https://bugzilla.redhat.com/show_bug.cgi?id=832559 (Red Hat Enterprise Linux 6)
Description of problem: install ipa server, uninstall, then reinstall fails intermittently with error: Configuring named: [1/9]: adding DNS container [2/9]: setting up our zone [3/9]: setting up reverse zone [4/9]: setting up our own record [5/9]: setting up kerberos principal [6/9]: setting up named.conf [7/9]: restarting named [8/9]: configuring named to start on boot [9/9]: changing resolv.conf to point to ourselves done configuring named. Global DNS configuration in LDAP server is empty You can use 'dnsconfig-mod' command to set global DNS options that would override settings in local named.conf files Restarting the web server Configuration of client side components failed! ipa-client-install returned: Command '/usr/sbin/ipa-client-install --on-master --unattended --domain testrelm.com --server qe-blade-13.testrelm.com --realm TESTRELM.COM --hostname qe-blade-13.testrelm.com' returned non-zero exit status 1 Can workaround by renaming /etc/pki/nss/cert8.db, and key3.db, and can reinstall Version-Release number of selected component (if applicable): ipa-server-2.2.0-16.el6.x86_64 How reproducible: intermittently Steps to Reproduce: 1. install ipa server 2. uninstall 3. reinstall Actual results: fails with error: ipa-client-install returned: Command '/usr/sbin/ipa-client-install --on-master --unattended --domain testrelm.com --server qe-blade-13.testrelm.com --realm TESTRELM.COM --hostname qe-blade-13.testrelm.com' returned non-zero exit status 1 Expected results: be able to reinstall successfully Additional info: After reinstalling, it failed, and ipaserver_install.log has - Domain testrelm.com is already configured in existing SSSD config, creating a new one. The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall. Configured /etc/sssd/sssd.conf Installation failed. Rolling back changes. 2012-06-15T13:38:11Z DEBUG stderr=Failed to add CA to the default NSS database. And ipaclient_install.log has error - 2012-06-15T13:38:04Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2012-06-15T13:38:04Z DEBUG Domain testrelm.com is already configured in existing SSSD config, creating a new one. 2012-06-15T13:38:04Z DEBUG args=/usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt 2012-06-15T13:38:04Z DEBUG stdout= 2012-06-15T13:38:04Z DEBUG stderr=certutil: could not obtain certificate from file: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.
May be a slightly different issue, but I can see what seem a possible similar IPA clients install failure, for example with:
Linux ca1.example.com 2.6.18-308.11.1.el5 #1 SMP Fri Jun 15 15:41:53 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux sssd-1.5.1-49.el5_8.1.x86_64 Mon 11 Jun 2012 11:56:14 PM PDT package ipa-server is not installed ipa-client-2.1.3-2.el5_8.x86_64 Mon 11 Jun 2012 11:56:15 PM PDT
The IPA client NSS db has been clean up in /etc/pki/nssdb/, but that IPA client file /etc/ipa/ca.crt stays with the older or first IPA enrollment, the CA cert shows the first CA's key id, not the newer one, and the client install fails on trusted cert, although the correct remote DNS servers are up and resolve correctly:
ipa-client-install -d --mkhomedir --force --enable-dns-updates -U -w password -p admin@EXAMPLE.COM root : DEBUG /usr/sbin/ipa-client-install was invoked with options: {'conf_ntp': True, 'domain': None, 'uninstall': False, 'force': True, 'sssd': True, 'krb5_offline_passwords': True, 'hostname': None, 'permit': False, 'server': None, 'prompt_password': False, 'mkhomedir': True, 'dns_updates': True, 'preserve_sssd': False, 'debug': True, 'on_master': False, 'ntp_server': None, 'realm_name': None, 'unattended': True, 'principal': 'admin@EXAMPLE.COM'} root : DEBUG missing options might be asked for interactively later
root : DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' root : DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' root : DEBUG [ipadnssearchldap(example.com)] root : DEBUG [ipadnssearchkrb] root : DEBUG [ipacheckldap] root : DEBUG args=/usr/bin/wget -O /tmp/tmpvkE1FT/ca.crt -T 15 -t 2 http://ipaserver1.example.com/ipa/config/ca.crt root : DEBUG stdout= root : DEBUG stderr=--2012-08-30 18:30:19-- http://ipaserver1.example.com/ipa/config/ca.crt Resolving ipaserver1.example.com... 10.14.5.36 Connecting to ipaserver1.example.com|10.14.5.36|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 1317 (1.3K) [application/x-x509-ca-cert] Saving to: `/tmp/tmpvkE1FT/ca.crt'
0K . 100% 2.75M=0s
2012-08-30 18:30:19 (2.75 MB/s) - `/tmp/tmpvkE1FT/ca.crt' saved [1317/1317]
root : DEBUG Init ldap with: ldap://ipaserver1.example.com:389 root : ERROR LDAP Error: Connect error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed root : DEBUG will use domain: example.com
root : DEBUG will use server: ipaserver1.example.com
Failed to verify that ipaserver1.example.com is an IPA Server. This may mean that the remote server is not up or is not reachable due to network or firewall settings. Installation failed. Force set so not rolling back changes. [root@ca1 ~]#
Renaming that older ca cert file /etc/ipa/ca.crt to something else allowed me to re-enroll my test IPA client to a different set of IPA servers successfully.
Is it related to #2702? Putting into NEEDS TRIAGE.
We can't do much about it. Deferring.
The ticket can be closed. Uninstall and install have been working for a while. FreeIPA no longer uses /etc/pki/nssdb
closing per comment 5
Metadata Update from @dpal: - Issue assigned to someone - Issue set to the milestone: 0.0 NEEDS_TRIAGE
Login to comment on this ticket.