Provisioning Server Service Does Not Start - Error Code 21

Products

• CA Identity Manager
• CA Identity Portal
• CA Directory

Issue/Introduction

After either rebooting the Provisioning Server machine or restarting all DSAs and the Provisioning Server, the Provisioning Server service does not start.

From Service window we have the error message:

"error code 21"

Environment

Identity Manager 14.5 & 15

Cause

The im_ps.log file display the following messages:

[14:21:06.078:00000B38] reading config file D:\Program Files (x86)\CA\Identity Manager\Provisioning Server\data\tls\server\fips.conf

TLS: can't connect.

[14:21:09.218:00000B38] backend_startup: bi_db_open 0 failed!

[14:21:09.265:00000B38] slapd stopped.

[14:21:09.265:00000B38] connections_destroy: nothing to destroy.

Cause could be bad or expired DSA personality certs and/or the trusted root CA has a mismatch with DSA personality certs.

Resolution

To ensure successful certificate trust and replication in your environment, follow these detailed procedures to append your trusted root CA and synchronize files across cluster nodes.

1. Appending the Trusted Root CA (trusted.pem to impd_trusted.pem)

After regenerating your certificates with dxcertgen, you must update the impd_trusted.pem file to ensure the DSAs recognize the new root CA.

1. Open trusted.pem: Navigate to your %DXHOME%\config\ssld directory and open the trusted.pem file in a text editor (such as Notepad or Notepad++).
2. Locate the Certificate: Scroll to the very end of the file. You are looking for the last certificate block, which begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----.
3. Copy the Block: Highlight and copy this entire block, including the header and footer lines.
4. Open impd_trusted.pem: Open the existing impd_trusted.pem file located in the same directory.
5. Append the Content:
   • Place your cursor at the end of the existing content in impd_trusted.pem.
   • Press Enter to start a new line if necessary.
   • Paste the copied certificate block from trusted.pem.
6. Save and Close: Save the file and close the editor.

2. Synchronizing Files in a Clustered Environment

If you are running in a cluster, changes must be applied to all nodes. Perform the certificate generation and appending steps on one primary node first, then propagate the files.

1. Identify Required Files: On the primary node where you performed the regeneration and appending, gather the following files from %DXHOME%\config\ssld:
   • impd_trusted.pem (the updated file from the step above).
   • All personality certificate files (typically named *-<DSA_Name>.pem).
2. Stop Services on Secondary Nodes: Ensure all DSAs and Connector Servers are stopped on all secondary nodes in the cluster using dxserver stop all.
3. Transfer Files:
   • Copy the gathered files from the primary node to the corresponding %DXHOME%\config\ssld directory on each secondary node.
   • Ensure the existing files on the secondary nodes are overwritten or replaced by these new versions.
4. Verify Permissions: After copying, verify that the file permissions on the secondary nodes match those on the primary node (especially if you are working in a Linux/Unix environment) to ensure the dsa user can read them.
5. Restart Services: Once the files are in place, restart the DSAs (dxserver start all) and the Connector Servers on all nodes in the cluster.