4:37 a.m.
Hi all,
I installed two Fedora and two pki-ca. Pki-ca works great, and pki-ca1
which is clone on pki-ca works great two.
Now I want to install pki-ra to use it with pki-ca1.
Installation is compleat, but i have problem with configuration.
First site - click Next.
Second site - Join an Existing Security Domain and write
https://pki-ca1:9445. Click Next.
Third site - show me Certificate Chain. Click Next. And
I see:
---
Internal Server Error
The server encountered an internal error or misconfiguration and was
unable to complete your request.
Please contact the server administrator, you(a)example.com and inform them
of the time the error occurred, and anything you might have done that
may have caused the error.
More information about this error may be available in the server error log.
---
And in pki-ra.log:
---
[Tue Dec 01 05:36:08 2009] [error] [client 192.168.6.243] Could not find
httpd.xml in /usr/sbin/ at
/var/lib/pki-ra/lib/perl/PKI/RA/DisplayCertChainPanel.pm line 228\n,
referer: https://ra.vpn.ca:12890/ra/admin/console/config/wizard
---
I can't find anywhere that file - httpd.xml
Can somebody help me? Why does it happens?
Br,
Rafal K
10:53 a.m.
How did you install RA? Did you do pkicreate?
It seems the install missed something.
From: Julius Adewumi
-----Original Message-----
From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of
Rafal Kaminski
Sent: Tuesday, December 01, 2009 3:38 AM
To: pki-users(a)redhat.com
Subject: [Pki-users] Problem with install RA (pki-ra)
Hi all,
I installed two Fedora and two pki-ca. Pki-ca works great, and pki-ca1 which is clone on
pki-ca works great two.
Now I want to install pki-ra to use it with pki-ca1.
Installation is compleat, but i have problem with configuration.
First site - click Next.
Second site - Join an Existing Security Domain and write https://pki-ca1:9445. Click
Next.
Third site - show me Certificate Chain. Click Next. And
I see:
---
Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete
your request.
Please contact the server administrator, you(a)example.com and inform them of the time the
error occurred, and anything you might have done that may have caused the error.
More information about this error may be available in the server error log.
---
And in pki-ra.log:
---
[Tue Dec 01 05:36:08 2009] [error] [client 192.168.6.243] Could not find httpd.xml in
/usr/sbin/ at /var/lib/pki-ra/lib/perl/PKI/RA/DisplayCertChainPanel.pm line 228\n,
referer: https://ra.vpn.ca:12890/ra/admin/console/config/wizard
---
I can't find anywhere that file - httpd.xml
Can somebody help me? Why does it happens?
Br,
Rafal K
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
1:17 p.m.
Hi,
How did you install RA? Did you do pkicreate?
It seems the install missed something.
No, I install by "yum install pki-ra" and on the end I saw the http://,
which put to my web browser.
The same http is in log - /var/log/pki-ra-install.log
Can you tell me how can I install by pkicreate? I always think - that
the pkicreate or pkiremove manage installed packet - not use to install.
Br,
Rafal K
2:22 p.m.
The install when run through yum eventual calls pkicreate. For a bit of
usage enter pkicreate -h
There is also a pkisilent which can be used to configure a subsystem
that has been installed. I.e. it replaces the web based wizard.
For some online information on the pkicreate and pkisilent scripts look
online here
http://www.redhat.com/docs/manuals/cert-system/8.0/cli/html/Create_and_R
emove_Instance_Tools.html
I haven't used the RA subsystem though so I don't have specific help on
your problem, sorry.
sean
-----Original Message-----
From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com]
On Behalf Of Rafal Kaminski
Sent: Tuesday, December 01, 2009 2:17 PM
To: pki-users(a)redhat.com
Subject: Re: [Pki-users] Problem with install RA (pki-ra)
Hi,
How did you install RA? Did you do pkicreate?
It seems the install missed something.
No, I install by "yum install pki-ra" and on the end I saw the http://,
which put to my web browser.
The same http is in log - /var/log/pki-ra-install.log
Can you tell me how can I install by pkicreate? I always think - that
the pkicreate or pkiremove manage installed packet - not use to install.
Br,
Rafal K
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
6:38 a.m.
Hi,
The install when run through yum eventual calls pkicreate. For a bit
of
usage enter pkicreate -h
I use pkicreate to create RA too. But it didn't work too. The same error
- httpd.xml missing and Internal Error on RA configure page.
There is also a pkisilent which can be used to configure a subsystem
that has been installed. I.e. it replaces the web based wizard.
