Ian Pilcher via FreeIPA-users wrote:
On 5/20/21 7:52 AM, Rob Crittenden via FreeIPA-users wrote:
> Florence Renaud via FreeIPA-users wrote:
>> Hi Ian,
>> with IPA 4.6.8 you just need to follow the 389ds doc.
>> The procedure was more complex in version < 3.2.2 because there were two
>> 389ds instances (one for the regular suffix and one for the Certificate
>> Server) and the password has to be manually synchronized between the 2,
>> and the replica installation was done using a different procedure (you
>> had to prepare a replica file containing passwords, private keys,
>> certificates and then transfer this file on the future replica).
> The PKCS#12 file of the CA root generated by IPA during installation is
> protected by the DM password.
> An updated file can be generated using PKCS12Export if desired.
This is where it gets confusing.
I can see the PKCS#12 file in /root. I've changed my DM password, but I
haven't regenerated the file. Is this going to cause problems later on?
Not directly but this contains the CA private key and we generally
recommend saving it off somewhere. If you can't open the file because
you don't know the password then it does you no good.