Chuck Lever wrote:

I'm new to FreeIPA.  I'm installing on an up-to-date Fedora 18 system from the 
freeipa packages available with Fedora 18.  When running ipa-server-install, 
the install process fails here:

Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 
   [1/20]: creating certificate server user
   [15/20]: requesting RA certificate from CA
Unexpected error - see /var/log/ipaserver-install.log for details:
IndexError: list index out of range

The tail of the installer log looks like this:

Generating key.  This may take a few moments...

2013-02-12T21:04:46Z INFO   File 
"/usr/lib/python2.7/site-packages/ipaserver/install/", line 617, 
in run_script
     return_value = main_function()

   File "/sbin/ipa-server-install", line 986, in main
     dm_password, subject_base=options.subject)

   File "/usr/lib/python2.7/site-packages/ipaserver/install/", 
line 621, in configure_instance

   File "/usr/lib/python2.7/site-packages/ipaserver/install/", line 
358, in start_creation

   File "/usr/lib/python2.7/site-packages/ipaserver/install/", 
line 1219, in __request_ra_certificate
     self.requestId = item_node[0].childNodes[0].data

2013-02-12T21:04:46Z INFO The ipa-server-install command failed, exception: 
IndexError: list index out of range

Is there a workaround or fix available?  I haven't found any relevant 
information via a web search, and a few searches on have 
come up empty.

We've seen just one other report of this and unfortunately the VM was removed before we could do a lot of diagnosis. What we saw was that certutil output garbage when requesting the RA admin certificate. Can you look in /var/log/ipaserver-install.log for the last certutil command? Does stdout contain a lot of garbage characters in it? It should consist of a base64-encoded CSR.

If so, what version of nss and nss-tools do you have installed?


Freeipa-users mailing list

Reply via email to