lejeczek wrote:
On 25/05/16 14:19, Rob Crittenden wrote:
lejeczek wrote:
hi there,
I'm trying to set up a replica with: --setup-dns --no-forwarders
--setup-ca
installer fails at:
[10/23]: importing CA chain to RA certificate database
[error] RuntimeError: Unable to retrieve CA chain: [Errno 111]
Connection refused
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
more from log:
2016-05-25T12:38:31Z DEBUG [10/23]: importing CA chain to RA
certificate database
2016-05-25T12:38:31Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 418, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 408, in run_step
method()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1015, in __import_ca_chain
chain = self.__get_ca_chain()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
997, in __get_ca_chain
raise RuntimeError("Unable to retrieve CA chain: %s" % str(e))
RuntimeError: Unable to retrieve CA chain: [Errno 111] Connection
refused
2016-05-25T12:38:31Z DEBUG [error] RuntimeError: Unable to retrieve CA
chain: [Errno 111] Connection refused
2016-05-25T12:38:31Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in
execute
what might be the problem?
It is failing getting the CA chain from dogtag. It uses port 8080 by
default. I'd check your firewall and that the remote CA is up.
is 8080 needed only @installation time or all the time?
many thanks,
I think it's just needed during install but I didn't pour over the code.
Once up the data replicates, depending on version, on 389 or 7389 and
all other access should be proxied through 443.
rob
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
