hi, digging further, the tomcat service does not start because the of this error:
server[48368]: org.xml.sax.SAXParseException; systemId: file:/var/lib/pki/pki-tomcat/conf/server.xml; lineNumber: 86; columnNumber: 861; Error at line [86] column [861]: [Cannot invoke "Object.getClass()" because the return value of "org.apache.catalina.connector.Connector.getProtocolHandler()" is null] If I check the server.xml, there is no colum 861 in line 86, the last char is 860 <Connector name="Secure" port="8443" protocol="org.dogtagpki.jss.tomcat.Http11NioProtocol" SSLEnabled="true" sslImplementationName="org.dogtagpki.jss.tomcat.JSSImplementation" scheme="https" secure="true" connectionTimeout="80000" keepAliveTimeout="300000" maxHttpHeaderSize="8192" acceptCount="100" maxThreads="150" minSpareThreads="25" enableLookups="false" disableUploadTimeout="true" enableOCSP="false" ocspResponderURL=" http://kdc.sub.domain.tld:8080/ca/ocsp" ocspResponderCertNickname="ocspSigningCert cert-pki-ca" ocspCacheSize="1000" ocspMinCacheEntryDuration="7200" ocspMaxCacheEntryDuration="14400" ocspTimeout="10" serverCertNickFile="/var/lib/pki/pki-tomcat/conf/serverCertNick.conf" passwordFile="/var/lib/pki/pki-tomcat/conf/password.conf" passwordClass="org.dogtagpki.jss.tomcat.PlainPasswordFile" certdbDir="/var/lib/pki/pki-tomcat/alias"> This line looks similar (replacying the ocsp url) to other ipa ca servers I manage, so I do not know where this is coming from. If I run this as root it starts but apparently not well enough, because then the ExecStartPost command /usr/libexec/ipa/ipa-pki-wait-running fails with a 404 # /usr/libexec/ipa/ipa-pki-wait-running pki.client: /usr/libexec/ipa/ipa-pki-wait-running:61: The subsystem in PKIConnection.__init__() has been deprecated ( https://github.com/dogtagpki/pki/wiki/PKI-10.8-Python-Changes). ipa-pki-wait-running: Created connection http://kdc.sub.domain.tld:8080/ca ipa-pki-wait-running: Request failed unexpectedly, 404 Client Error: for url: http://kdc.sub.domain.tld:8080/ca/admin/ca/getStatus Any clues? Regards, Natxo On Wed, May 29, 2024 at 4:06 PM Natxo Asenjo <natxo.ase...@gmail.com> wrote: > > > On Wed, May 29, 2024 at 3:03 PM Rob Crittenden <rcrit...@redhat.com> > wrote: > >> Since it starts directly as root perhaps check for SELinux AVCs? Maybe a >> relabel would help (or try permissive to catch the full set). >> >> rob > > > > unfortunately selinux was already in permissive mode and no recent avcs: > # ausearch -m avc -ts recent > <no matches> > > The latest avc is from a few days agoi regarding the ipa_custodia which we > do not use. > > I did a restorecon -rv / and it corrected some labels, but no difference > so far. > > > > -- -- Groeten, natxo
-- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue