Łukasz Jaworski wrote: > Hi, > > I have problem with setup new replicas. > I tried setup two replicas, both failed with the same error. > > environment: > Fedora 21 > > packages: > freeipa-server-4.1.3-2.fc21.x86_64 > 389-ds-base-1.3.3.8-1.fc21.x86_64 > 389-ds-base-libs-1.3.3.8-1.fc21.x86_64 > pki-server-10.2.0-5.fc21.noarch > > same on server and replicas > > > Output from ipa-replica-install: > (…) > Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 > seconds > [1/22]: creating certificate server user > [2/22]: configuring certificate server instance > [3/22]: stopping certificate server instance to update CS.cfg > [4/22]: backing up CS.cfg > [5/22]: disabling nonces > [6/22]: set up CRL publishing > [7/22]: enable PKIX certificate path discovery and validation > [8/22]: starting certificate server instance > [error] RuntimeError: CA did not start in 300.0s > > Your system may be partly configured. > Run /usr/sbin/ipa-server-install --uninstall to clean up. > >>From /var/log/ipareplica.log > 2015-10-07T06:25:58Z DEBUG The CA status is: check interrupted > 2015-10-07T06:25:58Z DEBUG Waiting for CA to start... > 2015-10-07T06:25:59Z DEBUG Starting external process > 2015-10-07T06:25:59Z DEBUG args='/usr/bin/wget' '-S' '-O' '-' '--timeout=30' > '--no-check-certificate' 'https://182.example.com:8443/ca/admin/c > a/getStatus' > 2015-10-07T06:25:59Z DEBUG Process finished, return code=8 > 2015-10-07T06:25:59Z DEBUG stdout= > 2015-10-07T06:25:59Z DEBUG stderr=--2015-10-07 08:25:59-- > https://182.example.com:8443/ca/admin/ca/getStatus > Resolving 182.example.com (182.example.com)... xx.xx.xx.xx > Connecting to 182.example.com (182.example.com)|xx.xx.xx.xx|:8443... > connected. > WARNING: cannot verify 182.example.com's certificate, issued by > ‘CN=Certificate Authority,O=ecample.com’: > Self-signed certificate encountered. > HTTP request sent, awaiting response... > HTTP/1.1 500 Internal Server Error > Server: Apache-Coyote/1.1 > Content-Type: text/html;charset=utf-8 > Content-Language: en > Content-Length: 2923 > Date: Wed, 07 Oct 2015 06:25:59 GMT > Connection: close > 2015-10-07 08:25:59 ERROR 500: Internal Server Error. > > Any idea? >
You'll need to check the dogtag logs for errors. Start with /var/log/pki/pki-tomcat/ca/debug rob -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
