[Freeipa-users] Re: "Cannot obtain CA certificate" error when trying to install, but works on older instances; force fails

2017-08-01 Thread Rob Crittenden via FreeIPA-users
None via FreeIPA-users wrote: > Further update: I'm pretty sure I found out the problem. > > Basically, my old server is running pyasn1==0.2.3 and the new one has > pyasn1==0.3.1. Per the pyasn1 documentation, they made a breaking change > to __init__ and a few other functions in 0.3.1, so I

[Freeipa-users] Re: "Cannot obtain CA certificate" error when trying to install, but works on older instances; force fails

2017-08-01 Thread None via FreeIPA-users
Further update: I'm pretty sure I found out the problem. Basically, my old server is running pyasn1==0.2.3 and the new one has pyasn1==0.3.1. Per the pyasn1 documentation, they made a breaking change to __init__ and a few other functions in 0.3.1, so I guess FreeIPA 4.3.1 isn't compatible with

[Freeipa-users] Re: "Cannot obtain CA certificate" error when trying to install, but works on older instances; force fails

2017-08-01 Thread None via FreeIPA-users
Slight update: I tried precreating /etc/ipa/ca.crt, and when running the install, I get the same Python error I did before: File "/usr/sbin/ipa-client-install", line 3099, in sys.exit(main()) File "/usr/sbin/ipa-client-install", line 3080, in main rval = install(options, env,

[Freeipa-users] Re: "Cannot obtain CA certificate" error when trying to install, but works on older instances; force fails

2017-08-01 Thread None via FreeIPA-users
Hey, I checked the logs and found this: conn=3295 op=3 SRCH base="cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=services,dc=example" scope=2 filter="(&(objectClass=ipaCertificate)(objectClass=pkiCA))" attrs="ipaKeyExtUsage cn ipaCertSubject ipaPublicKey cacertificate;binary ipaKeyTrust

[Freeipa-users] Re: "Cannot obtain CA certificate" error when trying to install, but works on older instances; force fails

2017-08-01 Thread Florence Blanc-Renaud via FreeIPA-users
On 08/01/2017 03:26 AM, None via FreeIPA-users wrote: I'm really at a loss on this one. I have a bunch of old server images (from 2 months ago) that can run ipa-client-install just fine. When I created a new image, though, I get this error (from the install logs): DEBUG flushing