May 2018 - FreeIPA-users - Fedora mailing-lists

CA install on replica fails - Clone URI does not match...
by Ross Infinger 09 May '18

09 May '18

I'm installing the CA service on an existing replica with command ipa-ca-install. It fails with this error in the log: Installation failed: com.netscape.certsrv.base.BadRequestException: Clone URI does not match available subsystems: https://pci-mgmt-ipa01.pci.xxxxxx.com:443 Version of both ca master and replica is 4.5.0 api version 2.228 domain level is 1 ipareplica-ca-install.log attached. How can I further troubleshoot this? Thanks, Ross

2 6

attrlist_replace - attr_replace failed
by Sandor Juhasz 09 May '18

09 May '18

Hello, we have a 4 way master master replication. Which is finnaly working, but we still see one error: [09/May/2018:14:21:27.882261986 +0200] attrlist_replace - attr_replace (nsslapd-referral, ldap://ipa34.bph.cxn:389/o%3Dipaca) failed. [09/May/2018:14:21:31.827746424 +0200] attrlist_replace - attr_replace (nsslapd-referral, ldap://ipa35.bph.cxn:389/o%3Dipaca) failed. How can we fix these? -- *Sándor Juhász* System Administrator *ChemAxon* *Ltd*. Building Hx, GraphiSoft Park, Záhony utca 7, Budapest, Hungary, H-1031 Cell: +36704258964

2 1

Re: After using 3rd party certs (Let's Encrypt) : pki-tomcatd fails to restart
by Joseph Flynn 09 May '18

