Bug 832559

Description of problem:
install ipa server, uninstall, then reinstall fails intermittently with error:
Configuring named:
  [1/9]: adding DNS container
  [2/9]: setting up our zone
  [3/9]: setting up reverse zone
  [4/9]: setting up our own record
  [5/9]: setting up kerberos principal
  [6/9]: setting up named.conf
  [7/9]: restarting named
  [8/9]: configuring named to start on boot
  [9/9]: changing resolv.conf to point to ourselves
done configuring named.

Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files

Restarting the web server
Configuration of client side components failed!
ipa-client-install returned: Command '/usr/sbin/ipa-client-install --on-master --unattended --domain testrelm.com --server qe-blade-13.testrelm.com --realm TESTRELM.COM --hostname qe-blade-13.testrelm.com' returned non-zero exit status 1


Can workaround by renaming /etc/pki/nss/cert8.db, and key3.db, and can reinstall


Version-Release number of selected component (if applicable):
ipa-server-2.2.0-16.el6.x86_64

How reproducible:
intermittently

Steps to Reproduce:
1. install ipa server
2. uninstall
3. reinstall
  
Actual results:
fails with error:
ipa-client-install returned: Command '/usr/sbin/ipa-client-install --on-master --unattended --domain testrelm.com --server qe-blade-13.testrelm.com --realm TESTRELM.COM --hostname qe-blade-13.testrelm.com' returned non-zero exit status 1

Expected results:
be able to reinstall successfully

Additional info:

After reinstalling, it failed, and ipaserver_install.log has -
Domain testrelm.com is already configured in existing SSSD config, creating a new one.
The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall.
Configured /etc/sssd/sssd.conf
Installation failed. Rolling back changes.

2012-06-15T13:38:11Z DEBUG stderr=Failed to add CA to the default NSS database.

And ipaclient_install.log has error -
2012-06-15T13:38:04Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index'
2012-06-15T13:38:04Z DEBUG Domain testrelm.com is already configured in existing SSSD config, creating a new one.
2012-06-15T13:38:04Z DEBUG args=/usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt
2012-06-15T13:38:04Z DEBUG stdout=
2012-06-15T13:38:04Z DEBUG stderr=certutil: could not obtain certificate from file: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.