Description of problem:

Our custommer is trying to upgrade IPA but it ends with:

Upgrade failed with This entry already exists
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
('IPA upgrade failed.', 1)
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information

My colleague, IPA specialist defined two options:

1. The problem is that all three certificates already in LDAP have the same value of ipaCertIssuerSerial and the check(attribute uniques plugin) fails automatically while adding any other cert. 

2. Problem comes while importing cert to LDAP(CN=VIG Czech Republic - Root CA,DC=koop,DC=int) while the check plugin found a record with identical value of ipaCertIssuerSerial

IPA Upgrade log:

2017-10-02T08:28:16Z DEBUG stderr=
2017-10-02T08:28:16Z DEBUG Destroyed connection context.ldap2_94886096
2017-10-02T08:28:16Z ERROR Upgrade failed with This entry already exists
2017-10-02T08:28:16Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 220, in __upgrade
self.modified = (ld.update(self.files) or self.modified)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 911, in update
self._run_updates(all_updates)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 883, in _run_updates
self._run_update_plugin(update['plugin'])
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 859, in _run_update_plugin
restart_ds, updates = self.api.Updater[plugin_name]()
File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 1470, in _call_
return self.execute(**options)
File "/usr/lib/python2.7/site-packages/ipaserver/install/plugins/upload_cacrt.py", line 84, in execute
ldap.update_entry(entry)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1553, in update_entry
self.conn.modify_s(str(entry.dn), modlist)
File "/usr/lib64/python2.7/contextlib.py", line 35, in _exit_
self.gen.throw(type, value, traceback)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in error_handler
raise errors.DuplicateEntry()
DuplicateEntry: This entry already exists

2017-10-02T08:28:16Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 228, in __upgrade
raise RuntimeError(e)
RuntimeError: This entry already exists

2017-10-02T08:28:16Z DEBUG [error] RuntimeError: This entry already exists
2017-10-02T08:28:16Z DEBUG [cleanup]: stopping directory server
2017-10-02T08:28:16Z DEBUG Destroyed connection context.ldap2_57176400
2017-10-02T08:28:16Z DEBUG Starting external process
2017-10-02T08:28:16Z DEBUG args=/bin/systemctl stop dirsrv
2017-10-02T08:29:33Z DEBUG Process finished, return code=0
2017-10-02T08:29:33Z DEBUG stdout=
2017-10-02T08:29:33Z DEBUG stderr=
2017-10-02T08:29:33Z DEBUG duration: 76 seconds
2017-10-02T08:29:33Z DEBUG [cleanup]: restoring configuration
2017-10-02T08:29:33Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2017-10-02T08:29:33Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2017-10-02T08:29:33Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state'
2017-10-02T08:29:33Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2017-10-02T08:29:33Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'


Version-Release number of selected component (if applicable):


How reproducible:

Always, while try to upgrade

Steps to Reproduce:
1.
2.
3.

Actual results:

based on all symtoms it seems like this bug: https://bugzilla.redhat.com/show_bug.cgi?id=1480102#c2 but we are not able to workaround because in our case there's nothing to rename - https://access.redhat.com/solutions/3176421

Expected results:
Working upgrade - please help us to apply sollution 

Additional info:

our configuration:
[root@ipa-tst-01 dklima]# certutil -d /etc/httpd/alias -L -f /etc/httpd/alias/pwdfile.txt

Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI

Signing-Cert u,u,u
CN=VIG Czech Republic - Root CA,DC=koop,DC=int CT,C,C
INTERNAL.SERVICES IPA CA CT,C,C
ipaCert u,u,u
Server-Cert u,u,u

[root@ipa-tst-02 ~]# ldapsearch -xLLL -D "cn=directory manager" -W -b "cn=certificates,cn=ipa,cn=etc,dc=internal,dc=services" dn ipaCertIssuerSerial
Enter LDAP Password:
dn: cn=certificates,cn=ipa,cn=etc,dc=internal,dc=services

dn: cn=CN\3DVIG Czech Republic - Root CA\2CDC\3Dkoop\2CDC\3Dint,cn=certificate
s,cn=ipa,cn=etc,dc=internal,dc=services
ipaCertIssuerSerial: CN=VIG Czech Republic - Root CA,DC=koop,DC=int;5568479957
1164127595453461947360030726

dn: cn=INTERNAL.SERVICES IPA CA,cn=certificates,cn=ipa,cn=etc,dc=internal,dc=s
ervices
ipaCertIssuerSerial: CN=VIG Czech Republic - Root CA,DC=koop,DC=int;2096270049
017594713081755922092318651133722692

dn: cn=CN\3DCertificate Authority\2CO\3DINTERNAL.SERVICES test,cn=certificates
,cn=ipa,cn=etc,dc=internal,dc=services
ipaCertIssuerSerial: CN=VIG Czech Republic - Root CA,DC=koop,DC=int;2096270049
017594713081755922092318651133722692

Thank you for your support,

Lea Bradacova