09 May '18

I restored the earlier image where it was working well with self-signed certs and just did the steps again. The pki-tomcatd restart was attempted at 10:47 local time and failed out several minutes later at 10:52. Your suggested debug steps reveal: root@prime prime.ipa.kkgpitt.org]# ipa-server-certinstall -w fullchain.pem privkey.pem Directory Manager password: Enter private key unlock password: Please restart ipa services after installing certificate (ipactl restart) The ipa-server-certinstall command was successful [root@prime prime.ipa.kkgpitt.org]# ipactl restart Stopping pki-tomcatd Service Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting named Service Restarting httpd Service Restarting ipa-custodia Service Restarting ntpd Service Restarting pki-tomcatd Service Failed to restart pki-tomcatd Service Shutting down Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed Aborting ipactl [root@prime prime.ipa.kkgpitt.org]# cd /etc/dirsrv/slapd-IPA-KKGPITT-ORG/ [root@prime slapd-IPA-KKGPITT-ORG]# certutil -d /etc/dirsrv/slapd-IPA-KKGPITT-ORG -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI IPA.KKGPITT.ORG IPA CA CT,C,C Server-Cert u,u,u ISRG_Root_X1 C,, DSTRootCAX3 C,, LetsEncryptX3CrossSigned C,, LetsEncryptX3CrossSigned C,, and cat /var/log/pki/pki-tomcat/ca/debug.2018-05-09.log 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: restart at autoShutdown? false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: autoShutdown crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: found cert:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: done init id=debug 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initialized debug 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initSubsystem id=log 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: ready to init id=log 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Event filters: 2018-05-09 10:47:45 [localhost-startStop-1] FINE: - CMC_SIGNED_REQUEST_SIG_VERIFY: (Outcome=Failure) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: - CMC_USER_SIGNED_REQUEST_SIG_VERIFY: (Outcome=Failure) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: - DELTA_CRL_GENERATION: (Outcome=Failure) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: - FULL_CRL_GENERATION: (Outcome=Failure) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: - OCSP_GENERATION: (Outcome=Failure) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: - RANDOM_GENERATION: (Outcome=Failure) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: - SELFTESTS_EXECUTION: (Outcome=Failure) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Creating RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Event filters: 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Creating RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Event filters: 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Creating RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: restart at autoShutdown? false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: autoShutdown crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: found cert:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: done init id=log 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initialized log 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initSubsystem id=jss 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: ready to init id=jss 2018-05-09 10:47:45 [localhost-startStop-1] FINE: JssSubsystem: initializing JSS subsystem 2018-05-09 10:47:45 [localhost-startStop-1] FINE: JssSubsystem: enabled: true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: JssSubsystem: NSS database: /var/lib/pki/pki-tomcat/alias/ 2018-05-09 10:47:45 [localhost-startStop-1] FINE: JssSubsystem: initializing CryptoManager 2018-05-09 10:47:45 [localhost-startStop-1] FINE: JssSubsystem: initializing SSL 2018-05-09 10:47:45 [localhost-startStop-1] FINE: JssSubsystem: random: 2018-05-09 10:47:45 [localhost-startStop-1] FINE: JssSubsystem: - algorithm: pkcs11prng 2018-05-09 10:47:45 [localhost-startStop-1] FINE: JssSubsystem: - provider: Mozilla-JSS 2018-05-09 10:47:45 [localhost-startStop-1] FINE: JssSubsystem: initialization complete 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: restart at autoShutdown? false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: autoShutdown crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: found cert:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: done init id=jss 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initialized jss 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initSubsystem id=dbs 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: ready to init id=dbs 2018-05-09 10:47:45 [localhost-startStop-1] FINE: DBSubsystem: init() mEnableSerialMgmt=false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Creating LdapBoundConnFactor(DBSubsystem) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Setting internaldb.basedn=o=ipaca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapBoundConnFactory: init 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapBoundConnFactory:doCloning true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapAuthInfo: init() 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapAuthInfo: init begins 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapAuthInfo: init ends 2018-05-09 10:47:45 [localhost-startStop-1] FINE: init: before makeConnection errorIfDown is true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: makeConnection: errorIfDown true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: TCP Keep-Alive: true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SSLClientCertificateSelectionCB: Setting desired cert nickname to: subsystemCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapJssSSLSocket: set client auth cert nickname subsystemCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SSLClientCertificatSelectionCB: Entering! 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Candidate cert: Server-Cert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Candidate cert: auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Candidate cert: subsystemCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SSLClientCertificateSelectionCB: desired cert found in list: subsystemCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SSL handshake happened 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Established LDAP connection with SSL client auth to prime.ipa.kkgpitt.org:636 2018-05-09 10:47:45 [localhost-startStop-1] FINE: initializing with mininum 3 and maximum 15 connections to host prime.ipa.kkgpitt.org port 636, secure connection, true, authentication type 2 2018-05-09 10:47:45 [localhost-startStop-1] FINE: increasing minimum connections by 3 2018-05-09 10:47:45 [localhost-startStop-1] FINE: new total available connections 3 2018-05-09 10:47:45 [localhost-startStop-1] FINE: new number of connections 3 2018-05-09 10:47:45 [localhost-startStop-1] FINE: registered: false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: restart at autoShutdown? false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: autoShutdown crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: found cert:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: done init id=dbs 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initialized dbs 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initSubsystem id=usrgrp 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: ready to init id=usrgrp 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Creating LdapBoundConnFactor(UGSubsystem) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapBoundConnFactory: init 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapBoundConnFactory:doCloning true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapAuthInfo: init() 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapAuthInfo: init begins 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapAuthInfo: init ends 2018-05-09 10:47:45 [localhost-startStop-1] FINE: init: before makeConnection errorIfDown is false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: makeConnection: errorIfDown false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: TCP Keep-Alive: true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SSLClientCertificateSelectionCB: Setting desired cert nickname to: subsystemCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapJssSSLSocket: set client auth cert nickname subsystemCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SSL handshake happened 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Established LDAP connection with SSL client auth to prime.ipa.kkgpitt.org:636 2018-05-09 10:47:45 [localhost-startStop-1] FINE: initializing with mininum 3 and maximum 15 connections to host prime.ipa.kkgpitt.org port 636, secure connection, true, authentication type 2 2018-05-09 10:47:45 [localhost-startStop-1] FINE: increasing minimum connections by 3 2018-05-09 10:47:45 [localhost-startStop-1] FINE: new total available connections 3 2018-05-09 10:47:45 [localhost-startStop-1] FINE: new number of connections 3 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: restart at autoShutdown? false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: autoShutdown crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: found cert:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: done init id=usrgrp 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initialized usrgrp 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initSubsystem id=registry 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: ready to init id=registry 2018-05-09 10:47:45 [localhost-startStop-1] FINE: RegistrySubsystem: start init 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profile caEnrollImpl Generic Certificate Enrollment Profile Certificate Authority Generic Certificate Enrollment Profile com.netscape.cms.profile.common.CAEnrollProfile 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profile caCACertEnrollImpl CA Certificate Enrollment Profile Certificate Authority CA Certificate Enrollment Profile com.netscape.cms.profile.common.CACertCAEnrollProfile 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profile caServerCertEnrollImpl Server Certificate Enrollment Profile Certificate Authority Server Certificate Enrollment Profile com.netscape.cms.profile.common.ServerCertCAEnrollProfile 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profile caUserCertEnrollImpl User Certificate Enrollment Profile Certificate Authority User Certificate Enrollment Profile com.netscape.cms.profile.common.UserCertCAEnrollProfile 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy noDefaultImpl No Default No Default com.netscape.cms.profile.def.NoDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy genericExtDefaultImpl Generic Extension Generic Extension com.netscape.cms.profile.def.GenericExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy autoAssignDefaultImpl Auto Request Assignment Default Auto Request Assignment Default com.netscape.cms.profile.def.AutoAssignDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy subjectNameDefaultImpl Subject Name Default Subject Name Default com.netscape.cms.profile.def.SubjectNameDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy validityDefaultImpl Validity Default Validty Default com.netscape.cms.profile.def.ValidityDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy randomizedValidityDefaultImpl Randomized Validity Default Randomized Validity Default com.netscape.cms.profile.def.RandomizedValidityDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy caValidityDefaultImpl CA Certificate Validity Default CA Certificate Validty Default com.netscape.cms.profile.def.CAValidityDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy