Please see IPA related ticket: https://fedorahosted.org/freeipa/ticket/6274
It looks for me the same issue as this reported in past: https://fedorahosted.org/pki/ticket/1702
"caIPAServiceCert" is default profile for IPA, should always exists.
This is reproducible in our CI test automation, it looks like dogtag is reporting that ready to serve, but when we execute ipa-replica-prepare too early, it fails with error "Profile caIPAserviceCert Not Found". Manually it works when delay between dogtag restart during ipa-server-install and ipa-replica-prepare is longer.
PS: we check dogtag status using http polling.
Consider this for a RHEL 7.3-Z stream patch.
Pushed to master (ced5cb71c1963d5234c2360d1f2ac11d4a452d9d)
How to test this scenario? In 7.4 , i don't think we need to do replica-prepare.
I think issue is reported during replica-prepare as mentioned in https://pagure.io/freeipa/issue/6274
Geetika, this will be difficult to test. It was a race condition
that could occur during profile reload e.g. after LDAP disconnection.
The reason for this particular symtom (ipa-replica-prepare failure) was that
the LDAP server gets restarted as a final step of server installation, and
the CI system ran ipa-replica-prepare immediately afterwards. The certificate
issuance that occurs as part of ipa-replica-prepare failed because the
caIPAserviceCert was temporarily unavailable while the profile subsystem
refreshed its view of the profile in LDAP (due to server disconnect).
So, how to test:
1. install a pre-RHEL7.3 master (domain level 0)
2. install a RHEL7.4 replica (which will also be domain level 0)
3. on the replica, *immediately* after installation (i.e. it should
be scripted), run ipa-replica-prepare for some third host. It
should succeed. Because it is a race condition you should do this
a few times to be truly satisfied that the issue has been resolved.
Hope that helps!
Verified using PKI version :: pki-server-10.4.1-8.el7.noarch
Marking BZ as verified. As comment #7, tried on ipa-replica-prepare with several RHEL 7.4 servers. Each time ipa-replica-prepare was successful. See attachment for console.log.
Created attachment 1287042 [details]
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.