projects.theforeman.org/issues/15507 >>>>>>>> >>>>>>>> It fails every time.. Does anyone know workaround? >>>>>>>> >>>>>>>> Edgars >>>>>>>> >>>>>>>> >>>>>>>> trešdiena, 2016. gada 6. jūlijs 22:51:48 UTC+2, Eric Helms rakstīja: >>>>>>>>> >>>>>>>>> Katello 3.0.2 has been released to supply bug fixes and major >>>>>>>>> upgrade issues found by some awesome users. Please see the changelog >>>>>>>>> for >>>>>>>>> more information ( >>>>>>>>> https://github.com/Katello/katello/blob/KATELLO-3.0/CHANGELOG.md). >>>>>>>>> >>>>>>>>> >>>>>>>>> Installation >>>>>>>>> ============ >>>>>>>>> >>>>>>>>> For installation, please see the instructions at: >>>>>>>>> >>>>>>>>> Server: http://www.katello.org/docs/3.0/installation/index.html >>>>>>>>> <http://www.katello.org/docs/2.4/installation/index.html> >>>>>>>>> Capsule: >>>>>>>>> http://www.katello.org/docs/3.0/installation/capsule.html >>>>>>>>> <http://www.katello.org/docs/2.4/installation/capsule.html> >>>>>>>>> >>>>>>>>> Bug reporting >>>>>>>>> ============= >>>>>>>>> If you come across a bug in your testing, please file it and note >>>>>>>>> the >>>>>>>>> version of Katello that you're using in the report and set the >>>>>>>>> release >>>>>>>>> to 3.0.2. >>>>>>>>> >>>>>>>>> http://projects.theforeman.org/projects/katello/issues/new >>>>>>>>> >>>>>>>>> >>>>>>>>> -- >>>>>>>>> Eric D. Helms >>>>>>>>> Red Hat Engineering >>>>>>>>> Ph.D. Student - North Carolina State University >>>>>>>>> >>>>>>>> -- >>>>>>>> You received this message because you are subscribed to the Google >>>>>>>> Groups "Foreman users" group. >>>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>>> send an email to [email protected]. >>>>>>>> To post to this group, send email to [email protected]. >>>>>>>> Visit this group at https://groups.google.com/group/foreman-users. >>>>>>>> For more options, visit https://groups.google.com/d/optout. >>>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> -- >>>>>>> Eric D. Helms >>>>>>> Red Hat Engineering >>>>>>> Ph.D. Student - North Carolina State University >>>>>>> >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> Eric D. Helms >>>>>> Red Hat Engineering >>>>>> Ph.D. Student - North Carolina State University >>>>>> >>>>> -- >>>>> You received this message because you are subscribed to the Google >>>>> Groups "Foreman users" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send >>>>> an email to [email protected]. >>>>> To post to this group, send email to [email protected]. >>>>> Visit this group at https://groups.google.com/group/foreman-users. >>>>> For more options, visit https://groups.google.com/d/optout. >>>>> >>>> -- >>> You received this message because you are subscribed to the Google >>> Groups "Foreman users" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> To post to this group, send email to [email protected]. >>> Visit this group at https://groups.google.com/group/foreman-users. >>> For more options, visit https://groups.google.com/d/optout. >>> >> -- You received this message because you are subscribed to the Google Groups "Foreman users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/foreman-users. For more options, visit https://groups.google.com/d/optout.