subjectKeyIdentifierExtDefaultImpl Subject Key Identifier Default Subject Key Identifier Default com.netscape.cms.profile.def.SubjectKeyIdentifierExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy authorityKeyIdentifierExtDefaultImpl Authority Key Identifier Extension Default Authority Key Identifier Extension Default com.netscape.cms.profile.def.AuthorityKeyIdentifierExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy basicConstraintsExtDefaultImpl Basic Constraints Extension Default Basic Constraints Extension Default com.netscape.cms.profile.def.BasicConstraintsExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy keyUsageExtDefaultImpl Key Usage Extension Default Key Usage Extension Default com.netscape.cms.profile.def.KeyUsageExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy nsCertTypeExtDefaultImpl Netscape Certificate Type Extension Default Netscape Certificate Type Extension Default com.netscape.cms.profile.def.NSCertTypeExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy extendedKeyUsageExtDefaultImpl Extended Key Usage Extension Default Extended Key Usage Extension Default com.netscape.cms.profile.def.ExtendedKeyUsageExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy ocspNoCheckExtDefaultImpl OCSP No Check Extension Default OCSP No Check Extension Default com.netscape.cms.profile.def.OCSPNoCheckExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy issuerAltNameExtDefaultImpl Issuer Alternative Name Extension Default Issuer Alternative Name Extension Default com.netscape.cms.profile.def.IssuerAltNameExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy subjectAltNameExtDefaultImpl Subject Alternative Name Extension Default Subject Alternative Name Extension Default com.netscape.cms.profile.def.SubjectAltNameExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy userSubjectNameDefaultImpl User Supplied Subject Name Default User Supplied Subject Name Default com.netscape.cms.profile.def.UserSubjectNameDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy cmcUserSignedSubjectNameDefaultImpl CMC User Signed Subject Name Default CMC User Signed Subject Name Default com.netscape.cms.profile.def.CMCUserSignedSubjectNameDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy signingAlgDefaultImpl Signing Algorithm Default Signing Algorithm Default com.netscape.cms.profile.def.SigningAlgDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy userKeyDefaultImpl User Supplied Key Default User Supplied Key Default com.netscape.cms.profile.def.UserKeyDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy userValidityDefaultImpl User Supplied Validity Default User Supplied Validity Default com.netscape.cms.profile.def.UserValidityDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy userExtensionDefaultImpl User Supplied Extension Default User Supplied Extension Default com.netscape.cms.profile.def.UserExtensionDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy userSigningAlgDefaultImpl User Supplied Signing Alg Default User Supplied Signing Alg Default com.netscape.cms.profile.def.UserSigningAlgDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy authTokenSubjectNameDefaultImpl Token Supplied Subject Name Default Token Supplied Subject Name Default com.netscape.cms.profile.def.AuthTokenSubjectNameDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy subjectInfoAccessExtDefaultImpl Subject Info Access Extension Default Subject Info Access Extension Default com.netscape.cms.profile.def.SubjectInfoAccessExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy authInfoAccessExtDefaultImpl Authority Info Access Extension Default Authority Info Access Extension Default com.netscape.cms.profile.def.AuthInfoAccessExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy nscCommentExtDefaultImpl Netscape Comment Extension Default Netscape Comment Extension Default com.netscape.cms.profile.def.NSCCommentExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy freshestCRLExtDefaultImpl Freshest CRL Extension Default Freshest CRL Extension Default com.netscape.cms.profile.def.FreshestCRLExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy crlDistributionPointsExtDefaultImpl CRL Distribution Points Extension Default CRL Distribution Points Extension Default com.netscape.cms.profile.def.CRLDistributionPointsExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy policyConstraintsExtDefaultImpl Policy Constraints Extension Default Policy Constraints Extension Default com.netscape.cms.profile.def.PolicyConstraintsExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy policyMappingsExtDefaultImpl Policy Mappings Extension Default Policy Mappings Extension Default com.netscape.cms.profile.def.PolicyMappingsExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy nameConstraintsExtDefaultImpl Name Constraints Extension Default Name Constraints Extension Default com.netscape.cms.profile.def.NameConstraintsExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy certificateVersionDefaultImpl Certificate Version Default Certificate Version Default com.netscape.cms.profile.def.CertificateVersionDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy certificatePoliciesExtDefaultImpl Certificate Policies Extension Default Certificate Policies Extension Default com.netscape.cms.profile.def.CertificatePoliciesExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy subjectDirAttributesExtDefaultImpl Subject Directory Attributes Extension Default Subject Directory Attributes Extension Default com.netscape.cms.profile.def.SubjectDirAttributesExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy privateKeyPeriodExtDefaultImpl Private Key Period Ext Default Private Key Period Ext Default com.netscape.cms.profile.def.PrivateKeyUsagePeriodExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy inhibitAnyPolicyExtDefaultImpl Inhibit Any-Policy Extension Default Inhibit Any-Policy Extension Default com.netscape.cms.profile.def.InhibitAnyPolicyExtDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy imageDefaultImpl Image Default Image Default com.netscape.cms.profile.def.ImageDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy nsTokenDeviceKeySubjectNameDefaultImpl nsTokenDeviceKeySubjectNameDefault nsTokenDeviceKeySubjectNameDefaultImpl com.netscape.cms.profile.def.nsTokenDeviceKeySubjectNameDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy nsTokenUserKeySubjectNameDefaultImpl nsTokenUserKeySubjectNameDefault nsTokenUserKeySubjectNameDefaultImpl com.netscape.cms.profile.def.nsTokenUserKeySubjectNameDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy authzRealmDefaultImpl Authz Realm Default Authz Realm Default com.netscape.cms.profile.def.AuthzRealmDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin defaultPolicy commonNameToSANDefaultImpl Copy Common Name to Subject Alternative Name Copy Common Name to Subject Alternative Name com.netscape.cms.profile.def.CommonNameToSANDefault 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy noConstraintImpl No Constraint No Constraint com.netscape.cms.profile.constraint.NoConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy subjectNameConstraintImpl Subject Name Constraint Subject Name Constraint com.netscape.cms.profile.constraint.SubjectNameConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy uniqueSubjectNameConstraintImpl Unique Subject Name Constraint Unique Subject Name Constraint com.netscape.cms.profile.constraint.UniqueSubjectNameConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy userSubjectNameConstraintImpl User Subject Name Constraint User Subject Name Constraint com.netscape.cms.profile.constraint.UserSubjectNameConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy cmcUserSignedSubjectNameConstraintImpl CMC User Subject Name Constraint CMC User Subject Name Constraint com.netscape.cms.profile.constraint.CMCUserSignedSubjectNameConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy caValidityConstraintImpl CA Validity Constraint CA Validity Constraint com.netscape.cms.profile.constraint.CAValidityConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy validityConstraintImpl Validity Constraint Validity Constraint com.netscape.cms.profile.constraint.ValidityConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy keyUsageExtConstraintImpl Key Usage Extension Constraint Key Usage Extension Constraint com.netscape.cms.profile.constraint.KeyUsageExtConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy nsCertTypeExtConstraintImpl Netscape Certificate Type Extension Constraint Netscape Certificate Type Extension Constraint com.netscape.cms.profile.constraint.NSCertTypeExtConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy extendedKeyUsageExtConstraintImpl Extended Key Usage Extension Constraint Extended Key Usage Extension Constraint com.netscape.cms.profile.constraint.ExtendedKeyUsageExtConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy keyConstraintImpl Key Constraint Key Constraint com.netscape.cms.profile.constraint.KeyConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy basicConstraintsExtConstraintImpl Basic Constraints Extension Constraint Basic Constraints Extension Constraint com.netscape.cms.profile.constraint.BasicConstraintsExtConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy extensionConstraintImpl Extension Constraint Extension Constraint com.netscape.cms.profile.constraint.ExtensionConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy signingAlgConstraintImpl Signing Algorithm Constraint Signing Algorithm Constraint com.netscape.cms.profile.constraint.SigningAlgConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy uniqueKeyConstraintImpl Unique Public Key Constraint Unique Public Key Constraint com.netscape.cms.profile.constraint.UniqueKeyConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy renewGracePeriodConstraintImpl Renewal Grace Period Constraint Renewal Grace Period Constraint com.netscape.cms.profile.constraint.RenewGracePeriodConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy authzRealmConstraintImpl Authz Realm Constraint Authz Realm Constraint com.netscape.cms.profile.constraint.AuthzRealmConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin constraintPolicy externalProcessConstraintImpl External Process Constraint External Process Constraint com.netscape.cms.profile.constraint.ExternalProcessConstraint 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput cmcCertReqInputImpl CMC Certificate Request Input CMC Certificate Request Input com.netscape.cms.profile.input.CMCCertReqInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput certReqInputImpl Certificate Request Input Certificate Request Input com.netscape.cms.profile.input.CertReqInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput keyGenInputImpl Key Generation Input Key Generation Input com.netscape.cms.profile.input.KeyGenInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput encKeyGenInputImpl Encryption Key Generation Input Encryption Key Generation Input com.netscape.cms.profile.input.EncryptionKeyGenInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput signKeyGenInputImpl Encryption Key Generation Input Encryption Key Generation Input com.netscape.cms.profile.input.SigningKeyGenInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput dualKeyGenInputImpl Dual Key Generation Input Dual Key Generation Input com.netscape.cms.profile.input.DualKeyGenInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput subjectNameInputImpl Subject Name Input Subject Name Input com.netscape.cms.profile.input.SubjectNameInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput submitterInfoInputImpl Submitter Information Input Submitter Information Input com.netscape.cms.profile.input.SubmitterInfoInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput genericInputImpl Generic Input Generic