amitj1jan--- via FreeIPA-users wrote:
By PROD/DR, I meant Production/Disaster Recovery environment.
And yes there are two IPA servers in both PROD/DR environment.
Also, came across the fact that while in PROD, SSL was implemented using self-signed
certs(where things r working), In DR environment CA signed certs were used later for SSL
Is there a chance something gone wrong in SSL implementation(using CA signed certs) and
resulting in this issue.
What can we do to resolve this issue?
We were thinking of two options, if above is true:
a. Possible work around, if it is there to fix this
a. or if "a" is not possible , revert to self-signed certs SSL
What u suggest.
I need more information on your environment. Are PROD and DR completely
separately installed IPA environments or do you just treat them as separate?
From your original e-mail (completely stripped out of your response) it
looked like the reverse of what you just said. PROD was using an IPA CA
and DR was using self-signed certs.
The underlying reason for the error is that on DR the NSS database was
replaced with a new one containing only self-signed certs. When a host
or service with a cert is deleted and a CA is configured IPA will
attempt to revoke the cert. This is where it is failing for you, because
ipaCert (the RA agent cert used to talk to dogtag) is completely missing.