William thank you for reply,  bellow is  output  for certl cmd for this host with error( Failed to get the default state of cipher)

To deploy almost identical ldap hosts , the Sys Admin here is using Puppet but  unfortunelly are always issues with  rpms version mismatch and cfg , can you suggest another solution to deploy multiple ldap hosts all running same version and almost same  cfg , only diff in ldap   hosts is  the name of DS instance  aka :ldap*


Here is the output s per your request:

certutil -L -d /etc/dirsrv/slapd-ldap2/


Certificate Nickname                                         Trust Attributes



n1-2.xxx.xxx.xx                                                u,u,u

XX Internal Root CA                                        CT,,

XX Internal CA                                             CT,,





From: William Brown <wbrown@suse.de>

Subject: [389-users] Re: 389-DS Failed to get the default state of


To: "389-users@lists.fedoraproject.org"


Message-ID: <87B2EB8A-BA13-4F9B-979E-252D5423C0C1@suse.de>

Content-Type: text/plain;       charset=utf-8




> we have another host with same version and suppose same cfg but never

> saw the error,


> [24/Jun/2020:09:22:54.687024072 -0700] - ERR - Security Initialization

> - _conf_setallciphers - Failed to get the default state of cipher

> (null)


I'm curious - how did you make a host with the same config? Normally with 389 you need to configure both individually to look the same but you can't copy-paste config files etc.


My guess here is that perhaps your nss db isn't configured properly, so I'd want to see the output of certutil -L -d /etc/dirsrv/slapd-<instance>/ on the affected host.




William Brown