Input com.netscape.cms.profile.input.GenericInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput fileSigningInputImpl File Signing Input File Signing Input com.netscape.cms.profile.input.FileSigningInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput imageInputImpl Image Input Image Input com.netscape.cms.profile.input.ImageInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput subjectDNInputImpl Subject DN Input Subject DN Input com.netscape.cms.profile.input.SubjectDNInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput nsNKeyCertReqInputImpl nsNKeyCertReqInputImpl nsNKeyCertReqInputImpl com.netscape.cms.profile.input.nsNKeyCertReqInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput nsHKeyCertReqInputImpl nsHKeyCertReqInputImpl nsHKeyCertReqInputImpl com.netscape.cms.profile.input.nsHKeyCertReqInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput serialNumRenewInputImpl Certificate Renewal Request Serial Number Input Certificate Renewal Request Serial Number Input com.netscape.cms.profile.input.SerialNumRenewInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileInput subjectAltNameExtInputImpl SAN Input SAN Input com.netscape.cms.profile.input.SubjectAltNameExtInput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileOutput certOutputImpl Certificate Output Certificate Output com.netscape.cms.profile.output.CertOutput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileOutput cmmfOutputImpl CMMF Response Output CMMF Response Output com.netscape.cms.profile.output.CMMFOutput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileOutput pkcs7OutputImpl PKCS7 Output PKCS7 Output com.netscape.cms.profile.output.PKCS7Output 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileOutput nsNKeyOutputImpl nsNKeyOutputImpl nsNKeyOutputImpl com.netscape.cms.profile.output.nsNKeyOutput 2018-05-09 10:47:45 [localhost-startStop-1] FINE: added plugin profileUpdater subsystemGroupUpdaterImpl Updater for Subsystem Group Updater for Subsystem Group com.netscape.cms.profile.updater.SubsystemGroupUpdater 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: restart at autoShutdown? false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: autoShutdown crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: found cert:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: done init id=registry 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initialized registry 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initSubsystem id=oidmap 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: ready to init id=oidmap 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: restart at autoShutdown? false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: autoShutdown crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: found cert:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: done init id=oidmap 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initialized oidmap 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initSubsystem id=X500Name 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: ready to init id=X500Name 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: restart at autoShutdown? false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: autoShutdown crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: found cert:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: done init id=X500Name 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initialized X500Name 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initSubsystem id=request 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: ready to init id=request 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: restart at autoShutdown? false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: autoShutdown crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: found cert:auditSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: done init id=request 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initialized request 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: initSubsystem id=ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CMSEngine: ready to init id=ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CertificateAuthority.init(MAIN, ca) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Creating LdapBoundConnFactor(CertificateAuthority) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapBoundConnFactory: init 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapBoundConnFactory:doCloning true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapAuthInfo: init() 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapAuthInfo: init begins 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapAuthInfo: init ends 2018-05-09 10:47:45 [localhost-startStop-1] FINE: init: before makeConnection errorIfDown is false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: makeConnection: errorIfDown false 2018-05-09 10:47:45 [localhost-startStop-1] FINE: TCP Keep-Alive: true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SSLClientCertificateSelectionCB: Setting desired cert nickname to: subsystemCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: LdapJssSSLSocket: set client auth cert nickname subsystemCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SSL handshake happened 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Established LDAP connection with SSL client auth to prime.ipa.kkgpitt.org:636 2018-05-09 10:47:45 [localhost-startStop-1] FINE: initializing with mininum 3 and maximum 15 connections to host prime.ipa.kkgpitt.org port 636, secure connection, true, authentication type 2 2018-05-09 10:47:45 [localhost-startStop-1] FINE: increasing minimum connections by 3 2018-05-09 10:47:45 [localhost-startStop-1] FINE: new total available connections 3 2018-05-09 10:47:45 [localhost-startStop-1] FINE: new number of connections 3 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Cert Repot inited 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CRL Repot inited 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Replica Repot inited 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CertificateAuthority:initSigUnit: ca cert found 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CertificateAuthority: initSigUnit 1- setting mIssuerObj and mSubjectObj 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CA SigningUnit.init(ca, ca.signing, null) 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Setting ca.signing.newNickname=caSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SigningUnit: Logging into token Internal Key Storage Token 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SigningUnit: Loading certificate caSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: SigningUnit: Unable to find certificate caSigningCert cert-pki-ca 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CA signing key and cert not (yet) present in NSSDB 2018-05-09 10:47:45 [localhost-startStop-1] FINE: null authorityID -> host authority; not starting KeyRetriever 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CertificateAuthority init: initRequestQueue 2018-05-09 10:47:45 [localhost-startStop-1] FINE: selected policy processor = classic 2018-05-09 10:47:45 [localhost-startStop-1] FINE: GenericPolicyProcessor::init begins 2018-05-09 10:47:45 [localhost-startStop-1] FINE: GenericPolicyProcessor::init Certificate Policy Framework (deprecated) is DISABLED 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CA policy inited 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CA service inited 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CA notifier inited 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CA pending notifier inited 2018-05-09 10:47:45 [localhost-startStop-1] FINE: RequestRepository: constructor2. 2018-05-09 10:47:45 [localhost-startStop-1] FINE: In setCertStatusUpdateInterval 600 2018-05-09 10:47:45 [localhost-startStop-1] FINE: In setCertStatusUpdateInterval listenToCloneModifications=true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: In setCertStatusUpdateInterval listening to modifications 2018-05-09 10:47:45 [localhost-startStop-1] FINE: In setCertStatusUpdateInterval scheduling cert status update every 600 seconds. 2018-05-09 10:47:45 [RetrieveModificationsTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [RetrieveModificationsTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [RetrieveModificationsTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [RetrieveModificationsTask] FINE: getConn: mNumConns now 2 2018-05-09 10:47:45 [RetrieveModificationsTask] FINE: Starting persistent search. 2018-05-09 10:47:45 [localhost-startStop-1] FINE: In setCertStatusUpdateInterval 600 2018-05-09 10:47:45 [localhost-startStop-1] FINE: In setSerialNumberUpdateInterval scheduling serial number update every 600 seconds. 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: About to start updateCertStatus 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: Starting updateCertStatus (entered lock) 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In updateCertStatus() 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: mNumConns now 1 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getInvalidCertificatesByNotBeforeDate filter (certStatus=INVALID) 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getInvalidCertificatesByNotBeforeDate: about to call findCertRecordsInList 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: mNumConns now 0 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In findCertRecordsInListRawJumpto with Jumpto 20180509104745Z 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=INVALID) attrs: [objectclass, certRecordId, x509cert] pageSize -200 startFrom 20180509104745Z 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CertificateFactory Type : X.509 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CertificateFactory Provider : SUN (DSA key/parameter generation; DSA signing; SHA-1, MD5 digests; SecureRandom; X.509 certificates; JKS & DKS keystores; PKIX CertPathValidator; PKIX CertPathBuilder; LDAP, Collection CertStores, JavaPolicy Policy; JavaLoginConfig Configuration) 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: About to start updateSerialNumbers 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Starting updateSerialNumbers (entered lock) 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository: updateCounter mEnableRandomSerialNumbers=false mCounter=null 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: increasing minimum connections by 3 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: new total available connections 6 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: new number of connections 3 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: getConn: mNumConns now 2 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: getSerialNumber() 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Setting ca.publish.publisher.instance.FileBaseCRLPublisher.directory=/var/lib/ipa/pki-ca/publish 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: returnConn: mNumConns now 3 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In getInvalidCertsByNotBeforeDate finally. 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: returnConn: mNumConns now 4 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: searching for entry 20180509104745Z 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList.getEntries() 2018-05-09 10:47:45 [RetrieveModificationsTask] FINE: Waiting for next result. 