Bug 1596161
| Summary: | Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012 | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Sudhir Menon <sumenon> | ||||||
| Component: | certmonger | Assignee: | Rob Crittenden <rcritten> | ||||||
| Status: | CLOSED NOTABUG | QA Contact: | ipa-qe <ipa-qe> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 7.6 | CC: | amore, frenaud, ftweedal, ksiddiqu, mkosek, nalin, ndehadra, nsoman, pvoborni, rcritten, spoore, sumenon, tscherf, xdong | ||||||
| Target Milestone: | rc | Keywords: | Regression, TestBlocker | ||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | certmonger-0.78.4-9.el7 | Doc Type: | If docs needed, set a value | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | |||||||||
| : | 1607616 (view as bug list) | Environment: | |||||||
| Last Closed: | 2018-08-14 12:00:47 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 1427105, 1607616 | ||||||||
| Attachments: |
|
||||||||
|
Description
Sudhir Menon
2018-06-28 10:56:59 UTC
Created attachment 1455240 [details]
messages
Created attachment 1455243 [details]
ipa-server-install log
Sudhir, Please provide the exact command used for ipa-server-install. Kaleem, I had actually used ipa-server-install with integrated DNS in an interactive installation, no specific command line options was provided. The issue happens in api.bootstrap because this method is called with an env variable LANG/LC_ALL not set. When certmonger is starting the CA helpers, it clears all the environment variables, but it should rather set LANG or LC_ALL to a suitable value (i.e. one for which sys.getfilesystemencoding() returns utf-8). The fix already exists in certmonger and needs to be backported: https://pagure.io/certmonger/c/0288d36e56bab788da3a494142bf9070f9f3aaf9?branch=master Keep LC_*, LANG, set default LC_CTYPE Moving to certmonger component. *** Bug 1597514 has been marked as a duplicate of this bug. *** *** Bug 1600356 has been marked as a duplicate of this bug. *** *** Bug 1601959 has been marked as a duplicate of this bug. *** *** Bug 1602149 has been marked as a duplicate of this bug. *** I'm still seeing this traceback with the updated version of certmonger: [root@vm-idm-037 log]# rpm -q certmonger certmonger-0.78.4-8.el7.x86_64 From automation that failed ipa-certupdate: STDERR: The ipa-pkinit-manage command was successful The ipa-cacert-manage command was successful trying https://vm-idm-037.domain.scrubbed/ipa/session/json [try 1]: Forwarding 'ca_is_enabled/1' to json server 'https://vm-idm-037.domain.scrubbed/ipa/session/json' [try 1]: Forwarding 'ca_find/1' to json server 'https://vm-idm-037.domain.scrubbed/ipa/session/json' Error resubmitting certmonger request '20180724014644', please check the request manually The ipa-certupdate command failed. Failed to update IPA CA certificate database In /var/log/messages: Jul 24 07:54:53 vm-idm-037 dogtag-ipa-ca-renew-agent-submit: Traceback (most recent call last):#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012 sys.exit(main())#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 502, in main#012 api.bootstrap(in_server=True, context='renew', confdir=paths.ETC_IPA)#012 File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 491, in bootstrap#012 raise errors.SystemEncodingError(encoding=fse)#012SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported. Set LC_ALL="C.UTF-8", or LC_ALL="" and LC_CTYPE="C.UTF-8". Jul 24 07:54:53 vm-idm-037 certmonger: 2018-07-24 07:54:53 [16766] Internal error Upon further review this is not an issue in certmonger at all. The failure is in the IPA-provided script. I'm going to roll back the patches to certmonger and remove this from the errata, and re-assign back to ipa project. And further considering, let's leave this in for now and see what happens after ipa fixes it. If possible it would be good to test with certmonger 0.78.4-6 as well as 0.78.4-8 to see if behavior of certmonger has changed. The scope of the IPA issue is more than just certmonger: a lot of different things break if the system encoding is not utf-8. See upstream ticket https://pagure.io/freeipa/issue/7646. BZ for ipa component is https://bugzilla.redhat.com/show_bug.cgi?id=1598044. The issue mentioned in the bug also affects RFE at BZ1427105#c14 for scenario related to : Setup IPA as SELF-SIGNED server and promote it to EXT-CA using "String-Name" in option '--external-ca-profile=' Setup IPA as SELF-SIGNED server and promote it to EXT-CA using "OID" in option '--external-ca-profile=' Note that the ipa-certupdate issue I was seeing before seems to be resolved with the fixed version of certmonger and ipa: https://bugzilla.redhat.com/show_bug.cgi?id=1598044#c14 I reverted the patches I added to handle LANG in build certmonger-0.78.4-9.el7 since these are unrelated to the underlying issue. |