Hide Forgot
This bug is created as a clone of upstream ticket: https://pagure.io/freeipa/issue/6966 The cert-find backend is hardcoded to use port 8080 in dogtag.py. If the CA is on another master then port 8080 needs to be open in order to make a connection. This needs to be documented, perhaps on the ipa-server-install output. This seems to also affect displaying a user (timing out) but I didn't investigate that part.
ipa-server version: ipa-server-4.5.4-8.el7.x86_64 VERIFIED the bug on the basis of following observations: A) VERIFIED that, on RHEL 7.4.z IPA MASTER and CLIENT when the ports 8080 are blocked then 'ipa cert-find' command fails (ipa-server-4.5.0-22.el7_4.x86_64) (Reproducer) IPA-Master: ----------- # iptables -A OUTPUT -p tcp -o lo --dport 8080 -j DROP # iptables -A OUTPUT -p tcp -i lo --dport 8080 -j DROP # iptables -A OUTPUT -p tcp -o enp4s0 --dport 8080 -j DROP # iptables -A INPUT -p tcp -i enp4s0 --dport 8080 -j DROP [root@qe-blade-09 ~]# iptables -L --line-numbers Chain INPUT (policy ACCEPT) num target prot opt source destination 1 DROP tcp -- anywhere anywhere tcp dpt:webcache 2 DROP tcp -- anywhere anywhere tcp dpt:webcache Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination 1 DROP tcp -- anywhere anywhere tcp dpt:webcache 2 DROP tcp -- anywhere anywhere tcp dpt:webcache IPA-CLIENT: -------------- [root@ipaqavmc ~]# kdestroy [root@ipaqavmc ~]# kinit admin Password for admin@TESTRELM.TEST: [root@ipaqavmc ~]# ipa cert-find ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS ([Errno 110] Connection timed out) B) VERIFIED that, on RHEL 7.5 IPA MASTER and CLIENT (ipa-server-4.5.4-8.el7.x86_64) (Fix) when the ports 8080 are blocked then 'ipa cert-find' command is successful. The 'ipa cert-find' command eventually fails when both '8080' and '80' ports are blocked. Thus on the basis of above observations and comment#5 and comment#6, marking the status of bug to 'VERIFIED'.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0918