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: returnConn: mNumConns now 5 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: getSerialNumber serial=1 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: entries: 0 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: top: 0 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: size: 0 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: index may be empty 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: mNumConns now 4 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getValidCertsByNotAfterDate filter (certStatus=VALID) 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: mNumConns now 3 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In findCertRecordsInListRawJumpto with Jumpto 20180509104745Z 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=VALID) attrs: [objectclass, certRecordId, x509cert] pageSize -200 startFrom 20180509104745Z 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: returnConn: mNumConns now 4 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: returnConn: mNumConns now 5 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: searching for entry 20180509104745Z 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository:setSerialNumber 2 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: in InitCache 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: Instance of Certificate Repository. 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: minSerial:1 maxSerial: 10000000 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: nextMinSerial: nextMaxSerial: 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: increment:10000000 lowWaterMark: 2000000 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository: in getLastSerialNumberInRange: low 1 high 268435456 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: getConn: mNumConns now 4 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList.getEntries() 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Releasing ldap connection 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: returnConn: mNumConns now 5 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: DBSubsystem: getEntryAttribute: dn=ou=certificateRepository, ou=ca, o=ipaca attr=description:; 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository: getLastSerialNumberInRange mEnableRandomSerialNumbers=false mMinRandomBitLength=4 CollisionRecovery=3,10 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository: getLastSerialNumberInRange modeChange=false enableRsnAtConfig=false mForceModeChange=false mode= 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Setting dbs.randomSerialNumberCounter=-1 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: entries: 1 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: top: 0 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: size: 10 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: transidValidCertificates: list size: 10 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: transitValidCertificates: ltSize 1 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: Record does not qualify,notAfter Mon Apr 27 10:58:21 EDT 2020 date Wed May 09 10:47:45 EDT 2018 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: transitCertList EXPIRED 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: mNumConns now 4 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getRevokedCertificatesByNotAfterDate filter (certStatus=REVOKED) 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getRevokedCertificatesByNotAfterDate: about to call findCertRecordsInList 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: getConn: mNumConns now 3 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In findCertRecordsInListRawJumpto with Jumpto 20180509104745Z 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=REVOKED) attrs: [objectclass, certRevokedOn, certRecordId, certRevoInfo, notAfter, x509cert] pageSize -200 startFrom 20180509104745Z 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: returnConn: mNumConns now 4 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: returnConn: mNumConns now 5 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: searching for entry 20180509104745Z 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList.getEntries() 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: entries: 0 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: top: 0 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: DBVirtualList: size: 0 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: index may be empty 2018-05-09 10:47:45 [CertStatusUpdateTask] FINE: updateCertStatus done 2018-05-09 10:47:45 [localhost-startStop-1] FINE: PublisherProcessor: startup() 2018-05-09 10:47:45 [localhost-startStop-1] FINE: No LdapPublishing enabled 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository: getLastSerialNumberInRange mEnableRandomSerialNumbers=false 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: getConn: mNumConns now 4 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: In findCertRecordsInList with Jumpto 268435456 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=*) attrs: null pageSize -5 startFrom 09268435456 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: returnConn: mNumConns now 5 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: DBVirtualList: searching for entry 09268435456 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: DBVirtualList.getEntries() 2018-05-09 10:47:45 [localhost-startStop-1] FINE: PublisherProcessor: startup: Publishing Queue Enabled: true Priority Level: 0 Maximum Number of Threads: 3 Page Size: 40 2018-05-09 10:47:45 [localhost-startStop-1] FINE: setPublishingQueue: Publishing Queue Enabled: true Priority Level: 0 Maximum Number of Threads: 3 Page Size: 40 2018-05-09 10:47:45 [localhost-startStop-1] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [localhost-startStop-1] FINE: masterConn is connected: true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [localhost-startStop-1] FINE: getConn: mNumConns now 4 2018-05-09 10:47:45 [localhost-startStop-1] FINE: returnConn: mNumConns now 5 2018-05-09 10:47:45 [localhost-startStop-1] FINE: RequestRepository: getPublishingStatus mBaseDN: ou=ca,ou=requests,o=ipaca status: -1 2018-05-09 10:47:45 [localhost-startStop-1] FINE: Publishing inited 2018-05-09 10:47:45 [localhost-startStop-1] FINE: initializing crl issue point MasterCRL 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CRL Page Size: 100 2018-05-09 10:47:45 [localhost-startStop-1] FINE: getTimeListSize: ListSize=1 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CRLIssuingPoint:initConfig: mUnexpectedExceptionWaitTime set to 1800000 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: DBVirtualList: entries: 6 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: DBVirtualList: top: 4 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: DBVirtualList: size: 10 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository:getLastSerialNumberInRange: recList size 10 2018-05-09 10:47:45 [localhost-startStop-1] FINE: CRLIssuingPoint:initConfig: mUnexpectedExceptionLoopMax set to 10 2018-05-09 10:47:45 [localhost-startStop-1] WARNING: java.lang.NullPointerException at com.netscape.ca.CRLIssuingPoint.initConfig(CRLIssuingPoint.java:752) at com.netscape.ca.CRLIssuingPoint.init(CRLIssuingPoint.java:485) at com.netscape.ca.CertificateAuthority.initCRL(CertificateAuthority.java:2271) at com.netscape.ca.CertificateAuthority.init(CertificateAuthority.java:634) at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1059) at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:965) at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:581) at com.netscape.certsrv.apps.CMS.init(CMS.java:191) at com.netscape.certsrv.apps.CMS.start(CMS.java:1606) at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:117) at javax.servlet.GenericServlet.init(GenericServlet.java:158) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123) at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1132) at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1091) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:983) at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4939) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5249) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:754) at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:150) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:140) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:728) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734) at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:629) at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1839) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository:getLastSerialNumberInRange: ltSize 10 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository:getLastCertRecordSerialNo: serialno 10 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: getLastSerialNumberInRange returning: 10 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: mLastSerialNo: 10 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: In LdapBoundConnFactory::getConn() 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: masterConn is connected: true 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: getConn: conn is connected true 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: getConn: mNumConns now 4 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Releasing ldap connection 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: returnConn: mNumConns now 5 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: DBSubsystem: getEntryAttribute: dn=ou=certificateRepository, ou=ca, o=ipaca attr=description:; 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository: updateCounter mEnableRandomSerialNumbers=false 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository: updateCounter CertificateRepositoryMode = 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository: updateCounter modeChange=false 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: CertificateRepository: UpdateCounter mEnableRandomSerialNumbers=false mCounter=-1 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Starting cert checkRanges 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: Serial Management not enabled. Returning .. 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Starting request checkRanges 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: Repository: Serial Management not enabled. Returning .. 2018-05-09 10:47:45 [SerialNumberUpdateTask] FINE: updateSerialNumbers done 2018-05-09 10:47:45 [http-nio-8080-exec-1] FINE: according to ccMode, authorization for servlet: caGetStatus is LDAP based, not XML {1}, use default authz mgr: {2}. 2018-05-09 10:47:45 [http-nio-8080-exec-1] SEVERE: Servlet.service() for servlet [caGetStatus] in context with path [/ca] threw exception java.io.IOException: CS server is not ready to serve. at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:442) at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:225) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496) at com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:650) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) 2018-05-09 10:47:46 [http-nio-8080-exec-3] SEVERE: Servlet.service() for servlet [caGetStatus] in context with path [/ca] threw exception java.io.IOException: CS server is not ready to serve. at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:442) at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:225) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496) at com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:650) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) 2018-05-09 10:47:47 [http-nio-8080-exec-4] SEVERE: Servlet.service() for servlet [caGetStatus] in context with path [/ca] threw exception java.io.IOException: CS server is not ready to serve. at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:442) at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:225) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security

