RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5519

I have a CA-less install (with --root-ca-file) and so certmonger is not configured to run.  ipa-server-upgrade from 4.2.0 fails in this situation with:
{{{
2015-12-07T17:47:46Z DEBUG Starting external process
2015-12-07T17:47:46Z DEBUG args='/bin/systemctl' 'is-active' 'certmonger.service'
2015-12-07T17:47:46Z DEBUG Process finished, return code=3
2015-12-07T17:47:46Z DEBUG stdout=unknown

2015-12-07T17:47:46Z DEBUG stderr=
2015-12-07T17:47:46Z ERROR IPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run com
mand ipa-server-upgrade manually.
2015-12-07T17:47:46Z DEBUG   File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line
 171, in execute
    return_value = self.run()
  File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 50, in ru
n
    raise admintool.ScriptError(str(e))

2015-12-07T17:47:46Z DEBUG The ipa-server-upgrade command failed, exception:
ScriptError: Certmon
ger is not running. Start certmonger and run upgrade again.
2015-12-07T17:47:46Z ERROR Certmonger is not running. Start certmonger and run
upgrade again.
}}}

Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/bef0f4c5c38e7ff6415e8f8c96dc306ef7f0ce56
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/f55a228f5ddab45fdea884eee93eac9890cf093d
ipa-4-3:
https://fedorahosted.org/freeipa/changeset/0097558d3f5b56c7db930fc951bbdb6b46abbcc5

Upgrade issue - high sev/prio.

This patch causes upgrade regression https://fedorahosted.org/freeipa/ticket/5655

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5655

Ticket 5655 is fixed.

master:

612f4aa9003658f9a494ec327d50ec5a0592f7b4 always start certmonger during IPA server configuration upgrade
ipa-4-3:

d99552a8a9f855a7c5e00c4b0736061e05d6ed31 always start certmonger during IPA server configuration upgrade
ipa-4-2:

3664efa31edf0dff6dd3410e2eccd12c9cd25782 always start certmonger during IPA server configuration upgrade

IPA server version: ipa-server-4.4.0-3.el7.x86_64

Verified the bug on the basis of following steps:
1. Verified that no error message like "ERROR Certmonger is not running" is observed during upgrade of IPA server.
2. Verified the bug for upgrade paths:
   a) 7.2(GA) to 7.3
   b) 7.2.z to 7.3 (In my case upgrade from 7.2up6)

 Thus on the basis of above observations marking the status of bug to "VERIFIED".

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html