# FreeIPA KRA install fails on Rocky 9 replica (from rocky 8 cluster) **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [April 16, 2025, 9:51am UTC](https://forums.rockylinux.org/t/freeipa-kra-install-fails-on-rocky-9-replica-from-rocky-8-cluster/18187 "2025-04-16T09:51:27Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![jbran](https://avatars.discourse-cdn.com/v4/letter/j/85e7bf/32.png) [@jbran](https://forums.rockylinux.org/u/jbran)\ **Post date:** [April 16, 2025, 9:51am UTC](https://forums.rockylinux.org/t/freeipa-kra-install-fails-on-rocky-9-replica-from-rocky-8-cluster/18187/1 "2025-04-16T09:51:27Z")
Not sure if this is the correct fora to ask in I have a freeipa setup on rocky 8 and is trying to upgrade to rocky9 by adding a replica to the cluster. the base packages seems to work fine but when I try to install KRA on the new host it fails. It works fine on rocky 8 btw do anyone have an idea how I can fix this ? ipa-kra-install log: FINE: Response: { “Response” : { “Status” : “1”, “Error” : “Unable to add KRA connector for httpx://ipa05.dev.ngc.dk:8443: KRA connector already exists” } } FINE: CAClient: Response: { “Response” : { “Status” : “1”, “Error” : “Unable to add KRA connector for httpx://ipa05.dev.ngc.dk:8443: KRA connector already exists” } } FINE: CAClient: status: 1 java.lang.NullPointerException: Cannot invoke “com.fasterxml.jackson.databind.JsonNode.asText()” because the return value of “com.fasterxml.jackson.databind.JsonNode.get(String)” is null at com.netscape.certsrv.ca.CAClient.addKRAConnector(CAClient.java:129) at com.netscape.cmstools.system.KRAConnectorAddCLI.execute(KRAConnectorAddCLI.java:220) at org.dogtagpki.cli.CommandCLI.execute(CommandCLI.java:58) at org.dogtagpki.cli.CLI.execute(CLI.java:353) at org.dogtagpki.cli.CLI.execute(CLI.java:353) at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:79) at org.dogtagpki.cli.CLI.execute(CLI.java:353) at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:659) at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:698) ERROR: CalledProcessError: Command ‘[‘pki’, ‘-d’, ‘/etc/pki/pki-tomcat/alias’, ‘-f’, ‘/etc/pki/pki-tomcat/password.conf’, ‘-U’, ‘httpx://ipa05.dev.ngc.dk:443’, ‘–ignore-banner’, ‘ca-kraconnector-add’, ‘–url’, ‘httpx://ipa05.dev.ngc.dk:8443/kra/agent/kra/connector’, ‘–subsystem-cert’, ‘/tmp/tmpf65kp8xr/subsystem.crt’, ‘–transport-cert’, ‘/tmp/tmpf65kp8xr/transport.crt’, ‘–transport-nickname’, ‘transportCert cert-pki-kra’, ‘–install-token’, ‘/tmp/tmpf65kp8xr/install-token’, ‘–debug’]’ returned non-zero exit status 255. File “/usr/lib/python3.9/site-packages/pki/server/pkispawn.py”, line 568, in main deployer.spawn() File “/usr/lib/python3.9/site-packages/pki/server/deployment/ **init**.py”, line 4985, in spawn scriptlet.spawn(self) File “/usr/lib/python3.9/site-packages/pki/server/deployment/scriptlets/configuration.py”, line 197, in spawn deployer.finalize\_subsystem(subsystem) File “/usr/lib/python3.9/site-packages/pki/server/deployment/ **init**.py”, line 4772, in finalize\_subsystem self.finalize\_kra(subsystem) File “/usr/lib/python3.9/site-packages/pki/server/deployment/ **init**.py”, line 4654, in finalize\_kra self.add\_kra\_connector(subsystem, ca\_url) File “/usr/lib/python3.9/site-packages/pki/server/deployment/ **init**.py”, line 4207, in add\_kra\_connector subprocess.check\_call(cmd) File “/usr/lib64/python3.9/subprocess.py”, line 373, in check\_call raise CalledProcessError(retcode, cmd) 2025-04-15T10:38:49Z CRITICAL Failed to configure KRA instance ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [April 16, 2025, 10:31am UTC](https://forums.rockylinux.org/t/freeipa-kra-install-fails-on-rocky-9-replica-from-rocky-8-cluster/18187/2 "2025-04-16T10:31:59Z")
Welcome to the forums! > [@jbran](#): > > I have a freeipa setup on rocky 8 and is trying to upgrade to rocky9 by adding a replica to the cluster. the base packages seems to work fine but when I try to install KRA on the new host it fails. This is an interesting issue and sounds like a bug I had seen in other deployments and other IPA versions. What I’m thinking is the issue here is that there is a mismatch between the NSS DB and configuration file for pki-tomcat. Here’s what I’d try to do: On the CA/KRA server (Rocky Linux 8): - Ensure you have taken a backup of the system and/or have ran `ipa-backup`. - Take a backup of /etc/pki/pki-tomcat/ca/CS.cfg - Run `certutil -L -d /etc/pki/pki-tomcat/alias -n 'transportCert cert-pki-kra' -a | grep -v ' CERTIFICATE' | tr -d '\n\r'` - This should make the certificate a single line. - Edit `/etc/pki/pki-tomcat/ca/CS.cfg` and find the line `ca.connector.KRA.transportCert` and replace the value with the above output. - `systemctl restart pki-tomcatd@pki-tomcat` to restart CA/KRA - Remove the broken replica with `ipa server-del ipa05.dev.ngc.dk` - On the broken replica, `ipa-server-install --uninstall -U` After that, you can try to re-run the `ipa-replica-install` with `--setup-kra` or run `ipa-replica-install` and then `ipa-kra-install` afterwards. ---
**Author:** ![jbran](https://avatars.discourse-cdn.com/v4/letter/j/85e7bf/32.png) [@jbran](https://forums.rockylinux.org/u/jbran)\ **Post date:** [April 16, 2025, 12:33pm UTC](https://forums.rockylinux.org/t/freeipa-kra-install-fails-on-rocky-9-replica-from-rocky-8-cluster/18187/3 "2025-04-16T12:33:41Z")
That was it Thanks you very much 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [June 15, 2025, 12:34pm UTC](https://forums.rockylinux.org/t/freeipa-kra-install-fails-on-rocky-9-replica-from-rocky-8-cluster/18187/4 "2025-06-15T12:34:39Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.