I've got two ancient (3.1?) IPA servers that have been upgraded over time. Last
January things got really goofy with certificates and I got it all sorted. However, now
I've got an old issue creeping back in. The 'transportCert cert-pki-kra' is
mismatched between the CS.cfg and the tracked certificate. This is a multi-master setup.
The signing master seems to be the one that's off. It's tracking the updated
original 'transportCert cert-pki-kra' certificate. However, the
"secondary" master is tracking a newly generated 'transportCert
cert-pki-kra', which is also what both CS.cfg's are referencing. Neither one of
the certificates is expired. Everything else seems to be in working order. Here is
ipa-healthcheck's only relevant error:
"msg": "Certificate 'transportCert cert-pki-kra' does not
match the value of ca.connector.KRA.transportCert in
"key": "transportCert cert-pki-kra"
So, what should I copy where to get this sorted? It seems like the updated original
'transportCert cert-pki-kra' should be copied into the CS.cfg and then manually
scp the NSS files from "primary" to "secondary"? What commands would
you use to do this? I've got a lot of commands noted and am beginning to get confused
as to which ones should be used to get this sorted. Thanks.