Troubleshooting

Logs, service checks, and common installation or setup failures.

Initial diagnostics

adpki status
sudo adpki logs
sudo systemctl status nginx php8.4-fpm
sudo systemctl status adpki-ca adpki-worker adpki-reverb

Relevant logs:

/var/log/adpki/installer/adpki-install.log
/var/log/adpki/setup/adpki-setup.log
/var/log/adpki/backend/
/var/log/adpki/ca-core/
/var/log/adpki/nginx/
/var/log/letsencrypt/letsencrypt.log

Setup reports that the runtime is missing

adpki-setup only starts after adpki-install has completed and the Backend, Frontend, and CA Core payloads are present.

sudo adpki-install

Then verify:

test -x /opt/adpki/ca-core/adpki-ca
test -f /opt/adpki/backend/artisan
test -f /opt/adpki/frontend/dist/index.html

Database connection fails

verify host, port, database, and role
check firewall rules and pg_hba.conf on an existing PostgreSQL server
ensure the database and role already exist
grant CREATE and DROP privileges within the AD-PKI database

Connection test:

PGPASSWORD='<PASSWORD>' psql \
  -h '<DB-HOST>' -p 5432 -U '<DB-ROLE>' -d '<DB-NAME>' \
  -c 'SELECT version();'

TLS enrollment fails

The setup step requires:

a correctly resolved hostname,
reachable TCP port 80,
CA Core on 127.0.0.1:8080,
port 80 available while Certbot performs the challenge.

getent hosts pki.example.com
curl -I http://pki.example.com/
curl http://127.0.0.1:8080/acme/directory
sudo ss -lntp | grep -E ':(80|443)\b'

CA file is not found

The wizard accepts existing files only and expects absolute paths:

realpath ~/pki/root/certs/root-ca.cert.pem
realpath ~/pki/intermediate/certs/intermediate-ca.cert.pem
realpath ~/pki/intermediate/private/intermediate-ca.key.pem

Validate certificates and keys before importing them:

openssl x509 -noout -subject -issuer -in <CERTIFICATE>
openssl pkey -check -in <PRIVATE-KEY>