Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem: Traceback seen in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
Version-Release number of selected component (if applicable):
[root@master ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.6 Beta (Maipo)
ipa-server-4.6.4-1.el7.x86_64
389-ds-base-1.3.8.2-1.el7.x86_64
certmonger-0.78.4-6.el7.x86_64
sssd-1.16.2-1.el7.x86_64
krb5-server-1.15.1-32.el7.x86_64
pki-ca-10.5.9-1.el7.noarch
pki-server-10.5.9-1.el7.noarch
certmonger-0.78.4-6.el7.x86_64
How reproducible:
Always
Steps to Reproduce:
1. Install IPA server
2. Check /var/log/messages
Actual results:
Traceback is seen in /var/log/messages file.
Jun 28 06:42:31 ipaqavma dogtag-ipa-ca-renew-agent-submit: Traceback (most recent call last):#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012 sys.exit(main())#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 502, in main#012 api.bootstrap(in_server=True, context='renew', confdir=paths.ETC_IPA)#012 File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 491, in bootstrap#012 raise errors.SystemEncodingError(encoding=fse)#012SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported. Set LC_ALL="C.UTF-8", or LC_ALL="" and LC_CTYPE="C.UTF-8".
Expected results:
Traceback should be fixed.
Additional info:
Kaleem,
I had actually used ipa-server-install with integrated DNS in an interactive installation, no specific command line options was provided.
Comment 7Florence Blanc-Renaud
2018-07-10 04:52:30 UTC
The issue happens in api.bootstrap because this method is called with an env variable LANG/LC_ALL not set.
When certmonger is starting the CA helpers, it clears all the environment variables, but it should rather set LANG or LC_ALL to a suitable value (i.e. one for which sys.getfilesystemencoding() returns utf-8).
The fix already exists in certmonger and needs to be backported:
https://pagure.io/certmonger/c/0288d36e56bab788da3a494142bf9070f9f3aaf9?branch=master
Keep LC_*, LANG, set default LC_CTYPE
Moving to certmonger component.
Comment 8Florence Blanc-Renaud
2018-07-10 04:55:55 UTC
*** Bug 1597514 has been marked as a duplicate of this bug. ***
I'm still seeing this traceback with the updated version of certmonger:
[root@vm-idm-037 log]# rpm -q certmonger
certmonger-0.78.4-8.el7.x86_64
From automation that failed ipa-certupdate:
STDERR:
The ipa-pkinit-manage command was successful
The ipa-cacert-manage command was successful
trying https://vm-idm-037.domain.scrubbed/ipa/session/json
[try 1]: Forwarding 'ca_is_enabled/1' to json server 'https://vm-idm-037.domain.scrubbed/ipa/session/json'
[try 1]: Forwarding 'ca_find/1' to json server 'https://vm-idm-037.domain.scrubbed/ipa/session/json'
Error resubmitting certmonger request '20180724014644', please check the request manually
The ipa-certupdate command failed.
Failed to update IPA CA certificate database
In /var/log/messages:
Jul 24 07:54:53 vm-idm-037 dogtag-ipa-ca-renew-agent-submit: Traceback (most recent call last):#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012 sys.exit(main())#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 502, in main#012 api.bootstrap(in_server=True, context='renew', confdir=paths.ETC_IPA)#012 File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 491, in bootstrap#012 raise errors.SystemEncodingError(encoding=fse)#012SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported. Set LC_ALL="C.UTF-8", or LC_ALL="" and LC_CTYPE="C.UTF-8".
Jul 24 07:54:53 vm-idm-037 certmonger: 2018-07-24 07:54:53 [16766] Internal error
Upon further review this is not an issue in certmonger at all. The failure is in the IPA-provided script. I'm going to roll back the patches to certmonger and remove this from the errata, and re-assign back to ipa project.
And further considering, let's leave this in for now and see what happens after ipa fixes it. If possible it would be good to test with certmonger 0.78.4-6 as well as 0.78.4-8 to see if behavior of certmonger has changed.
The scope of the IPA issue is more than just certmonger: a lot of different things break if the system encoding is not utf-8. See upstream
ticket https://pagure.io/freeipa/issue/7646.
The issue mentioned in the bug also affects RFE at BZ1427105#c14 for scenario related to :
Setup IPA as SELF-SIGNED server and promote it to EXT-CA using "String-Name" in option '--external-ca-profile='
Setup IPA as SELF-SIGNED server and promote it to EXT-CA using "OID" in option '--external-ca-profile='