On Thu, Jun 10, 2021, at 5:45 PM, Rob Crittenden wrote:
So you've run ipa-replica-prepare <host> and then ship that
file to
<host> right?
Exactly.
At some point we started re-generating the CA certs file
(/root/cacert.p12) during preparation. Did we do this in F21? I have no
idea.
Can you use pk12util to look at the contents of that file? The password
is the initial DM password. Look for expirations, things like that.
# pk12util -l /root/cacert.p12
All the "Not After" dates were in 2022 or 2034, and the "Not Before"
dates were all before 2020. So I that all seems fine.
You can generate a new one but it requires putting passwords into files
temporarily.
If you need to generate a new one make a backup of the current, put the
passwords in files per below and run this:
# PKCS12Export -d /etc/pki/pki-tomcat/alias/ -p /tmp/nssdbpwd -w
/tmp/pk12pwd -o /root/cacert.p12
The NSS db password is in /etc/pki/pki-tomcat/password.conf the value
internal.
Otherwise I'm not sure what would generate the socket error except a
real network issue. Can you run wireshark on the new server during the
install to see what is happening?
I could, but these two systems are both VM guests on the same VMware server, on the same
virtual subnet. But I will take a deep dive today into the network and see if I can find
anything there.
>
> rob
>
>