Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30
seconds
  [1/31]: creating certificate server user
  [2/31]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA
instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpANra4a' returned
non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs
and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL   /var/log/pki/pki-tomcat
  [error] RuntimeError: CA configuration failed.
ipa.ipapython.install.cli.install_tool(Server): ERROR    CA configuration
failed.
ipa.ipapython.install.cli.install_tool(Server): ERROR    The ipa-server-install
command failed. See /var/log/ipaserver-install.log for more information

2017-01-17T07:01:18Z DEBUG Starting external process
2017-01-17T07:01:18Z DEBUG args=/usr/sbin/pkispawn -s CA -f /tmp/tmpANra4a
2017-01-17T07:01:19Z DEBUG Process finished, return code=1
2017-01-17T07:01:19Z DEBUG stdout=Log file:
/var/log/pki/pki-ca-spawn.20170117070118.log
Loading deployment configuration from /tmp/tmpANra4a.
Installing CA into /var/lib/pki/pki-tomcat.
Storing deployment configuration into
/etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg.

Installation failed: stat() argument 1 must be encoded string without null
bytes, not str

2017-01-17 07:01:19 pkispawn    : INFO     ....... executing 'certutil -N -d
/tmp/tmp-oI6sY0 -f /root/.dogtag/pki-tomcat/ca/password.conf'
2017-01-17 07:01:19 pkispawn    : DEBUG    ....... Error Type: TypeError
2017-01-17 07:01:19 pkispawn    : DEBUG    ....... Error Message: stat()
argument 1 must be encoded string without null bytes, not str
2017-01-17 07:01:19 pkispawn    : DEBUG    .......   File "/usr/sbin/pkispawn",
line 528, in main
    scriptlet.spawn(deployer)
  File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/confi
guration.py", line 301, in spawn
    if len(deployer.instance.tomcat_instance_subsystems()) < 2:
  File "/usr/lib/python2.7/site-packages/pki/server/deployment/pkihelper.py",
line 1028, in tomcat_instance_subsystems
    if os.path.exists(path) and os.path.isdir(path):
  File "/usr/lib64/python2.7/genericpath.py", line 26, in exists
    os.stat(path)

Try to install FreeIPA server with self-signed CA provided by Dogtag

Installation fails during CA subsystem spawn.

Installation produces a working FreeIPA server

The installation works in freeipa/freeipa-server:fedora-rawhide Docker image
built on 2017-01-11T13:53:49.455Z and also on freshly built Docker image
launched on Fedora Atomic Host 25.

Adding some debug prints into
"/usr/lib/python2.7/site-packages/pki/server/deployment/pkihelper.py" reveals
that on one occasion, PKI_INSTANCE_PATH constant from
"/usr/lib/python2.7/site-packages/pki/server/deployment/config.py" holds a
value containing non-printable character:

PKI instance path: /var/lib/pki/pki-tomcat
Path: /var/lib/pki/pki-tomcat/ocsp [type <type 'str'>]
PKI instance path: /var/lib/pki/pki-tomcat
Path: /var/lib/pki/pki-tomcat/tks [type <type 'str'>]
PKI instance path: /var/lib/pki/pki-tomcat
Path: /var/lib/pki/pki-tomcat/tps [type <type 'str'>]
PKI instance path: /var/lib/pki^@pki-tomcat <----
Path: /var/lib/pki^@pki-tomcat/ca [type <type 'str'>]

Created attachment of CA instance spawn log in associated bug.