Good day, Colleagues!

And Happy New Year!

I have tried to install test stend with ipa v4.2 and 2 master-master

files /etc/hosts on both servers contain:   localhost localhost.localdomain localhost4
::1         localhost localhost.localdomain localhost6
localhost6.localdomain6 radipa00.test.ckt radipa00 radipa01.test.ckt radipa01

prepare key for replica server:
[root@radipa00 ipa]# ipa-replica-prepare --ip-address=

copy it to replica:
[root@radipa00 ipa]# scp /var/lib/ipa/replica-info-radipa01.test.ckt.gpg

then on replica start installation:
[root@radipa01 ~]# ipa-replica-install --setup-ca --setup-kra
--mkhomedir --ssh-trust-dns --ip-address= --setup-dns
--forwarder= --forwarder=

and!!! I have got such error:
  [2/23]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to
configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f'
'/tmp/tmpvgc4S6'' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the
installation logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL  
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL  
  [error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

log file contains this error:
[root@radipa01 ~]# less /var/log/pki/pki-ca-spawn.20160111150634.log
    'application_version': '[APPLICATION_VERSION]'}
2016-01-11 15:06:34 pkispawn    : ERROR    ....... Deployment file could
not be parsed correctly.  This might be because of unescaped '%%'
characters.  You must escape '%%' characters in deployment files
(example - 'setting=foo%%%%bar').
2016-01-11 15:06:34 pkispawn    : ERROR    ....... Interpolation error
('%' must be followed by '%' or '(', found: '%')

I have reproduced that error several times with cenos7 and fedora23

I am really confused if I am doing something wrong or may it is
something else...
what it can be?
Best wishes!

Manage your subscription for the Freeipa-users mailing list:
Go to for more info on the project

Reply via email to