PS: Below you can find an excerpt from the slapd errors file on ipa1 (the renewal master).
Regards Harri
[15/Jul/2019:11:31:53.160959903 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:36:53.653395671 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:41:53.058845426 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:46:53.151024629 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:51:04.583330896 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.example.de" (ipa2:389): Unable to receive the response for a startReplication extended operation to co nsumer (Can't contact LDAP server). Will retry later. [15/Jul/2019:11:51:10.571064133 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipa2.example.de" (ipa2:389): Replication bind with GSSAPI auth resumed [15/Jul/2019:11:51:53.061195487 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:55:18.051457277 +0200] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 19 max work q size 7 max work q stack size 7 [15/Jul/2019:11:55:18.064908548 +0200] - INFO - slapd_daemon - slapd shutting down - waiting for 19 threads to terminate [15/Jul/2019:11:55:18.078770335 +0200] - INFO - slapd_daemon - slapd shutting down - closing down internal subsystems and plugins [15/Jul/2019:11:55:18.082254490 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipabak.ac.example.de" (ipabak:389): Unable to receive the response for a startReplication extended operatio n to consumer (Timed out). Will retry later. [15/Jul/2019:11:55:18.090549719 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa4.example.de" (ipa4:389): Unable to receive the response for a startReplication extended operation to co nsumer (Timed out). Will retry later. [15/Jul/2019:11:55:18.104784402 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.example.de" (ipa2:389): Unable to receive the response for a startReplication extended operation to co nsumer (Timed out). Will retry later. [15/Jul/2019:11:55:18.107970198 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa3.example.de" (ipa3:389): Unable to receive the response for a startReplication extended operation to co nsumer (Timed out). Will retry later. [15/Jul/2019:11:55:18.789739228 +0200] - ERR - nis-plugin - error sending request to portmap or rpcbind on 6: Broken pipe [15/Jul/2019:11:55:18.794509661 +0200] - ERR - nis-plugin - retried sending request to portmap or rpcbind on 11, and succeeded [15/Jul/2019:11:55:18.801335996 +0200] - ERR - nis-plugin - portmap request failed [15/Jul/2019:11:55:18.809544948 +0200] - ERR - nis-plugin - portmap request failed [15/Jul/2019:11:55:18.818395173 +0200] - ERR - nis-plugin - portmap request failed [15/Jul/2019:11:55:18.826133514 +0200] - ERR - nis-plugin - portmap request failed [15/Jul/2019:11:55:18.844088004 +0200] - ERR - nis-plugin - portmap request failed [15/Jul/2019:11:55:18.847534816 +0200] - ERR - nis-plugin - portmap request failed [15/Jul/2019:11:55:18.857519024 +0200] - INFO - dblayer_pre_close - Waiting for 4 database threads to stop [15/Jul/2019:11:55:19.311770607 +0200] - INFO - dblayer_pre_close - All database threads now stopped [15/Jul/2019:11:55:19.406955185 +0200] - INFO - ldbm_back_instance_set_destructor - Set of instances destroyed [15/Jul/2019:11:55:19.411535412 +0200] - INFO - connection_post_shutdown_cleanup - slapd shutting down - freed 7 work q stack objects - freed 21 op stack objects [15/Jul/2019:11:55:19.418371030 +0200] - INFO - main - slapd stopped. [15/Jul/2019:11:55:19.926760501 +0200] - INFO - slapd_extract_cert - CA CERT NAME: CN=example Root CA,OU=example Certificate Authority,O=example AG,C=DE [15/Jul/2019:11:55:19.951893692 +0200] - INFO - slapd_extract_cert - CA CERT NAME: EXAMPLE.DE IPA CA [15/Jul/2019:11:55:19.955564732 +0200] - INFO - slapd_extract_cert - CA CERT NAME: EXAMPLE.DE IPA CA [15/Jul/2019:11:55:19.964110018 +0200] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password. [15/Jul/2019:11:55:19.977359029 +0200] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [15/Jul/2019:11:55:19.985393892 +0200] - INFO - Security Initialization - SSL info: Enabling default cipher set. [15/Jul/2019:11:55:19.994523569 +0200] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [15/Jul/2019:11:55:20.002138699 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [15/Jul/2019:11:55:20.006991585 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [15/Jul/2019:11:55:20.014274369 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [15/Jul/2019:11:55:20.032865141 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [15/Jul/2019:11:55:20.036050155 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [15/Jul/2019:11:55:20.044608934 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [15/Jul/2019:11:55:20.052757869 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled [15/Jul/2019:11:55:20.069482237 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [15/Jul/2019:11:55:20.072662900 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [15/Jul/2019:11:55:20.086386519 +0200] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [15/Jul/2019:11:55:20.095005183 +0200] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled [15/Jul/2019:11:55:20.098605150 +0200] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled [15/Jul/2019:11:55:20.106909542 +0200] - INFO - Security Initialization - SSL info: TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled [15/Jul/2019:11:55:20.124649749 +0200] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled [15/Jul/2019:11:55:20.136051830 +0200] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled [15/Jul/2019:11:55:20.139314489 +0200] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [15/Jul/2019:11:55:20.147865555 +0200] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled [15/Jul/2019:11:55:20.155903956 +0200] - INFO - Security Initialization - SSL info: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled [15/Jul/2019:11:55:20.164400795 +0200] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled [15/Jul/2019:11:55:20.178064628 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [15/Jul/2019:11:55:20.181546265 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [15/Jul/2019:11:55:20.205322492 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [15/Jul/2019:11:55:20.208598221 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [15/Jul/2019:11:55:20.216914749 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [15/Jul/2019:11:55:20.230910824 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [15/Jul/2019:11:55:20.234046619 +0200] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [15/Jul/2019:11:55:20.242573647 +0200] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [15/Jul/2019:11:55:20.250913897 +0200] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [15/Jul/2019:11:55:20.267433165 +0200] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.2 [15/Jul/2019:11:55:20.281058589 +0200] - INFO - main - 389-Directory/1.3.8.4 B2019.073.1017 starting up [15/Jul/2019:11:55:23.547420923 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [15/Jul/2019:11:55:23.559032647 +0200] - WARN - default_mr_indexer_create - Plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match [15/Jul/2019:11:55:23.564949251 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [15/Jul/2019:11:55:23.577560053 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [15/Jul/2019:11:55:23.588155114 +0200] - NOTICE - ldbm_back_start - found 16161224k physical memory [15/Jul/2019:11:55:23.591539124 +0200] - NOTICE - ldbm_back_start - found 13940692k available [15/Jul/2019:11:55:23.599946323 +0200] - NOTICE - ldbm_back_start - cache autosizing: db cache: 646448k [15/Jul/2019:11:55:23.616518778 +0200] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (3 total): 327680k [15/Jul/2019:11:55:23.621093317 +0200] - NOTICE - ldbm_back_start - cache autosizing: userRoot dn cache (3 total): 65536k [15/Jul/2019:11:55:23.628508949 +0200] - NOTICE - ldbm_back_start - cache autosizing: ipaca entry cache (3 total): 327680k [15/Jul/2019:11:55:23.638398863 +0200] - NOTICE - ldbm_back_start - cache autosizing: ipaca dn cache (3 total): 65536k [15/Jul/2019:11:55:23.645023551 +0200] - NOTICE - ldbm_back_start - cache autosizing: changelog entry cache (3 total): 327680k [15/Jul/2019:11:55:23.654352539 +0200] - NOTICE - ldbm_back_start - cache autosizing: changelog dn cache (3 total): 65536k [15/Jul/2019:11:55:23.667416379 +0200] - NOTICE - ldbm_back_start - total cache size: 1869923286 B; [15/Jul/2019:11:55:23.704506887 +0200] - ERR - nis-plugin - scheduled nis-plugin tree scan in about 5 seconds after the server startup! [15/Jul/2019:11:55:23.713733297 +0200] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [15/Jul/2019:11:55:23.728929057 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.739725600 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=keys,cn=sec,cn=dns,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.748699366 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.752214540 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.766237141 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.769433779 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.777943351 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.786219631 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.803747001 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.806948786 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.815282194 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.831267382 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.834650844 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.843022267 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.856636050 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.859983212 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.868234767 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.876714886 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.895069815 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.898452558 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.906932808 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=de does not exist [15/Jul/2019:11:55:23.916056324 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=example,dc=de does not exist [15/Jul/2019:11:55:24.002345465 +0200] - ERR - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [15/Jul/2019:11:55:24.009036968 +0200] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=example,dc=de--no CoS Templates found, which should be added before the CoS Definition. [15/Jul/2019:11:55:24.057587909 +0200] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa1.example...@example.de] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328324 (Generic error (see e-text)) [15/Jul/2019:11:55:24.061303913 +0200] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [15/Jul/2019:11:55:24.070393552 +0200] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [15/Jul/2019:11:55:24.078341143 +0200] - INFO - slapd_daemon - Listening on /var/run/slapd-EXAMPLE-DE.socket for LDAPI requests [15/Jul/2019:11:55:24.107411582 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:55:24.110691318 +0200] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=masterAgreement1-ipa2.example.de-pki-tomcat" (ipa2:389) - Replication bind with SIMPLE auth failed: LDAP error -11 (Connect error) (error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (self signed certificate in certificate chain)) [15/Jul/2019:11:55:24.119532167 +0200] - ERR - nis-plugin - nis-plugin tree scan will start in about 5 seconds! [15/Jul/2019:11:55:24.127438476 +0200] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [15/Jul/2019:11:55:27.049230028 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:55:29.540035160 +0200] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=de [15/Jul/2019:11:55:29.545887704 +0200] - ERR - schema-compat-plugin - Finished plugin initialization. [15/Jul/2019:11:55:29.969283612 +0200] - ERR - nis-plugin - warning: no entries in domain=example.de,map=ethers.byname [15/Jul/2019:11:55:29.974487661 +0200] - ERR - nis-plugin - warning: no entries in domain=example.de,map=ethers.byaddr [15/Jul/2019:11:55:29.982575457 +0200] - ERR - nis-plugin - Finished plugin initialization. [15/Jul/2019:11:55:33.436732360 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:55:45.083331894 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:56:09.309547212 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:56:17.543703980 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa4.example.de" (ipa4:389): Unable to receive the response for a startReplication extended operation to consumer (Can't contact LDAP server). Will retry later. [15/Jul/2019:11:56:26.355725880 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipa4.example.de" (ipa4:389): Replication bind with GSSAPI auth resumed [15/Jul/2019:11:56:57.931980423 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:11:58:33.095158094 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:01:45.167805882 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:06:45.840094815 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:11:45.126107090 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:16:45.649092285 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:21:45.148007042 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:26:46.008328386 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:31:45.277804671 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:36:45.115789474 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:41:46.007044612 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:46:45.142744840 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:47:54.105667318 +0200] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToipa3.example.de" (ipa3:389): Unable to parse the response to the endReplication extended operation. [15/Jul/2019:12:51:45.101085976 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:12:56:45.235382704 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) [15/Jul/2019:13:01:45.658871508 +0200] - ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