1 0

ipa replication issues
by Sandor Juhasz 09 May '18

09 May '18

Hello, we are using freeipa in a 4way multi master replication setup. Servers ipa14,ipa15 and ipa34,ipa35 on CentOS Linux release 7.3.1611 (Core) with version ipa-server-common-4.4.0-14.el7.centos.7.noarch. We have an issue where one of the servers log a missing CSN. It happens even after ipa replication reinitialized. We are guessing that CSN 5a0a27d9000000060000 only exists on ipa35, but we see it in those files listed on ipa15 and the error is reported there. Please see attached file with logs. How can we fix this? -- *Sándor Juhász* System Administrator *ChemAxon* *Ltd*. Building Hx, GraphiSoft Park, Záhony utca 7, Budapest, Hungary, H-1031 Cell: +36704258964

2 4

DS server crashes regularly
by Bart 09 May '18

09 May '18

Hi all, I have set up FreeIPA server and replica, bunch of client servers and established trust with an AD domain. In the very beginning everything seemed to be working correctly. Unfortunately, after a while it appears that 389 directory server crashes on both instances - once it crashes on one, it crashes on the other in a couple of seconds/minutes. I enabled core dumps and collected them but I can't grasp what's going on there. It seems that it happens when I try to execute su - on one of the client instances after servers restart. I followed the steps devoted to DS server described here: https://www.freeipa.org/page/Troubleshooting but to no avail. I've just created a bug in 389 directory server mailing list: https://pagure.io/389-ds-base/issue/49660, but wanted to try to find out here if there is anything else I can try at this stage. Thank you in advance for you help, Bart

2 2

Host is enrolled and installed
by Lachlan Musicman 09 May '18

09 May '18

Not 100% sure where to send this. Am trying to write an Ansible playbook to install SSSD and enroll the host in a domain. The problem starts when the host exists in the domain and ipa-client is already installed. We can use Ansible's delegate module to remove host from domain enrollment (would be more ideal to test if it's enrolled, then unenroll if test returns true). And we can use ipa-client-install --uninstall to if ipa-client is already configured. But neither of these commands provide easy answers quickly. ipa host-find {{ host }} | grep matched | cut -d " " -f 1 will turn ipa host-find into something usable. A switch that just returned the number matched would be ideal, but it's workable currently. More interestingly, once a host is unenrolled from the domain (ie, ipa host-del <host> runs successfully on the IPA server), it doesn't, and probably shouldn't, uninstall ipa-client on the host itself. But there doesn't seem to be any way to check ipa-client --install/--uninstall for it's opposite. IE, if ipa-client is installed, and is run again, one is urged to uninstall first: IPA client is already configured on this system. If you want to reinstall the IPA client, uninstall it first using 'ipa-client-install --uninstall'. The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information if ipa-client is not installed, and you run ipa-client --uninstall The message returned is: IPA client is not configured on this system. The ipa-client-install command failed. See /var/log/ipaclient-uninstall.log for more information Have I missed a true/false return value cli arg for ipa-client-install? ipa-client-install --exists ipa-client-install --configured or something like that? Am I making hard work of something that is relatively straight forward and solved elsewhere but I've missed? Ansible has "ignore_errors: True" available, but I feel that is a weak get out of jail free card. Given that this is authentication and authorization, errors shouldn't be ignored (opinion). cheers L. ------ "The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics is the insistence that we cannot ignore the truth, nor should we panic about it. It is a shared consciousness that our institutions have failed and our ecosystem is collapsing, yet we are still here — and we are creative agents who can shape our destinies. Apocalyptic civics is the conviction that the only way out is through, and the only way through is together. " *Greg Bloom* @greggish https://twitter.com/greggish/status/873177525903609857

