RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 867640 - ipa-replica-install Configuration of CA failed
Summary: ipa-replica-install Configuration of CA failed
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: pki-core
Version: 6.4
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: rc
: ---
Assignee: Matthew Harmsen
QA Contact: Asha Akkiangady
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-10-17 22:29 UTC by Scott Poore
Modified: 2018-12-02 18:08 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-21 10:06:05 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
Reverts Bugzilla Bug #819111 - non-existent container ou=csusers breaks replication (5.53 KB, patch)
2012-10-19 21:39 UTC, Matthew Harmsen 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0511 0 normal SHIPPED_LIVE Moderate: pki-core security, bug fix and enhancement update 2013-02-20 21:29:34 UTC

Description Scott Poore 2012-10-17 22:29:59 UTC 
Description of problem:

On RHEL 6.4 test builds, I'm seeing ipa-replica-install fail on Configuring certificate server when running the pkisilent ConfigureCA command.

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-105.20121017T0247zgit22a8ab4.el6.x86_64
pki-ca-9.0.3-26.20121017T0149z.el6.noarch


How reproducible:
unknown but, seems to be semi-frequent.

Steps to Reproduce:
1.  Install IPA Master on RHEL6.4 build.
2.  ipa-replica-prepare on master
3.  copy replica info gpg file to replica
4.  on replica: ipa-replica-install -U  --setup-ca --setup-dns --forwarder=<DNSFORWARDER> -w <PASSWORD> -p <PASSWORD> /path/to/replica-info-<REPLICA_HOSTNAME>.gpg
  
Actual results:

# ipa-replica-install -U  --setup-ca --setup-dns --forwarder=192.168.122.1 -w XXXXXX -p XXXXXX /dev/shm/replica-info-rhel6-2.testrelm.com.gpg
...

Configuring certificate server: Estimated time 3 minutes 30 seconds
  [1/17]: creating certificate server user
  [2/17]: creating pki-ca instance
  [3/17]: configuring certificate server instance
ipa         : CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname rhel6-2.testrelm.com -cs_port 9445 -client_certdb_dir /tmp/tmp-Q8ad1f -client_certdb_pwd XXXXXXXX -preop_pin w53uYQUJBSyYNddpO5Xk -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=TESTRELM.COM -ldap_host rhel6-2.testrelm.com -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=TESTRELM.COM -ca_subsystem_cert_subject_name CN=CA Subsystem,O=TESTRELM.COM -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=TESTRELM.COM -ca_server_cert_subject_name CN=rhel6-2.testrelm.com,O=TESTRELM.COM -ca_audit_signing_cert_subject_name CN=CA Audit,O=TESTRELM.COM -ca_sign_cert_subject_name CN=Certificate Authority,O=TESTRELM.COM -external false -clone true -clone_p12_file ca.p12 -clone_p12_password XXXXXXXX -sd_hostname rhel6-1.testrelm.com -sd_admin_port 443 -sd_admin_name admin -sd_admin_password XXXXXXXX -clone_start_tls true -clone_uri https://rhel6-1.testrelm.com:443' returned non-zero exit status 255

Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

Configuration of CA failed


Expected results:

CA configured without errors.


Additional info:

/var/log/ipareplica-install errors:

Error in LdapConnectionPanel(): updateStatus value is null
ERROR: ConfigureCA: LdapConnectionPanel() failure
ERROR: unable to create CA

#######################################################################

2012-10-17T22:07:50Z DEBUG stderr=
2012-10-17T22:07:50Z CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname rhel6-2.testrelm.com -cs_port 9445 -client_certdb_dir /tmp/tmp-Q8ad1f -client_certdb_pwd XXXXXXXX -preop_pin w53uYQUJBSyYNddpO5Xk -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=TESTRELM.COM -ldap_host rhel6-2.testrelm.com -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=TESTRELM.COM -ca_subsystem_cert_subject_name CN=CA Subsystem,O=TESTRELM.COM -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=TESTRELM.COM -ca_server_cert_subject_name CN=rhel6-2.testrelm.com,O=TESTRELM.COM -ca_audit_signing_cert_subject_name CN=CA Audit,O=TESTRELM.COM -ca_sign_cert_subject_name CN=Certificate Authority,O=TESTRELM.COM -external false -clone true -clone_p12_file ca.p12 -clone_p12_password XXXXXXXX -sd_hostname rhel6-1.testrelm.com -sd_admin_port 443 -sd_admin_name admin -sd_admin_password XXXXXXXX -clone_start_tls true -clone_uri https://rhel6-1.testrelm.com:443' returned non-zero exit status 255
2012-10-17T22:07:50Z INFO   File "/usr/lib/python2.6/site-packages/ipaserver/install/installutils.py", line 614, in run_script
    return_value = main_function()

