Andrea Bontempi wrote:
Hi, i'm trying to install FreeIPA with external CA (again)

Now i use FreeIPA 3.3.* and i found a strange error on "[17/22]: requesting RA 
certificate from CA":

2013-11-08T11:07:38Z DEBUG   File 
"/usr/lib/python2.7/site-packages/ipaserver/install/", line 622, 
in run_script
    return_value = main_function()

  File "/usr/sbin/ipa-server-install", line 1096, in main

  File "/usr/lib/python2.7/site-packages/ipaserver/install/", line 
478, in configure_instance

  File "/usr/lib/python2.7/site-packages/ipaserver/install/", line 
364, in start_creation

  File "/usr/lib/python2.7/site-packages/ipaserver/install/", line 
1089, in __request_ra_certificate
    self.requestId = item_node[0].childNodes[0].data

2013-11-08T11:07:38Z DEBUG The ipa-server-install command failed, exception: 
IndexError: list index out of range

So, i open /usr/lib/python2.7/site-packages/ipaserver/install/ on 
the line 1089:

  # Send the request to the CA
  conn = httplib.HTTPConnection(
      self.fqdn, self.dogtag_constants.UNSECURE_PORT)
  params = urllib.urlencode({'profileId': 'caServerCert',
          'cert_request_type': 'pkcs10',
          'requestor_name': 'IPA Installer',
          'cert_request': csr,
          'xmlOutput': 'true'})
  headers = {"Content-type": "application/x-www-form-urlencoded",
             "Accept": "text/plain"}

  conn.request("POST", "/ca/ee/ca/profileSubmit", params, headers)
  res = conn.getresponse()
  if res.status == 200:
      data =
      doc = xml.dom.minidom.parseString(data)
      item_node = doc.getElementsByTagName("RequestId")
      self.requestId = item_node[0].childNodes[0].data   <--  exception: 
IndexError: list index out of range
      self.requestId = self.requestId.strip()
      if self.requestId is None:
          raise RuntimeError("Unable to determine RA certificate requestId")

I read the value of "data":

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<Error>Profile caServerCert Not Found</Error>

Can someone help me?

I'd check out the CA logs in /var/log/pki/pki-tomcat/ca for more information.


Freeipa-users mailing list

Reply via email to