On 9/15/10 7:45 PM, Rob Crittenden wrote:
Miljan Karadzic wrote:
Hello all,
I am having some problems installing FreeIPA server on a freshly
installed Fedora 13 machine. Installation fails during configuration of
certificate server at step 3/14:
-----------
[3/14]: configuring certificate server instance
root : CRITICAL failed to restart ca instance Command '/usr/bin/perl
/usr/bin/pkisilent ConfigureCA -cs_hostname loznica.lhs-systems.com
-cs_port 9445 -client_certdb_dir /tmp/tmp-0ANqdU -client_certdb_pwd
XXXXXXXX -preop_pin eTvJduILXN6kCgkX46ih -domain_name IPA -admin_user
admin -admin_email r...@localhost -admin_password XXXXXXXX -agent_name
ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa
-agent_cert_subject "CN=ipa-ca-agent,O=IPA" -ldap_host
loznica.lhs-systems.com -ldap_port 7389 -bind_dn "cn=Directory Manager"
-bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048
-key_type rsa -save_p12 true -backup_pwd XXXXXXXX -subsystem_name
pki-cad -token_name internal -ca_subsystem_cert_subject_name "CN=CA
Subsystem,O=IPA" -ca_ocsp_cert_subject_name "CN=OCSP Subsystem,O=IPA"
-ca_server_cert_subject_name "CN=loznica.lhs-systems.com,O=IPA"
-ca_audit_signing_cert_subject_name "CN=CA Audit,O=IPA"
-ca_sign_cert_subject_name "CN=Certificate Authority,O=IPA" -external
false -clone false' returned non-zero exit status 255
[4/14]: creating CA agent PKCS#12 file in /root
Unexpected error - see ipaserver-install.log for details:
Command '/usr/bin/pk12util -n ipa-ca-agent -o /root/ca-agent.p12 -d
/tmp/tmp-0ANqdU -k /tmp/tmplUonD_ -w /tmp/tmplUonD_' returned non-zero
exit status 24
-----------
Even if installation continues to next step PKI-CA is not configured.
Debug message from the installation log file says (complete installation
log is attached):
-----------
Required parameter -key_algorithm is not specified.
Use -help for help information
-----------
Installed packages are as follows:
-----------
pki-common-1.3.8-1.fc13.noarch
pki-util-1.3.2-1.fc13.noarch
pki-console-1.3.2-1.fc13.noarch
pki-native-tools-1.3.0-5.fc13.i686
dogtag-pki-ca-ui-1.3.2-1.fc13.noarch
pki-silent-1.3.4-1.fc13.noarch
pki-symkey-1.3.2-4.fc13.i686
pki-java-tools-1.3.1-1.fc13.noarch
dogtag-pki-console-ui-1.3.2-2.fc13.noarch
pki-ca-1.3.6-1.fc13.noarch
pki-selinux-1.3.5-1.fc13.noarch
dogtag-pki-common-ui-1.3.3-1.fc13.noarch
pki-setup-1.3.4-1.fc13.noarch
-
ipa-server-1.9.0.pre4-0.fc13.i686
ipa-admintools-1.9.0.pre4-0.fc13.i686
ipa-python-1.9.0.pre4-0.fc13.i686
ipa-server-selinux-1.9.0.pre4-0.fc13.i686
ipa-client-1.9.0.pre4-0.fc13.i686
-
389-ds-base-1.2.6-1.fc13.i686
-----------
Any ideas what could be the problem?
The problem is that pkisilent requires a new argument, -key_algorithm,
that we aren't providing. To wokr around this you'll need to modify
/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py.
Search for pkisilent and you'll see we create a huge array of
arguments to pass. Add this:
"-key_algorithm", "SHA256withRSA",
I put it in right after:
"-key_type", "rsa",
but order shouldn't matter.
rob
Hi Rob,
I found the same thing after writing the email, but I didn't know what
to use as an argument - putting just 'rsa' didn't work. :)
Thanks a lot for the help!
_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users
