I think I (finally) figured out what went wrong, but I have no idea how to proceed. Somehow I missed an error during the setup, and so now I think whatever CA I had has been clobbered and rendered useless (since it was wiped and reinstalled after this error occurred):
Please don't read too much into any typos below -- I had to type this by hand as the originals are on an internal development network and this was actually faster than transferring files in this direction.I've also just realized that replication appears to have ceased; I have entries in some IPA servers but not all.
[root@zsipa ~]# ipa-replica-manage list
Directory Manager password:
zsipa.damascusgrp.com: master
zsipa2.damascusgrp.com: master
zsipa3.damascusgrp.com: master
[root@zsipa ~]# ipa-replica-manage list zsipa.damascusgrp.com
Directory Manager password:
zsipa3.damascusgrp.com: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (19) Replication error acquiring replica: Replica has different database generation ID, remote replica may need to be initialized (RUV error)
last update ended: 1970-01-01 00:00:00+00:00
[root@zsipa ~]#Only zsipa3 is listed as a replica anywhere, and it's not a functioning one. I can set up replication between zsipa and zsipa2, but is there a good way to bring zsipa3 back in line as well?
The background is that we attempted to do a rolling update of our IPA servers by bringing in a new server, zsipa2, and then upgrading each of the other two from Fedora to Centos 7 and then initialized them as replicas of zsipa2. But apparently, this didn't work as we had thought. So add replication errors to the certificate issue I'm still trying to run to ground.