Ade,

The attached patch should address these issues.

-- Matt

On 12/19/12 09:46, Ade Lee wrote:

OK -- I tried this --

1. Install instance A with CA, KRA
2. Install instance B with CA.  At this point, status shows me error on
not being able to find KRA files on instance B.
3. Install OCSP on instance A.
4. Remove OCSP on instance A.  Other than problem mentioned above, all
looks ok.
5. Install OCSP on instance B.

I see this for B:
Status for pki-tomcat28: pki-tomcat28 is running ..

     [CA Status Definitions]
     Unsecure Port       = http://alee-workpc.redhat.com:8280/ca/ee/ca
     Secure Agent Port   = https://alee-workpc.redhat.com:8283/ca/agent/ca
     Secure EE Port      = https://alee-workpc.redhat.com:8283/ca/ee/ca
     Secure Admin Port   = https://alee-workpc.redhat.com:8283/ca/services
     EE Client Auth Port = https://alee-workpc.redhat.com:8283/ca/eeca/ca
     PKI Console Port    = pkiconsole https://alee-workpc.redhat.com:8283/ca
     Tomcat Port         = 8285 (for shutdown)
     Unsecure Port       = http://alee-workpc.redhat.com:8280/kra/ee/kra
     Secure Agent Port   = https://alee-workpc.redhat.com:8283/kra/agent/kra
     Secure EE Port      = https://alee-workpc.redhat.com:8283/kra/ee/kra
     Secure Admin Port   = https://alee-workpc.redhat.com:8283/kra/services
     PKI Console Port    = pkiconsole https://alee-workpc.redhat.com:8283/kra
     Tomcat Port         = 8285 (for shutdown)

     [OCSP Status Definitions]
     Unsecure Port       = http://alee-workpc.redhat.com:8280/ocsp/ee/ocsp
     Secure Agent Port   = https://alee-workpc.redhat.com:8283/ocsp/agent/ocsp
     Secure EE Port      = https://alee-workpc.redhat.com:8283/ocsp/ee/ocsp
     Secure Admin Port   = https://alee-workpc.redhat.com:8283/ocsp/services
     PKI Console Port    = pkiconsole https://alee-workpc.redhat.com:8283/ocsp
     Tomcat Port         = 8285 (for shutdown)

Looks like you are not parsing the server.conf correctly.


On Wed, 2012-12-19 at 12:29 -0500, Ade Lee wrote:

I found the following issues:

Issue 1:

Lets say I have the following setup:
instance A with subsystems CA, KRA, OCSP
instance B with subsystem CA, KRA

Then for instance B, I see the following error message:

grep: /var/lib/pki/pki-tomcat27/conf/ocsp/CS.cfg: No such file or directory
pki-tomcat27 Configuration Definitions not found for ocsp

It appears that if any instance has a subsystem, then it is assumed that
all instances have that subsystem because you use a global list of
subsystems.

Issue 2:

This may be a pkidestroy problem.  I did a pkidestroy of the OCSP on
instance A.  Now I see the following:

     [CA Status Definitions]
     Unsecure Port       = http://alee-workpc.redhat.com:8220/ca/ee/ca
     Secure Agent Port   = https://alee-workpc.redhat.com:8223/ca/agent/ca
     Secure EE Port      = https://alee-workpc.redhat.com:8223/ca/ee/ca
     Secure Admin Port   = https://alee-workpc.redhat.com:8223/ca/services
     EE Client Auth Port = https://alee-workpc.redhat.com:8223/ca/eeca/ca
     PKI Console Port    = pkiconsole https://alee-workpc.redhat.com:8223/ca
     Tomcat Port         = 8225 (for shutdown)

     [DRM Status Definitions]
     Unsecure Port       = http://alee-workpc.redhat.com:8220/kra/ee/kra
     Secure Agent Port   = https://alee-workpc.redhat.com:8223/kra/agent/kra
     Secure EE Port      = https://alee-workpc.redhat.com:8223/kra/ee/kra
     Secure Admin Port   = https://alee-workpc.redhat.com:8223/kra/services
     PKI Console Port    = pkiconsole https://alee-workpc.redhat.com:8223/kra
     Tomcat Port         = 8225 (for shutdown)
     Unsecure Port       = http://alee-workpc.redhat.com:8220/ocsp/ee/ocsp
     Secure Agent Port   = https://alee-workpc.redhat.com:8223/ocsp/agent/ocsp
     Secure EE Port      = https://alee-workpc.redhat.com:8223/ocsp/ee/ocsp
     Secure Admin Port   = https://alee-workpc.redhat.com:8223/ocsp/services
     PKI Console Port    = pkiconsole https://alee-workpc.redhat.com:8223/ocsp
     Tomcat Port         = 8225 (for shutdown)

That is -- I still see definitions from the removed OCSP.  Ditto if I
remove the KRA.

Maybe this is a weird instance.  Still testing ..



On Tue, 2012-12-18 at 19:36 -0800, Matthew Harmsen wrote:

The attached patch addresses the following PKI issue:
       * TRAC Ticket #271 - Dogtag 10: Fix 'status' command in
         'pkidaemon' . . .

_______________________________________________
Pki-devel mailing list
Pki-devel@redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel

_______________________________________________
Pki-devel mailing list
Pki-devel@redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel

_______________________________________________
Pki-devel mailing list
Pki-devel@redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel