Okay, I have checked the back up. The problem is there. I have upgraded to the version 4.9.8, API_VERSION 2.245. I get the same error. I have enrolled a new client and it seemed to work but I am unable to remove it getting the same error. One precision, IPA is in the vm at the moment in a bridged mode. It shouldn't matter though ? How could I back up IPA data for a reinstall? Or do you have a better suggestion?

Hi, Flo Thank you for the answer! Here's the logs you asked for, and some others that I think are useful. I replaced domain name with domain.priv. ipa cert-show 1 ipa: ERROR: Ticket expired getcert status None of ID or database directory and and nickname or certificate file specified. getcert - client certificate enrollment tool ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: STOPPED ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING 1 service(s) are not running journalctl -u pki-tomcatd(a)pki-tomcat.service -- Logs begin at Wed 2022-08-10 19:58:29 CEST, end at Thu 2022-08-11 12:32:22 CEST. -- august 10 20:01:52 ipa.domain.priv systemd[1]: Starting PKI Tomcat Server pki-tomcat... august 10 20:02:47 ipa.domain.priv server[3641]: Java virtual machine used: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java august 10 20:02:48 ipa.domain.priv server[3641]: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/ant.jar:/usr/share/java/ant-launcher.jar:/usr/lib/jvm/java/lib/tools.jar august 10 20:02:48 ipa.domain.priv server[3641]: main class used: org.apache.catalina.startup.Bootstrap august 10 20:02:48 ipa.domain.priv server[3641]: flags used: -Dcom.redhat.fips=false august 10 20:02:48 ipa.domain.priv server[3641]: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.security.manager -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy august 10 20:02:48 ipa.domain.priv server[3641]: arguments used: start august 10 20:03:02 ipa.domain.priv ipa-pki-wait-running[3643]: pki.client: /usr/libexec/ipa/ipa-pki-wait-running:64: The subsystem in PKIConnection.__init__() has been deprecated (https://www.dogtagpki.org/wiki/PKI_10.8_Python_Changes). august 10 20:03:03 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Created connection http://ipa.domain.priv:8080/ca august 10 20:03:03 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae586048>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:04 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae586438>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:05 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5867b8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:06 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae586b38>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:07 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae586eb8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:08 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae599278>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:09 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae599630>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:10 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5999e8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:11 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae586e80>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:12 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5866d8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:13 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae586358>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:14 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae586208>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:15 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5ceb38>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:16 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5994e0>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:17 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5992e8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:19 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae599da0>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:20 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5a3198>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:21 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5a3550>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:22 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5a3908>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:23 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5a3cc0>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:24 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5b00b8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:25 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5a3a90>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:26 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5a36d8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:27 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5a3320>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:28 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5ceb70>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:29 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5864a8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:30 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5867f0>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:31 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae586b70>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:31 ipa.domain.priv server[3641]: AVERTISSEMENT: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'address' to 'localhost6' did not find a matching property. august 10 20:03:32 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae586198>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:33 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae599f98>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:34 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae599e10>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:35 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae599048>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:36 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae599908>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:37 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5999e8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:38 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5b0470>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:39 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae5996d8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:40 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae599278>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:41 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5bae599ac8>: Failed to establish a new connection: [Errno 111] Connection refused',)) august 10 20:03:42 ipa.domain.priv server[3641]: AVERTISSEMENT: Quelques [protocols] spécifiés ne sont pas supportés par le moteur SSL et ont été ignorés: [[TLSv1, TLSv1.1]] august 10 20:03:43 ipa.domain.priv server[3641]: GRAVE: Echec d'initialisation du composant [Connector[AJP/1.3-8009]] august 10 20:03:43 ipa.domain.priv server[3641]: org.apache.catalina.LifecycleException: L'initialisation du gestionnaire de protocole a échoué august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.connector.Connector.initInternal(Connector.java:983) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.core.StandardService.initInternal(StandardService.java:533) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:1057) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.startup.Catalina.load(Catalina.java:584) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.startup.Catalina.load(Catalina.java:607) august 10 20:03:43 ipa.domain.priv server[3641]: at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) august 10 20:03:43 ipa.domain.priv server[3641]: at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) august 10 20:03:43 ipa.domain.priv server[3641]: at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) august 10 20:03:43 ipa.domain.priv server[3641]: at java.lang.reflect.Method.invoke(Method.java:498) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:303) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:473) august 10 20:03:43 ipa.domain.priv server[3641]: Caused by: java.net.BindException: Address already in use august 10 20:03:43 ipa.domain.priv server[3641]: at sun.nio.ch.Net.bind0(Native Method) august 10 20:03:43 ipa.domain.priv server[3641]: at sun.nio.ch.Net.bind(Net.java:461) august 10 20:03:43 ipa.domain.priv server[3641]: at sun.nio.ch.Net.bind(Net.java:453) august 10 20:03:43 ipa.domain.priv server[3641]: at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:222) august 10 20:03:43 ipa.domain.priv server[3641]: at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:85) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.tomcat.util.net.NioEndpoint.initServerSocket(NioEndpoint.java:229) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:212) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1141) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1154) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:575) august 10 20:03:43 ipa.domain.priv server[3641]: at org.apache.catalina.connector.Connector.initInternal(Connector.java:980) august 10 20:03:43 ipa.domain.priv server[3641]: ... 13 more august 10 20:03:43 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:03:45 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:03:47 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:03:49 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:03:51 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:03:53 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:03:56 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:03:58 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:00 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:02 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:04 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:06 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:08 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:10 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:12 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:14 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:16 ipa.domain.priv ipa-pki-wait-running[3643]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Read timed out. (read timeout=1.0) august 10 20:04:17 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Start-post operation timed out. Stopping. august 10 20:05:47 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: State 'stop-sigterm' timed out. Killing. august 10 20:05:47 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Killing process 3641 (java) with signal SIGKILL. august 10 20:05:48 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Main process exited, code=killed, status=9/KILL august 10 20:05:48 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Failed with result 'timeout'. august 10 20:05:48 ipa.domain.priv systemd[1]: Failed to start PKI Tomcat Server pki-tomcat. Please let me know if anything else could be useful. Cheers.

Yes, I have checked ports and no process is running on port 8009, tcp nor udp. Restarting pki-tomcatd(a)pki-tomcat.service takes forever and eventually fails because of timeout. systemctl restart pki-tomcatd(a)pki-tomcat.service Job for pki-tomcatd(a)pki-tomcat.service failed because a timeout was exceeded. See "systemctl status pki-tomcatd(a)pki-tomcat.service&quot; and "journalctl -xe" for details. journalctl -xe août 11 13:31:39 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:40 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:41 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:42 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:43 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:44 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:45 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:46 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:47 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:48 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:49 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:50 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:51 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:52 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:53 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:54 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:56 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:57 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:58 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:31:59 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:00 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:01 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:02 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:03 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:04 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:05 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:06 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:07 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:08 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:09 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:10 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:11 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:12 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:13 ipa.domain.priv ipa-pki-wait-running[79555]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa.domain.priv', port=8080): Max retries exceeded with url: /ca/> août 11 13:32:13 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Start-post operation timed out. Stopping. août 11 13:32:22 ipa.domain.priv sssd_be[809]: GSSAPI client step 1 août 11 13:32:22 ipa.domain.priv sssd_be[809]: GSSAPI client step 1 août 11 13:32:22 ipa.domain.priv sssd_be[809]: GSSAPI client step 1 août 11 13:32:22 ipa.domain.priv sssd_be[809]: GSSAPI client step 2 août 11 13:33:43 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: State 'stop-sigterm' timed out. Killing. août 11 13:33:43 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Killing process 79554 (java) with signal SIGKILL. août 11 13:33:43 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Main process exited, code=killed, status=9/KILL août 11 13:33:43 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Failed with result 'timeout'. -- Subject: Unit failed -- Defined-By: systemd -- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- The unit pki-tomcatd(a)pki-tomcat.service has entered the 'failed' state with result 'timeout'. août 11 13:33:44 ipa.domain.priv systemd[1]: Failed to start PKI Tomcat Server pki-tomcat. -- Subject: L'unité (unit) pki-tomcatd(a)pki-tomcat.service a échoué -- Defined-By: systemd -- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- L'unité (unit) pki-tomcatd(a)pki-tomcat.service a échoué, avec le résultat failed. /etc/pki/pki-tomcat/server.xml contents: <!-- Define an AJP 1.3 Connector on port 8009 --> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="localhost4" name="Connector1" secret="..." requiredSecret="..."/> And after <Engine> section there's a definition for ipv6. Secrets are the same. <Connector address="localhost6" name="Connector1" port="8009" protocol="AJP/1.3" redirectPort="8443" secret="..." requiredSecret="..."/>

