I found the following issues: Issue 1: Lets say I have the following setup: instance A with subsystems CA, KRA, OCSP instance B with subsystem CA, KRA Then for instance B, I see the following error message: grep: /var/lib/pki/pki-tomcat27/conf/ocsp/CS.cfg: No such file or directory pki-tomcat27 Configuration Definitions not found for ocsp It appears that if any instance has a subsystem, then it is assumed that all instances have that subsystem because you use a global list of subsystems. Issue 2: This may be a pkidestroy problem. I did a pkidestroy of the OCSP on instance A. Now I see the following: [CA Status Definitions] Unsecure Port = http://alee-workpc.redhat.com:8220/ca/ee/ca Secure Agent Port = https://alee-workpc.redhat.com:8223/ca/agent/ca Secure EE Port = https://alee-workpc.redhat.com:8223/ca/ee/ca Secure Admin Port = https://alee-workpc.redhat.com:8223/ca/services EE Client Auth Port = https://alee-workpc.redhat.com:8223/ca/eeca/ca PKI Console Port = pkiconsole https://alee-workpc.redhat.com:8223/ca Tomcat Port = 8225 (for shutdown) [DRM Status Definitions] Unsecure Port = http://alee-workpc.redhat.com:8220/kra/ee/kra Secure Agent Port = https://alee-workpc.redhat.com:8223/kra/agent/kra Secure EE Port = https://alee-workpc.redhat.com:8223/kra/ee/kra Secure Admin Port = https://alee-workpc.redhat.com:8223/kra/services PKI Console Port = pkiconsole https://alee-workpc.redhat.com:8223/kra Tomcat Port = 8225 (for shutdown) Unsecure Port = http://alee-workpc.redhat.com:8220/ocsp/ee/ocsp Secure Agent Port = https://alee-workpc.redhat.com:8223/ocsp/agent/ocsp Secure EE Port = https://alee-workpc.redhat.com:8223/ocsp/ee/ocsp Secure Admin Port = https://alee-workpc.redhat.com:8223/ocsp/services PKI Console Port = pkiconsole https://alee-workpc.redhat.com:8223/ocsp Tomcat Port = 8225 (for shutdown) That is -- I still see definitions from the removed OCSP. Ditto if I remove the KRA. Maybe this is a weird instance. Still testing .. On Tue, 2012-12-18 at 19:36 -0800, Matthew Harmsen wrote: > The attached patch addresses the following PKI issue: > * TRAC Ticket #271 - Dogtag 10: Fix 'status' command in > 'pkidaemon' . . . > > _______________________________________________ > Pki-devel mailing list > Pki-devel(a)redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel _______________________________________________ Pki-devel mailing list Pki-devel(a)redhat.com https://www.redhat.com/mailman/listinfo/pki-devel

Ade, The attached patch should address these issues. -- Matt On 12/19/12 09:46, Ade Lee wrote: > OK -- I tried this -- > > 1. Install instance A with CA, KRA > 2. Install instance B with CA. At this point, status shows me error on > not being able to find KRA files on instance B. > 3. Install OCSP on instance A. > 4. Remove OCSP on instance A. Other than problem mentioned above, all > looks ok. > 5. Install OCSP on instance B. > > I see this for B: > Status for pki-tomcat28: pki-tomcat28 is running .. > > [CA Status Definitions] > Unsecure Port = http://alee-workpc.redhat.com:8280/ca/ee/ca > Secure Agent Port = > https://alee-workpc.redhat.com:8283/ca/agent/ca > Secure EE Port = https://alee-workpc.redhat.com:8283/ca/ee/ca > Secure Admin Port = > https://alee-workpc.redhat.com:8283/ca/services > EE Client Auth Port = > https://alee-workpc.redhat.com:8283/ca/eeca/ca > PKI Console Port = pkiconsole > https://alee-workpc.redhat.com:8283/ca > Tomcat Port = 8285 (for shutdown) > Unsecure Port = http://alee-workpc.redhat.com:8280/kra/ee/kra > Secure Agent Port = > https://alee-workpc.redhat.com:8283/kra/agent/kra > Secure EE Port = > https://alee-workpc.redhat.com:8283/kra/ee/kra > Secure Admin Port = > https://alee-workpc.redhat.com:8283/kra/services > PKI Console Port = pkiconsole > https://alee-workpc.redhat.com:8283/kra > Tomcat Port = 8285 (for shutdown) > > [OCSP Status Definitions] > Unsecure Port = > http://alee-workpc.redhat.com:8280/ocsp/ee/ocsp > Secure Agent Port = > https://alee-workpc.redhat.com:8283/ocsp/agent/ocsp > Secure EE Port = > https://alee-workpc.redhat.com:8283/ocsp/ee/ocsp > Secure Admin Port = > https://alee-workpc.redhat.com:8283/ocsp/services > PKI Console Port = pkiconsole > https://alee-workpc.redhat.com:8283/ocsp > Tomcat Port = 8285 (for shutdown) > > Looks like you are not parsing the server.conf correctly. > > > On Wed, 2012-12-19 at 12:29 -0500, Ade Lee wrote: >> I found the following issues: >> >> Issue 1: >> >> Lets say I have the following setup: >> instance A with subsystems CA, KRA, OCSP >> instance B with subsystem CA, KRA >> >> Then for instance B, I see the following error message: >> >> grep: /var/lib/pki/pki-tomcat27/conf/ocsp/CS.cfg: No such file or >> directory >> pki-tomcat27 Configuration Definitions not found for ocsp >> >> It appears that if any instance has a subsystem, then it is assumed >> that >> all instances have that subsystem because you use a global list of >> subsystems. >> >> Issue 2: >> >> This may be a pkidestroy problem. I did a pkidestroy of the OCSP on >> instance A. Now I see the following: >> >> [CA Status Definitions] >> Unsecure Port = http://alee-workpc.redhat.com:8220/ca/ee/ca >> Secure Agent Port = >> https://alee-workpc.redhat.com:8223/ca/agent/ca >> Secure EE Port = https://alee-workpc.redhat.com:8223/ca/ee/ca >> Secure Admin Port = >> https://alee-workpc.redhat.com:8223/ca/services >> EE Client Auth Port = >> https://alee-workpc.redhat.com:8223/ca/eeca/ca >> PKI Console Port = pkiconsole >> https://alee-workpc.redhat.com:8223/ca >> Tomcat Port = 8225 (for shutdown) >> >> [DRM Status Definitions] >> Unsecure Port = >> http://alee-workpc.redhat.com:8220/kra/ee/kra >> Secure Agent Port = >> https://alee-workpc.redhat.com:8223/kra/agent/kra >> Secure EE Port = >> https://alee-workpc.redhat.com:8223/kra/ee/kra >> Secure Admin Port = >> https://alee-workpc.redhat.com:8223/kra/services >> PKI Console Port = pkiconsole >> https://alee-workpc.redhat.com:8223/kra >> Tomcat Port = 8225 (for shutdown) >> Unsecure Port = >> http://alee-workpc.redhat.com:8220/ocsp/ee/ocsp >> Secure Agent Port = >> https://alee-workpc.redhat.com:8223/ocsp/agent/ocsp >> Secure EE Port = >> https://alee-workpc.redhat.com:8223/ocsp/ee/ocsp >> Secure Admin Port = >> https://alee-workpc.redhat.com:8223/ocsp/services >> PKI Console Port = pkiconsole >> https://alee-workpc.redhat.com:8223/ocsp >> Tomcat Port = 8225 (for shutdown) >> >> That is -- I still see definitions from the removed OCSP. Ditto if I >> remove the KRA. >> >> Maybe this is a weird instance. Still testing .. >> >> >> >> On Tue, 2012-12-18 at 19:36 -0800, Matthew Harmsen wrote: >>> The attached patch addresses the following PKI issue: >>> * TRAC Ticket #271 - Dogtag 10: Fix 'status' command in >>> 'pkidaemon' . . . >>> >>> _______________________________________________ >>> Pki-devel mailing list >>> Pki-devel(a)redhat.com >>> https://www.redhat.com/mailman/listinfo/pki-devel >> >> _______________________________________________ >> Pki-devel mailing list >> Pki-devel(a)redhat.com >> https://www.redhat.com/mailman/listinfo/pki-devel > _______________________________________________ Pki-devel mailing list Pki-devel(a)redhat.com https://www.redhat.com/mailman/listinfo/pki-devel