  File "/usr/sbin/ipa-replica-install", line 463, in main
    (CA, cs) = cainstance.install_replica_ca(config)

  File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 1542, in install_replica_ca
    subject_base=config.subject_base)

  File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 579, in configure_instance
    self.start_creation("Configuring certificate server", 210)

  File "/usr/lib/python2.6/site-packages/ipaserver/install/service.py", line 321, in start_creation
    method()

  File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 841, in __configure_instance
    raise RuntimeError('Configuration of CA failed')

2012-10-17T22:07:50Z INFO The ipa-replica-install command failed, exception: RuntimeError: Configuration of CA failed
Comment 2 Scott Poore 2012-10-17 23:29:37 UTC 
I also tried to use the pki-selinux reinstall workaround from F17 but that didn't work either.

https://www.redhat.com/archives/freeipa-users/2012-July/msg00167.html

I got the same results.


I also see this in /var/log/dirsrv/slapd-PKI-IPA/errors:

[17/Oct/2012:18:16:32 -0500] - ipaca: Finished indexing.
[17/Oct/2012:18:16:34 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager masterAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)
[17/Oct/2012:18:16:34 -0500] NSMMReplicationPlugin - agmt="cn=cloneAgreement1-rhel6-2.testrelm.com-pki-ca" (rhel6-1:7389): Replication bind with SIMPLE auth failed: LDAP error 32 (No such object) ((null))
[17/Oct/2012:18:16:37 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager masterAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)
[17/Oct/2012:18:16:43 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager masterAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)


And in /var/log/pki-ipa/debug:

...
[17/Oct/2012:18:16:39][http-9445-1]: DatabasePanel replicationDone: dn: cn=masterAgreement1-rhel6-2.testrelm.com-pki-ca,cn=replica,cn="o=ipaca",cn=mapping tree,cn=config
[17/Oct/2012:18:16:39][http-9445-1]: DatabasePanel replicationStatus: dn: cn=masterAgreement1-rhel6-2.testrelm.com-pki-ca,cn=replica,cn="o=ipaca",cn=mapping tree,cn=config
[17/Oct/2012:18:16:39][http-9445-1]: DatabasePanel setupReplication: consumer initialization failed. 32  - LDAP error: No such object
[17/Oct/2012:18:16:39][http-9445-1]: DatabasePanel setupReplication: java.io.IOException: consumer initialization failed. 32  - LDAP error: No such object
[17/Oct/2012:18:16:39][http-9445-1]: panel no=9
[17/Oct/2012:18:16:39][http-9445-1]: panel name=database
[17/Oct/2012:18:16:39][http-9445-1]: total number of panels=19
[17/Oct/2012:18:16:39][http-9445-1]: WizardServlet: found xml
[17/Oct/2012:18:16:39][http-9445-1]: Error: unknown type org.apache.catalina.connector.ResponseFacade
[17/Oct/2012:18:16:39][http-9445-1]: Error: unknown type org.apache.catalina.connector.RequestFacade
Comment 3 Rob Crittenden 2012-10-18 00:15:48 UTC 
This suggests that it failed in setting up a replication agreement with the remote master. Can you check the error log on the remote master?
Comment 4 Scott Poore 2012-10-18 13:17:50 UTC 
from /var/log/dirsrv/slapd-PKI-IPA/errors:

[17/Oct/2012:18:10:29 -0500] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected)
[17/Oct/2012:18:10:29 -0500] NSMMReplicationPlugin - agmt="cn=masterAgreement1-rhel6-2.testrelm.com-pki-ca" (rhel6-2:7389): Replication bind with SIMPLE auth failed: LDAP error -1 (Can't contact LDAP server) ((null))
[17/Oct/2012:18:15:29 -0500] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected)
[17/Oct/2012:18:16:33 -0500] NSMMReplicationPlugin - agmt_delete: begin
[17/Oct/2012:18:16:33 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)
[17/Oct/2012:18:16:33 -0500] NSMMReplicationPlugin - agmt="cn=masterAgreement1-rhel6-2.testrelm.com-pki-ca" (rhel6-2:7389): Replication bind with SIMPLE auth failed: LDAP error 32 (No such object) ((null))
[17/Oct/2012:18:16:34 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)
[17/Oct/2012:18:16:34 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)
[17/Oct/2012:18:16:38 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)
[17/Oct/2012:18:16:44 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)
[17/Oct/2012:18:16:56 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)
[17/Oct/2012:18:17:20 -0500] slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config] mech [SIMPLE]: error 32 (No such object) errno 0 (Success)
Comment 5 Rob Crittenden 2012-10-18 20:16:46 UTC 
The replication agreement created by dogtag has the wrong nsDS5ReplicaBindDN set.

It is using: cn=Replication Manager masterAgreement1-rhel6-2.testrelm.com-pki-ca,cn=config

It should be using one with ou=csusers: cn=Replication Manager cloneAgreement1-rhel6-2.testrelm.com-pki-ca,ou=csusers,cn=config

The user is created in the correct place, it looks like just a problem with the agreement.
Comment 6 Matthew Harmsen 2012-10-19 21:39:06 UTC 
Created attachment 630257 [details]
Reverts Bugzilla Bug #819111 - non-existent container ou=csusers breaks replication

The following reverts the patch that fixed Bugzilla Bug #819111 - non-existent container ou=csusers breaks replication.

# git log
. . .
commit e11f90c85738eebc1af16fc9180109df4cab9538
Author: Ade Lee <alee>
Date:   Tue May 8 13:38:44 2012 -0400

    Resolves #819111 - non-existent container ou=csusers breaks replication

# git revert e11f90c85738eebc1af16fc9180109df4cab9538
Comment 7 Matthew Harmsen 2012-10-19 21:41:10 UTC 
# git branch
* IPA_v2_RHEL_6_ERRATA_BRANCH

# git am ../0001-Reverts-819111-non-existent-container-ou-csusers-bre.patch

# git pull

# git push
Counting objects: 27, done.
Compressing objects: 100% (13/13), done.
Writing objects: 100% (14/14), 1.16 KiB, done.
Total 14 (delta 11), reused 0 (delta 0)
To ssh://git.fedorahosted.org/git/pki.git
   8d498ec..da19197  IPA_v2_RHEL_6_ERRATA_BRANCH -> IPA_v2_RHEL_6_ERRATA_BRANCH

# git log
commit da19197387b4f8d9626391367110da4b0f284498
Author: Matthew Harmsen <mharmsen>
Date:   Fri Oct 19 14:27:10 2012 -0700

    Reverts #819111 - non-existent container ou=csusers breaks replication
Comment 8 Matthew Harmsen 2012-10-19 22:10:56 UTC 
commit 30f63ec7c91c45ba59a856659e1f6f20e3e57231
Author: Matthew Harmsen <mharmsen>
Date:   Fri Oct 19 14:48:37 2012 -0700

    Revised spec file comment for better clarity.
Comment 10 Scott Poore 2012-10-23 21:56:58 UTC 
Ok, aside from seeing ipa-replica-install work, what's the best way to test for this?

ldapsearch to see the change?
Comment 11 Scott Poore 2012-10-30 16:52:22 UTC 
So, what's the best way to test this?
Comment 12 Rob Crittenden 2012-11-09 22:57:36 UTC 
Simply installing a replica should be enough. The installation will succeed.

To confirm that replication is taking place you can use ipa cert-request to issue a certificate on each master, then use ipa cert-show <serial#> to confirm that the certificate is visible on the opposing master.
Comment 13 Scott Poore 2012-11-27 20:06:28 UTC 
Verified.

Version ::

ipa-server-3.0.0-8.el6.x86_64
pki-ca-9.0.3-27.el6.noarch

Manual Test Results ::

[root@rhel6-3 ~]# ipa-replica-install -U --setup-dns --setup-ca --forwarder=$DNSFORWARD -w $ADMINPW -p $ADMINPW /var/lib/ipa/replica-info-rhel6-3.testrelm.com.gpg 
Run connection check to master
Check connection from replica to remote master 'rhel6-2.testrelm.com':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK
   PKI-CA: Directory Service port (7389): OK

The following list of ports use UDP protocol and would need to be
checked manually:
   Kerberos KDC: UDP (88): SKIPPED
   Kerberos Kpasswd: UDP (464): SKIPPED

Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
Execute check on remote master
Check connection from master to remote replica 'rhel6-3.testrelm.com':
   Directory Service: Unsecure port (389): OK
   Directory Service: Secure port (636): OK
   Kerberos KDC: TCP (88): OK
   Kerberos KDC: UDP (88): OK
   Kerberos Kpasswd: TCP (464): OK
   Kerberos Kpasswd: UDP (464): OK
   HTTP Server: Unsecure port (80): OK
   HTTP Server: Secure port (443): OK
   PKI-CA: Directory Service port (7389): OK

Connection from master to replica is OK.