Hey, I couldn't easily find the version. Normally, there should be a version.sh script somewhere, but there's none. I checked the installed dnf package and this is what I got. tomcatjss.noarch 7.7.1-1.module+el8.6.0+788+76246f77 @appstream So apparently it's under 9. In /etc/httpd/conf.d/ipa-pki-proxy.conf the ProxyPassMatch secret corresponds to the requiredSecret in /etc/pki/pki-tomcat/server.xml. So I removed secret from /etc/pki/pki-tomcat/server.xml and now the corresponding connector section looks like this: <!-- Define an AJP 1.3 Connector on port 8009 --> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="localhost4" name="Connector1" requiredSecret="..."/> Same for ipv6 connector. The I tried to restart tomcat again with systemd. août 11 14:58:17 ipa.commown.priv systemd[1]: Starting PKI Tomcat Server pki-tomcat... -- Subject: L'unité (unit) pki-tomcatd(a)pki-tomcat.service a commencé à démarrer -- Defined-By: systemd -- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- L'unité (unit) pki-tomcatd(a)pki-tomcat.service a commencé à démarrer. août 11 14:59:51 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: start-pre operation timed out. Terminating. août 11 15:01:01 ipa.domain.priv CROND[87387]: (root) CMD (run-parts /etc/cron.hourly) août 11 15:01:01 ipa.domain.priv run-parts[87390]: (/etc/cron.hourly) starting 0anacron août 11 15:01:01 ipa.domain.priv run-parts[87396]: (/etc/cron.hourly) finished 0anacron août 11 15:01:22 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: State 'stop-final-sigterm' timed out. Killing. août 11 15:01:22 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Killing process 87164 (java) with signal SIGKILL. août 11 15:01:22 ipa.domain.priv systemd[1]: pki-tomcatd(a)pki-tomcat.service: Failed with result 'timeout'. -- Subject: Unit failed -- Defined-By: systemd -- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- The unit pki-tomcatd(a)pki-tomcat.service has entered the 'failed' state with result 'timeout'. août 11 15:01:22 ipa.commown.priv systemd[1]: Failed to start PKI Tomcat Server pki-tomcat. -- Subject: L'unité (unit) pki-tomcatd(a)pki-tomcat.service a échoué -- Defined-By: systemd -- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- L'unité (unit) pki-tomcatd(a)pki-tomcat.service a échoué, avec le résultat failed. Then tried ipactl restart, which also timed out on tomcat.

Thanks ! Apparently it's version 9 pki-servlet-4.0-api.noarch 1:9.0.30-3.module+el8.5.0+697+f586bb30 @appstream pki-servlet-engine.noarch 1:9.0.30-3.module+el8.5.0+697+f586bb30 @appstream I found the directory /usr/share/doc/pki-servlet-engine but there's nothing indicating the version I tried renaming "secret" attribute to "requiredSecret" and restarting ipa, didn't work. Then I also renamed "secret" to "requiredSecret" in /etc/httpd/conf.d/ipa-pki-proxy.conf just in case, didn't work. I have undone the changes. Where would I be looking next? Thanks for your help.

Hey, in the meantime, I can no longer access certificates with pki ca-cert-show. It says that the serial number is missing. I have made another post as I feel like missing serial number is the core issue to why tomcat doesn't start. https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... Cheers.