I should try but:
-bash-4.0# yum search pkisilent
Warning: No matches found for: pkisilent
No Matches found
-bash-4.0#
BR,
Rafal Kaminski
7 a.m.
On 12/04/2009 06:08 PM, Rafał Kamiński wrote:
Hi,
> The install when run through yum eventual calls pkicreate. For a bit of
> usage enter pkicreate -h
I use pkicreate to create RA too. But it didn't work too. The same error
- httpd.xml missing and Internal Error on RA configure page.
not sure about this error though..
> There is also a pkisilent which can be used to configure a subsystem
> that has been installed. I.e. it replaces the web based wizard.
I should try but:
-bash-4.0# yum search pkisilent
Warning: No matches found for: pkisilent
No Matches found
-bash-4.0#
try yum search pki-silent
after installing the package, you can also notice a template for silent installations
which you can refer to,
/usr/share/pki/silent/pki_silent.template
/Kashyap
BR,
Rafal Kaminski
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
8:14 a.m.
> There is also a pkisilent which can be used to configure a
subsystem
>> that has been installed. I.e. it replaces the web based wizard.
>
> I should try but:
>
try yum search pki-silent
after installing the package, you can also notice a template for silent
installations which you can refer to,
/usr/share/pki/silent/pki_silent.template
Yupi :) I install pki-silent - but now how can I configure RA? Without
any errors?
Br,
Rafal Kaminski
1:50 p.m.
Rafal,
What version of Fedora are you using?
Do you have selinux in enforcing mode?
What is the output of :
rpm -qa |grep pki
thanks,
Ade Lee
On Fri, 2009-12-04 at 15:14 +0100, Rafał Kamiński wrote:
>> There is also a pkisilent which can be used to configure a
subsystem
>>> that has been installed. I.e. it replaces the web based wizard.
>>
>> I should try but:
>>
> try yum search pki-silent
>
> after installing the package, you can also notice a template for silent
> installations which you can refer to,
> /usr/share/pki/silent/pki_silent.template
Yupi :) I install pki-silent - but now how can I configure RA? Without
any errors?
Br,
Rafal Kaminski
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
2:33 a.m.
Hi,
Thanks for your answer.
What version of Fedora are you using?
Fedora release 11 (Leonidas)
Do you have selinux in enforcing mode?
I had enforcing mode on Selinux. Now I diabled selinux and first:
- Join an Existing Security Domain - and I use https://domain:9545 <- I
not using default port 9445 but 9545 port
Because I have that status on CA:
-bash-4.0# /etc/init.d/pki-ca status
pki-ca (pid 5892) is running ...
Unsecure Port = http://domain:9580/ca/ee/ca
Secure Agent Port = https://domain:9543/ca/agent/ca
Secure EE Port = https://domain:9544/ca/ee/ca
Secure Admin Port = https://domain:9545/ca/services
PKI Console Port = pkiconsole https://domain:9545/ca
Tomcat Port = 9801 (for shutdown)
Maybe this is problem?
- After that I see: Display Certificate Chain
- Click Next
- And:
Internal Server Error
The server encountered an internal error or misconfiguration and was
unable to complete your request.
Please contact the server administrator, you(a)example.com and inform them
of the time the error occurred, and anything you might have done that
may have caused the error.
More information about this error may be available in the server error log.
:(
What is the output of :
rpm -qa |grep pki
bash-4.0# rpm -qa |grep pki
pki-setup-1.2.0-1.fc11.noarch
pki-ra-1.2.0-2.fc11.noarch
dogtag-pki-common-ui-1.2.0-1.fc11.noarch
pki-util-1.2.0-1.fc11.noarch
pki-selinux-1.2.0-2.fc11.noarch
pki-common-1.2.0-1.fc11.noarch
pki-native-tools-1.2.0-2.fc11.i586
dogtag-pki-ra-ui-1.2.0-1.fc11.noarch
pki-java-tools-1.2.0-1.fc11.noarch
pki-silent-1.2.0-1.fc11.noarch
BR,
Thanks for your help.
Rafal Kaminski
8:40 p.m.
Hmm,
I was hoping something obvious would stand out, but thats not the case.
I tried installing the RA on a FC11 system I have here - and had no
problems. Of course, I'm using the latest versions of all the pki-*
components.
The port you are using is fine. It should be the one for the security
domain which is on the secure admin port. You can also see this in the
section at the end of the status display - which looks something like:
Registered PKI Security Domain Information:
==========================================================================
Name: foo domain
URL: https://host:19145
==========================================================================
So, its time to look at the logs.
