IPA-Server install error. Configuring CA Failed.

Latest response

Hi

I have tried installing IPA-Server in Red Hat system, and strange it gave me some " Configuration of CA Failed " error. Co-incidentally the same error occurs in Cent OS systems as well. However i was installing IPA-Server in Cent OS based machines few months back, but this time it doesn't work.

I have seen many reports of users facing similar issue, but without any active solution.

Please find the attached ipaserver-install.log

PS : I have tried it in Brand New Installed System's multiple times. Same error.

Attachments

ZV
Log in to join the conversation

Responses

R. Hinton's picture Guru 6827 points
29 December 2014 11:31 PM

Hi Zeal Vora,

See if one of these bugzillas apply, one is the upstream, the other is the Red Hat bugzilla:
upstream IPA bugzilla 4415 https://fedorahosted.org/freeipa/ticket/4415
- As I type this, this bugzilla has a status of "assigned" redhat bugzilla 1114127 https://bugzilla.redhat.com/show_bug.cgi?id=1114127, and see the comment by Scott Poore 2014-06-27 16:19:11 EDT (and he says his work-around may or may not be useful).

Martin Kosek's picture Red Hat Community Member 22 points
27 February 2015 7:53 AM

Hello,

I do not think this is the root cause, the hostname used in the original log was not that long (it may have been anonymized, I know). But even the errors did not match:

2014-06-27T19:44:00Z DEBUG stderr=Exception: Unable to Send Request:java.io.IOException: java.io.IOException: SSL_ForceHandshake failed:

vs,

2014-12-26T18:18:16Z DEBUG stderr=Exception: Unable to Send Request:java.net.ConnectException: Connection refused
java.net.ConnectException: Connection refused

In this case, I rather suspect that some port was blocked before IPA server installation. I would especially check for port 8443 to be open. Other ports that PKI uses: in RHEL-6:

# netstat -putna | grep java
tcp        0      0 :::9180                     :::*                        LISTEN      27771/java          
tcp        0      0 :::9443                     :::*                        LISTEN      27771/java          
tcp        0      0 :::9444                     :::*                        LISTEN      27771/java          
tcp        0      0 ::ffff:127.0.0.1:9701       :::*                        LISTEN      27771/java          
tcp        0      0 :::9445                     :::*                        LISTEN      27771/java          
tcp        0      0 :::9446                     :::*                        LISTEN      27771/java          
tcp        0      0 :::9447                     :::*                        LISTEN      27771/java
ZV Community Member 35 points
30 December 2014 3:33 AM

oh, thank you.

I guess we will have to wait for bug fix in order to have a permanent solution around.

Is it possible to have one of the repositories with the working version of IPA ? . Because i remember, 2 months back IPA installation was working perfectly.

R. Hinton's picture Guru 6827 points
30 December 2014 2:49 PM

Here's one immediate possibility Zeal,

Download a RHEL 6.5 server iso and follow the instructions for creating an IPA server, and use (only) a local yum repo you have created from the RHEL 6.5 disk (or if you have a Red Hat Satellite server, a cloned channel that is earlier than the affected date for the ipa binaries with a bug).
(Note, using an external CA may cause bonus configuration fun, just to let you know). I created a test IPA server in this fashion for a test-victim server that I then later deleted for a test. But know that if you take this path, you inherit all security issues that are not patched from the release of RHEL 6.5 to current day, until you register and patch the system with errata, security fixes and the future bug fix they have for IPA.

I had attempted to create an IPA server under RHEL 7, but at the time I did it, the install failed and when I looked up the error messages, I had found a bugzilla against IPA on RHEL 7... but there's a chance they may have fixed it (and I have not checked). If I had a choice, I'd rather have an IPA server on RHEL 7... but I've had bigger fish to fry lately.

ZV Community Member 35 points
1 January 2015 11:11 AM

Thanks for your reply.

I am using RHEL 6.5 and am using the Local YUM Repo . I tried installing IPA from offline YUM REPO and still i get the same error. It seems strange as when downloading the REPO ISO , it was updated last year , and i am sure that IPA was working till September 2014.

R. Hinton's picture Guru 6827 points
2 January 2015 3:38 PM

That is odd.. I'll check the IPA server I have at another location later and get back with you.

wi Newbie 5 points
15 February 2015 3:25 AM

Same error for me too. Can you help out ?

DK Newbie 16 points
15 May 2015 12:44 PM

Hello, is there some resolution? I can not install IPA on RHEL 6.5...

Russell Goldberg's picture Active Contributor 392 points
24 June 2015 5:47 PM

I'm in the same boat.

Unable to install IPA on RHEL 6.6.

Martin Kosek's picture Red Hat Community Member 22 points
25 June 2015 4:00 AM

I would advise to check this KB: https://access.redhat.com/solutions/1275383

There is a known issue with Java 1.8.0 (ZStream fix for PKI should be on the way).

RG Active Contributor 392 points
25 June 2015 12:05 PM

Thanks, Martin. This ended up fixing the issue for me.

Reverting to Java 1.7.0 enables the installation to complete successfully.

R. Hinton's picture Guru 6827 points
12 August 2015 1:17 AM

Martin, https://access.redhat.com/solutions/1275383 has expired, and is no longer available. any idea if that solution ID can be made available?

Thanks

Robert Krátký's picture Red Hat Guru 3240 points
12 August 2015 7:40 AM

Hi,

That solution has been deprecated in favor of https://access.redhat.com/solutions/1468433.

(tl;dr -- the problem has been fixed, and an up-to-date ipa-server-install should work as expected without needing to install Java 1.7.0.)

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.