3 7

After using 3rd party certs (Let's Encrypt) : pki-tomcatd fails to restart
by Henery Hawk 08 May '18

08 May '18

I've followed what I thought were the instructions to install Let's Encrypt certs on my recent FreeIPA installation but when I restart the services I pki-tomcatd fails to restart. During the installs I've tried various combinations of installing the CA certs but they all seem to result in the same problem Logs are below and I tried to format to make it easier to read but I'm afraid this submission will lose formatting. Any help would be greatly appreciated. Prior to these steps the instance runs fine but requires browser user to accept the security exception. Joe [root@prime]# cd /etc/letsencrypt/live/my.domain.org/ # I got LE certs separately using certbot & nginx [root@prime]# ls cert.pem README chain.pem fullchain.pem privkey.pem [root@prime]# kinit admin Password for admin(a)MY.DOMAIN.ORG: [root@prime]# sudo vi DTSRootCAX3.pem #get from https://www.identrust.com/certificates/trustid/root-download-x3.html [root@prime]# # I got this from the Let's Encyrpt web site ISRG Root X1 (self-signed) [root@prime]# curl --output ISRG_Root_X1.crt https://letsencrypt.org/certs/isrgrootx1.pem.txt [root@prime]# # I got this from the Let's Encyrpt web site Let’s Encrypt Authority X3 (IdenTrust cross-signed) [root@prime]# curl --output LetsEncryptX3CrossSigned.crt https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt [root@prime]# # I got this from the Let's Encyrpt web site Let’s Encrypt Authority X3 (Signed by ISRG Root X1) [root@prime]# curl --output LetsEncryptAuthX3a.crt https://letsencrypt.org/certs/letsencryptauthorityx3.pem.txt [root@prime]# ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem Installing CA certificate, please wait CA certificate successfully installed The ipa-cacert-manage command was successful [root@prime]# ipa-cacert-manage -n ISRG_Root_X1 -t C,, install ISRG_Root_X1.crt Installing CA certificate, please wait CA certificate successfully installed The ipa-cacert-manage command was successful [root@prime]# ipa-cacert-manage -n LetsEncryptX3CrossSigned -t C,, install LetsEncryptX3CrossSigned.crt Installing CA certificate, please wait CA certificate successfully installed The ipa-cacert-manage command was successful [root@prime]# ipa-cacert-manage -n LetsEncryptAuthX3a -t C,, install LetsEncryptAuthX3a.crt Installing CA certificate, please wait CA certificate successfully installed The ipa-cacert-manage command was successful [root@prime]# ipa-cacert-manage -n LetsEncryptX3 -t C,, install chain.pem # this fails Installing CA certificate, please wait Failed to get LetsEncryptX3 The ipa-cacert-manage command failed. [root@prime]# ipa-certupdate trying https://my.domain.org/ipa/json [try 1]: Forwarding 'ca_is_enabled/1' to json server 'https://my.domain.org/ipa/json' [try 1]: Forwarding 'ca_find/1' to json server 'https://my.domain.org/ipa/json' Systemwide CA database updated. Systemwide CA database updated. The ipa-certupdate command was successful [root@prime]# ipa-server-certinstall -w fullchain.pem privkey.pem Directory Manager password: Enter private key unlock password: Please restart ipa services after installing certificate (ipactl restart) The ipa-server-certinstall command was successful [root@prime]# ipactl restart Stopping pki-tomcatd Service Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting named Service Restarting httpd Service Restarting ipa-custodia Service Restarting ntpd Service Restarting pki-tomcatd Service Failed to restart pki-tomcatd Service Shutting down Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed Aborting ipactl [root@prime]# certutil -L -d /etc/pki/pki-tomcat/alias/ Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI IPA.KKGPITT.ORG IPA CA CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu Server-Cert cert-pki-ca u,u,u DSTRootCAX3 C,, ISRG_Root_X1 C,, LetsEncryptX3CrossSigned C,, LetsEncryptX3CrossSigned C,,

2 1

Seeking advice on testing ipa internal certificate renewal
by Roderick Johnstone 08 May '18

08 May '18

Hi In our current ipa implementation some of the ipa internal certificates are not able to be renewed correctly. After a lot of support both from Redhat and also through this list, neither of which was able to fix the issue, I was advised by Redhat to implement a new instance of ipa and migrate to it. I now have the new ipa instance running on RHEL7 servers, but before migrating clients and users to it would like to test that the ipa certificate renewal will work correctly. However, I don't want to break the new instance! I've read chapters 24 and 26 of the Linux Domain Identity, Authentication and Policy guide and I'm not sure either are relevant to renewing eg 'ocspSigningCert cert-pki-ca', which was one of the ones I was having problems with before. In trying to fix the current ipa implementation we have been using eg 'getcert resubmit -i <id>' where <id> is the id of the 'ocspSigningCert cert-pki-ca' certificate as shown by 'getcert list'. Is 'getcert resubmit -i <id>' a sensible way to test renewing a certificate manually in a working ipa instance? Do I need to do anything else to propagate the new certificate to the replica? Do I need to explicitly revoke the old certificate, if so how? Thanks. Roderick Johnstone

2 1

named crashes on start; lib/dns-pkcs11/view.c:962: REQUIRE(view->zonetable != ((void *)0)) failed
by Timo Aaltonen 08 May '18

08 May '18

Hi, Named is crashing here on start, but not if I disable the dyndb part of named.conf. So I assume it's not getting data out of ldap correctly (or correct data), and this from slapd logs might suggest so: [05/May/2018:09:42:02.566222364 +0300] conn=23 op=3 SRCH base="cn=dns,dc=foo,dc=bar" scope=2 filter="(|(objectClass=idnsConfigObject)(&(objectClass=idnsServerConfigObject)(idnsServerId=host.foo.bar)))" attrs=ALL [05/May/2018:09:42:02.568886490 +0300] conn=23 op=3 RESULT err=0 tag=101 nentries=2 etime=0.0002800470 [05/May/2018:09:42:02.715423436 +0300] conn=24 op=-1 fd=96 closed - B1 [05/May/2018:09:42:02.716084255 +0300] conn=23 op=-1 fd=95 closed error 104 (Connection reset by peer) - TCP connection reset by peer. looking at the install logs everything seemed to go fine until it started named, and ldapsearch doesn't provide any hints either.. ubuntu 18.04 ipa 4.6.90.pre1+1b320ac3e7ab763 bind9 9.11.3 bind9-dyndb-ldap 11.1 -- t