In the /var/lib/<ra instance name>/logs/debug logfile, you should see
something like the following for this panel in the installation:
Tue Dec 15 09:31:06 EST 2009 - RA wizard: setting up test objects
Tue Dec 15 09:31:06 EST 2009 - RA wizard: found 2 certtags
Tue Dec 15 09:31:06 EST 2009 - DisplayCertChainPanel: update
Tue Dec 15 09:31:06 EST 2009 - content = <XMLResponse><DomainInfo><?xml
version="1.0"
encoding="UTF-8"?><DomainInfo><Name>workpc
domain 1
093009</Name><CAList><CA><Host>dhcp231-70.rdu.redhat.com</Host><SecurePort>9544</SecurePort><SecureAgentPort>9543</SecureAgentPort><SecureAdminPort>9545</SecureAdminPort><UnSecurePort>9580</UnSecurePort><Clone>false</Clone><SubsystemName>Certificate
Authority
pki-ca1</SubsystemName><DomainManager>true</DomainManager></CA><SubsystemCount>1</SubsystemCount></CAList><OCSPList><SubsystemCount>0</SubsystemCount></OCSPList><KRAList><SubsystemCount>0</SubsystemCount></KRAList><RAList><SubsystemCount>0</SubsystemCount></RAList><TKSList><SubsystemCount>0</SubsystemCount></TKSList><TPSList><SubsystemCount>0</SubsystemCount></TPSList></DomainInfo></DomainInfo><Status>0</Status></XMLResponse>
Tue Dec 15 09:31:06 EST 2009 - DisplayCertChainPanel: security domain 'workpc domain 1
093009'
Tue Dec 15 09:31:06 EST 2009 - DisplayCertChainPanel: Found CA 'Certificate Authority
pki-ca1'
We're particularly interested in what content is displaying ..
What do you see?
In fact, please open a bugzilla against dogtag, attach the debug and
error_log, and let me know the bug number.
Thanks,
Ade Lee
On Tue, 2009-12-15 at 09:33 +0100, Rafał Kamiński wrote:
Hi,
Thanks for your answer.
> What version of Fedora are you using?
Fedora release 11 (Leonidas)
> Do you have selinux in enforcing mode?
I had enforcing mode on Selinux. Now I diabled selinux and first:
- Join an Existing Security Domain - and I use https://domain:9545 <- I
not using default port 9445 but 9545 port
Because I have that status on CA:
-bash-4.0# /etc/init.d/pki-ca status
pki-ca (pid 5892) is running ...
Unsecure Port = http://domain:9580/ca/ee/ca
Secure Agent Port = https://domain:9543/ca/agent/ca
Secure EE Port = https://domain:9544/ca/ee/ca
Secure Admin Port = https://domain:9545/ca/services
PKI Console Port = pkiconsole https://domain:9545/ca
Tomcat Port = 9801 (for shutdown)
Maybe this is problem?
- After that I see: Display Certificate Chain
- Click Next
- And:
Internal Server Error
The server encountered an internal error or misconfiguration and was
unable to complete your request.
Please contact the server administrator, you(a)example.com and inform them
of the time the error occurred, and anything you might have done that
may have caused the error.
More information about this error may be available in the server error log.
:(
> What is the output of :
> rpm -qa |grep pki
bash-4.0# rpm -qa |grep pki
pki-setup-1.2.0-1.fc11.noarch
pki-ra-1.2.0-2.fc11.noarch
dogtag-pki-common-ui-1.2.0-1.fc11.noarch
pki-util-1.2.0-1.fc11.noarch
pki-selinux-1.2.0-2.fc11.noarch
pki-common-1.2.0-1.fc11.noarch
pki-native-tools-1.2.0-2.fc11.i586
dogtag-pki-ra-ui-1.2.0-1.fc11.noarch
pki-java-tools-1.2.0-1.fc11.noarch
pki-silent-1.2.0-1.fc11.noarch
BR,
Thanks for your help.
Rafal Kaminski
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
4:34 a.m.
Hi :)
I have better humour, because it's work :)
My problem was in "Security Domain" - I used wrong address and wrong port.
Because:
- i have two CA - main CA and second clone CA1
ca --- ca1 ---- ra
- and always when I install ra I use ca1 Security Domain - and that was
problem.
Now I installed pki-ra and now configure that to my uses.
Thanks a lot for you Helps!!!
Br,
Rafal Kaminski
5251
days inactive
5267
days old
10 comments
5 participants
participants (5)
-
Ade Lee -
Adewumi, Julius-p99373 -
Kashyap Chamarthy -
Rafał Kamiński -
Veale, Sean