Created attachment 1272108
rhel69 master pki debug

Description of problem:
During Replica install on RHEL-7.4 from RHEL-6.9 master, pki instance creation
fails with following error message.

------------------------------
  [10/28]: importing RA certificate from PKCS #12 file
  [error] CalledProcessError: Command '/usr/bin/openssl pkcs12 -in
/tmp/tmpmNC1Eiipa/realm_info/ra.p12 -nocerts -nodes -out
/var/lib/ipa/ra-agent.key -passin pass:' returned non-zero exit status 1
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
Command '/usr/bin/openssl pkcs12 -in /tmp/tmpmNC1Eiipa/realm_info/ra.p12
-nocerts -nodes -out /var/lib/ipa/ra-agent.key -passin pass:' returned non-zero
exit status 1
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for
more information
[root@hp-dl380pgen8-02-vm-7 ~]#

------------------------------

Version-Release number of selected component (if applicable):
6.9 master
-----------
[root@kvm-guest-03 ~]# rpm -q pki-ca ipa-server
pki-ca-9.0.3-53.el6.noarch
ipa-server-3.0.0-51.el6.x86_64
[root@kvm-guest-03 ~]#

7.4 replica
------------
[root@hp-dl380pgen8-02-vm-7 ~]# rpm -q ipa-server pki-ca selinux-policy
ipa-server-4.5.0-6.el7.x86_64
pki-ca-10.4.1-1.el7.noarch
selinux-policy-3.13.1-142.el7.noarch
[root@hp-dl380pgen8-02-vm-7 ~]#
[root@hp-dl380pgen8-02-vm-7 ~]# getenforce
Permissive
[root@hp-dl380pgen8-02-vm-7 ~]# cat /var/log/audit/audit.log |audit2allow
#============= gssproxy_t ==============
allow gssproxy_t self:capability dac_override;
#============= tomcat_t ==============
allow tomcat_t user_tmp_t:file open;
[root@hp-dl380pgen8-02-vm-7 ~]#


How reproducible:
Always

Steps to Reproduce:
1. Install RHEL-6.9 master
2. Preate replica gpg for RHEL-7.4 replica
3. Install replica on RHEL-7.4 using gpg file from step 2

Actual results:
Replica install fails

Expected results:
Replica install should be successful

Additional info:
Please find the attached pki debug log from Master and Replica