Created attachment 1455240 [details]
messages

Created attachment 1455243 [details]
ipa-server-install log

Sudhir,

Please provide the exact command used for ipa-server-install.

Kaleem,
I had actually used ipa-server-install with integrated DNS in an interactive installation, no specific command line options was provided.

The issue happens in api.bootstrap because this method is called with an env variable LANG/LC_ALL not set.
When certmonger is starting the CA helpers, it clears all the environment variables, but it should rather set LANG or LC_ALL to a suitable value (i.e. one for which sys.getfilesystemencoding() returns utf-8).

The fix already exists in certmonger and needs to be backported:
https://pagure.io/certmonger/c/0288d36e56bab788da3a494142bf9070f9f3aaf9?branch=master
Keep LC_*, LANG, set default LC_CTYPE

Moving to certmonger component.

*** Bug 1597514 has been marked as a duplicate of this bug. ***

*** Bug 1600356 has been marked as a duplicate of this bug. ***

*** Bug 1601959 has been marked as a duplicate of this bug. ***

*** Bug 1602149 has been marked as a duplicate of this bug. ***

I'm still seeing this traceback with the updated version of certmonger:

[root@vm-idm-037 log]# rpm -q certmonger
certmonger-0.78.4-8.el7.x86_64

From automation that failed ipa-certupdate:

STDERR:

The ipa-pkinit-manage command was successful
The ipa-cacert-manage command was successful
trying https://vm-idm-037.domain.scrubbed/ipa/session/json
[try 1]: Forwarding 'ca_is_enabled/1' to json server 'https://vm-idm-037.domain.scrubbed/ipa/session/json'
[try 1]: Forwarding 'ca_find/1' to json server 'https://vm-idm-037.domain.scrubbed/ipa/session/json'
Error resubmitting certmonger request '20180724014644', please check the request manually
The ipa-certupdate command failed.
Failed to update IPA CA certificate database

In /var/log/messages:

Jul 24 07:54:53 vm-idm-037 dogtag-ipa-ca-renew-agent-submit: Traceback (most recent call last):#012  File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012    sys.exit(main())#012  File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 502, in main#012    api.bootstrap(in_server=True, context='renew', confdir=paths.ETC_IPA)#012  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 491, in bootstrap#012    raise errors.SystemEncodingError(encoding=fse)#012SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported. Set LC_ALL="C.UTF-8", or LC_ALL="" and LC_CTYPE="C.UTF-8".
Jul 24 07:54:53 vm-idm-037 certmonger: 2018-07-24 07:54:53 [16766] Internal error

Upon further review this is not an issue in certmonger at all. The failure is in the IPA-provided script. I'm going to roll back the patches to certmonger and remove this from the errata, and re-assign back to ipa project.

And further considering, let's leave this in for now and see what happens after ipa fixes it. If possible it would be good to test with certmonger 0.78.4-6 as well as 0.78.4-8 to see if behavior of certmonger has changed.

The scope of the IPA issue is more than just certmonger: a lot of different things break if the system encoding is not utf-8.  See upstream
ticket https://pagure.io/freeipa/issue/7646.

BZ for ipa component is https://bugzilla.redhat.com/show_bug.cgi?id=1598044.

The issue mentioned in the bug also affects RFE at BZ1427105#c14 for scenario related to :

Setup IPA as SELF-SIGNED server and promote it to EXT-CA using  "String-Name" in option '--external-ca-profile='

Setup IPA as SELF-SIGNED server and promote it to EXT-CA using  "OID" in option '--external-ca-profile='

Note that the ipa-certupdate issue I was seeing before seems to be resolved with the fixed version of certmonger and ipa:

https://bugzilla.redhat.com/show_bug.cgi?id=1598044#c14

I reverted the patches I added to handle LANG in build certmonger-0.78.4-9.el7 since these are unrelated to the underlying issue.