2 4

Trust fails between IPA 4.5.4 and Samba AD DC 4.8.1 (MIT Kerberos) -- CIFS server denied credentials
by Nathan Brown 08 May '18

08 May '18

When trying to establish an AD trust between IPA 4.5.4 and Samba 4.8.1 (MIT Kerberos), it fails with the following error: [root@atlas5ipa samba]# ipa -vv trust-add ATLAS5.HPC --range-type=ipa-ad-trust --two-way=true --admin=Administrator --server dc.atlas5.hpc Active Directory domain administrator's password: ipa: ERROR: Insufficient access: CIFS server denied your credentials IPA Server Versions ------------------- root@atlas5ipa samba]# rpm -qa | grep ipa python2-ipaclient-4.5.4-10.el7.centos.noarch ipa-server-trust-ad-4.5.4-10.el7.centos.x86_64 python-ipaddress-1.0.16-2.el7.noarch python-libipa_hbac-1.16.0-19.el7.x86_64 sssd-ipa-1.16.0-19.el7.x86_64 ipa-server-4.5.4-10.el7.centos.x86_64 ipa-python-compat-4.5.4-10.el7.centos.noarch python-iniparse-0.4-9.el7.noarch ipa-common-4.5.4-10.el7.centos.noarch python2-ipaserver-4.5.4-10.el7.centos.noarch ipa-client-4.5.4-10.el7.centos.x86_64 ipa-server-dns-4.5.4-10.el7.centos.noarch libipa_hbac-1.16.0-19.el7.x86_64 ipa-server-common-4.5.4-10.el7.centos.noarch python2-ipalib-4.5.4-10.el7.centos.noarch ipa-client-common-4.5.4-10.el7.centos.noarch [root@atlas5ipa samba]# rpm -qa | grep samba samba-libs-4.7.1-6.el7.x86_64 samba-common-tools-4.7.1-6.el7.x86_64 samba-winbind-4.7.1-6.el7.x86_64 samba-client-libs-4.7.1-6.el7.x86_64 samba-4.7.1-6.el7.x86_64 samba-winbind-modules-4.7.1-6.el7.x86_64 samba-python-4.7.1-6.el7.x86_64 samba-common-libs-4.7.1-6.el7.x86_64 samba-common-4.7.1-6.el7.noarch Samba DC Server Versions ------------------------ Samba 4.8.1 compiled with MIT Kerberos against GNUTLS 3.5.0 Note: The IPA server and Samba AD server are running on separate VM's. Both have CentOS 7.3.1611 installed. Here are the last few lines in the /var/log/httpd/error_log file from the IPA server. You can see that information about both sides is being exchanged but it ends up failing. --- signed SMB2 message lsa_lsaRSetForestTrustInformation: struct lsa_lsaRSetForestTrustInformation out: struct lsa_lsaRSetForestTrustInformation collision_info : * collision_info : NULL result : NT_STATUS_OK rpc reply data: lsa_QueryTrustedDomainInfoByName: struct lsa_QueryTrustedDomainInfoByName in: struct lsa_QueryTrustedDomainInfoByName handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000016-0000-0000-f15a-25affc130000 trusted_domain : * trusted_domain: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'atlas5.hpc' level : LSA_TRUSTED_DOMAIN_INFO_FULL_INFO (8) signed SMB2 message lsa_QueryTrustedDomainInfoByName: struct lsa_QueryTrustedDomainInfoByName out: struct lsa_QueryTrustedDomainInfoByName info : * info : NULL result : NT_STATUS_OBJECT_NAME_NOT_FOUND lsa_CreateTrustedDomainEx2: struct lsa_CreateTrustedDomainEx2 in: struct lsa_CreateTrustedDomainEx2 policy_handle : * policy_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000016-0000-0000-f15a-25affc130000 info : * info: struct lsa_TrustDomainInfoInfoEx domain_name: struct lsa_StringLarge length : 0x0014 (20) size : 0x0016 (22) string : * string : 'atlas5.hpc' netbios_name: struct lsa_StringLarge length : 0x000c (12) size : 0x000e (14) string : * string : 'ATLAS5' sid : * sid : S-1-5-21-600493320-3079828444-3896724992 trust_direction : 0x00000003 (3) 1: LSA_TRUST_DIRECTION_INBOUND 1: LSA_TRUST_DIRECTION_OUTBOUND trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000000 (0) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION auth_info_internal : * auth_info_internal: struct lsa_TrustDomainInfoAuthInfoInternal auth_blob: struct lsa_DATA_BUF2 size : 0x00000440 (1088) data : * data: ARRAY(1088) access_mask : 0x00010000 (65536) 0: LSA_TRUSTED_QUERY_DOMAIN_NAME 0: LSA_TRUSTED_QUERY_CONTROLLERS 0: LSA_TRUSTED_SET_CONTROLLERS 0: LSA_TRUSTED_QUERY_POSIX 0: LSA_TRUSTED_SET_POSIX 0: LSA_TRUSTED_SET_AUTH 0: LSA_TRUSTED_QUERY_AUTH signed SMB2 message lsa_CreateTrustedDomainEx2: struct lsa_CreateTrustedDomainEx2 out: struct lsa_CreateTrustedDomainEx2 trustdom_handle : * trustdom_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_ACCESS_DENIED [Tue May 08 10:07:34.739980 2018] [:error] [pid 3854] ipa: INFO: [jsonserver_session] admin(a)IPA.DOMAIN.COM: trust_add/1(u'ATLAS5.HPC', realm_admin=u'Administrator', realm_passwd=u'********', realm_server=u'dc.atlas5.hpc', range_type=u'ipa-ad-trust', bidirectional=True, version=u'2.228'): ACIError --- When you look at the Samba AD trust list, it shows the following entry. If you delete the trust and try to add it again, the entry comes back. [root@atlas5dc samba]# bin/samba-tool domain trust list Type[Forest] Transitive[Yes] Direction[BOTH] Name[ipa.domain.com] I have poured over this for days and cannot find a reason why it's saying NT_STATUS_ACCESS_DENIED. I've tried verifying all the tedious details like DNS SRV records and user SIDs, so now I feel like it's going to be something more obvious :) Thanks, nate

2 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2018