Bug 1998016

Description of problem:

RA key import failing during PKI instance creation..

Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
  [1/29]: creating certificate server db
  [2/29]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 8 seconds elapsed
Update succeeded

  [3/29]: creating ACIs for admin
  [4/29]: creating installation admin user
  [5/29]: configuring certificate server instance
  [6/29]: stopping certificate server instance to update CS.cfg
  [7/29]: backing up CS.cfg
  [8/29]: Add ipa-pki-wait-running
  [9/29]: secure AJP connector
  [10/29]: reindex attributes
  [11/29]: exporting Dogtag certificate store pin
  [12/29]: disabling nonces
  [13/29]: set up CRL publishing
  [14/29]: enable PKIX certificate path discovery and validation
  [15/29]: authorizing RA to modify profiles
  [16/29]: authorizing RA to manage lightweight CAs
  [17/29]: Ensure lightweight CAs container exists
  [18/29]: destroying installation admin user
  [19/29]: starting certificate server instance
  [20/29]: Finalize replication settings
  [21/29]: configure certmonger for renewals
  [22/29]: Importing RA key
Error storing key "keys/ra/ipaCert": CalledProcessError(Command ['/usr/libexec/ipa/custodia/ipa-custodia-ra-agent', '--import', '-'] returned non-zero exit status 1: 'Traceback (most recent call last):\n  File "/usr/libexec/ipa/custodia/ipa-custodia-ra-agent", line 8, in <module>\n    main(ra_agent_parser())\n  File "/usr/lib/python3.9/site-packages/ipaserver/secrets/handlers/pemfile.py", line 114, in main\n    common.main(parser, export_key, import_key)\n  File "/usr/lib/python3.9/site-packages/ipaserver/secrets/handlers/common.py", line 73, in main\n    func(args, tmpdir, **kwargs)\n  File "/usr/lib/python3.9/site-packages/ipaserver/secrets/handlers/pemfile.py", line 69, in import_key\n    ipautil.run(cmd, umask=0o027)\n  File "/usr/lib/python3.9/site-packages/ipapython/ipautil.py", line 598, in run\n    raise CalledProcessError(\nipapython.ipautil.CalledProcessError: CalledProcessError(Command [\'/usr/bin/openssl\', \'pkcs12\', \'-in\', \'/tmp/tmp04xw30vu/import.p12\', \'-clcerts\', \'-nokeys\', \'-out\', \'/var/lib/ipa/ra-agent.pem\', \'-password\', \'file:/tmp/tmp04xw30vu/passwd\'] returned non-zero exit status 1: \'Error outputting keys and certificates\\n007CB411E27F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:346:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()\\n\')\n')
  [error] FileNotFoundError: [Errno 2] No such file or directory: '/var/lib/ipa/ra-agent.key'
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

[Errno 2] No such file or directory: '/var/lib/ipa/ra-agent.key'
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information


Version-Release number of selected component (if applicable):
[root@replica ~]# rpm -q ipa 389-ds-base pki-ca
package ipa is not installed
389-ds-base-2.0.8-1.el9.x86_64
pki-ca-11.0.0-0.4.alpha1.el9.noarch
[root@replica ~]#

How reproducible:
Always

Steps to Reproduce:
1. Install RHEL8.4 IPA master
2. Install RHEL9.0 IPA replica against RHEL8.4 IPA server
3.

Actual results:
Replica install fails during pki instance creation

Expected results:
Replica install should be successful