William thank you for reply,  bellow is  output  for certl cmd for this host with error( Failed to get the default state of cipher)

To deploy almost identical ldap hosts , the Sys Admin here is using Puppet but  unfortunelly are always issues with  rpms version mismatch and cfg , can you suggest another solution to deploy multiple ldap hosts all running same version and almost same  cfg , only diff in ldap   hosts is  the name of DS instance  aka :ldap*

 

Here is the output s per your request:

certutil -L -d /etc/dirsrv/slapd-ldap2/

 

Certificate Nickname                                         Trust Attributes

                                                             SSL,S/MIME,JAR/XPI

 

n1-2.xxx.xxx.xx                                                u,u,u

XX Internal Root CA                                        CT,,

XX Internal CA                                             CT,,

 

Regards

Isabella

 

From: William Brown <wbrown@suse.de>

Subject: [389-users] Re: 389-DS Failed to get the default state of

              cipher

To: "389-users@lists.fedoraproject.org"

              <389-users@lists.fedoraproject.org>

Message-ID: <87B2EB8A-BA13-4F9B-979E-252D5423C0C1@suse.de>

Content-Type: text/plain;       charset=utf-8

 

 

>

> we have another host with same version and suppose same cfg but never

> saw the error,

>

> [24/Jun/2020:09:22:54.687024072 -0700] - ERR - Security Initialization

> - _conf_setallciphers - Failed to get the default state of cipher

> (null)

 

I'm curious - how did you make a host with the same config? Normally with 389 you need to configure both individually to look the same but you can't copy-paste config files etc.

 

My guess here is that perhaps your nss db isn't configured properly, so I'd want to see the output of certutil -L -d /etc/dirsrv/slapd-<instance>/ on the affected host.

 

Sincerely,

 

William Brown