Connection check OK
Configuring NTP daemon (ntpd)
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server for the CA (pkids): Estimated time 30 seconds
  [1/3]: creating directory server user
  [2/3]: creating directory server instance
  [3/3]: restarting directory server
Done configuring directory server for the CA (pkids).
Configuring certificate server (pki-cad): Estimated time 3 minutes 30 seconds
  [1/17]: creating certificate server user
  [2/17]: creating pki-ca instance
  [3/17]: configuring certificate server instance
  [4/17]: disabling nonces
  [5/17]: creating RA agent certificate database
  [6/17]: importing CA chain to RA certificate database
  [7/17]: fixing RA database permissions
  [8/17]: setting up signing cert profile
  [9/17]: set up CRL publishing
  [10/17]: set certificate subject base
  [11/17]: enabling Subject Key Identifier
  [12/17]: setting audit signing renewal to 2 years
  [13/17]: configuring certificate server to start on boot
  [14/17]: configure certmonger for renewals
  [15/17]: configure clone certificate renewals
  [16/17]: configure Server-Cert certificate renewal
  [17/17]: Configure HTTP to proxy connections
Done configuring certificate server (pki-cad).
Restarting the directory and certificate servers
Configuring directory server (dirsrv): Estimated time 1 minute
  [1/31]: creating directory server user
  [2/31]: creating directory server instance
  [3/31]: adding default schema
  [4/31]: enabling memberof plugin
  [5/31]: enabling winsync plugin
  [6/31]: configuring replication version plugin
  [7/31]: enabling IPA enrollment plugin
  [8/31]: enabling ldapi
  [9/31]: disabling betxn plugins
  [10/31]: configuring uniqueness plugin
  [11/31]: configuring uuid plugin
  [12/31]: configuring modrdn plugin
  [13/31]: enabling entryUSN plugin
  [14/31]: configuring lockout plugin
  [15/31]: creating indices
  [16/31]: enabling referential integrity plugin
  [17/31]: configuring ssl for ds instance
  [18/31]: configuring certmap.conf
  [19/31]: configure autobind for root
  [20/31]: configure new location for managed entries
  [21/31]: restarting directory server
  [22/31]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress
Update in progress
Update in progress
Update in progress
Update succeeded
  [23/31]: adding replication acis
  [24/31]: setting Auto Member configuration
  [25/31]: enabling S4U2Proxy delegation
  [26/31]: initializing group membership
  [27/31]: adding master entry
  [28/31]: configuring Posix uid/gid generation
  [29/31]: enabling compatibility plugin
  [30/31]: tuning directory server
  [31/31]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds
  [1/9]: adding sasl mappings to the directory
  [2/9]: writing stash file from DS
  [3/9]: configuring KDC
  [4/9]: creating a keytab for the directory
  [5/9]: creating a keytab for the machine
  [6/9]: adding the password extension to the directory
  [7/9]: enable GSSAPI for replication
  [8/9]: starting the KDC
  [9/9]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin 
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
  [1/2]: starting ipa_memcached 
  [2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring the web interface (httpd): Estimated time 1 minute
  [1/13]: disabling mod_ssl in httpd
  [2/13]: setting mod_nss port to 443
  [3/13]: setting mod_nss password file
  [4/13]: enabling mod_nss renegotiate
  [5/13]: adding URL rewriting rules
  [6/13]: configuring httpd
  [7/13]: setting up ssl
  [8/13]: publish CA cert
  [9/13]: creating a keytab for httpd
  [10/13]: clean up any existing httpd ccache
  [11/13]: configuring SELinux for httpd
  [12/13]: restarting httpd
  [13/13]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Using reverse zone 122.168.192.in-addr.arpa.
Configuring DNS (named)
  [1/8]: adding NS record to the zone
  [2/8]: setting up reverse zone
  [3/8]: setting up our own record
  [4/8]: setting up kerberos principal
  [5/8]: setting up named.conf
  [6/8]: restarting named
  [7/8]: configuring named to start on boot
  [8/8]: changing resolv.conf to point to ourselves
Done configuring DNS (named).

Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files

Restarting the web server

[root@rhel6-3 ~]# grep "CRITICAL failed to configure ca instance" /var/log/ipareplica-install.log

[root@rhel6-3 ~]#
Comment 14 errata-xmlrpc 2013-02-21 10:06:05 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0511.html
Note You need to log in before you can comment on or make changes to this bug.