After googling i tried to run following test on ldap-b-3 (new replica
where it failed and got following)
[root@ldap-b-3 tmp]# python ipa-custodia-check.in `hostname` --verbose
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: Platform:
Linux-3.10.0-514.el7.x86_64-x86_64-with-centos-7.3.1611-Core
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: IPA version: 4.6.5
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: IPA vendor version:
4.6.5-11.el7.centos
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: Realm:
EXAMPLE.COM
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: Host:
ldap-b-3.example.com
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: Remote server:
ldap-b-3.example.com
[2019-09-18T16:33:51 ipa-custodia-tester] <WARNING>: Performing self-test only.
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: File
'/etc/ipa/default.conf' exists.
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: File
'/etc/krb5.keytab' exists.
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: File
'/etc/ipa/custodia/custodia.conf' exists.
[2019-09-18T16:33:51 ipa-custodia-tester] <INFO>: File
'/etc/ipa/custodia/server.keys' exists.
[2019-09-18T16:33:51 ipa-custodia-tester] <ERROR>: Failed to create
client: Incorrect number of results (0) searching for public key for
host/ldap-b-3.example.com(a)EXAMPLE.COM
Traceback (most recent call last)
File "ipa-custodia-check.in", line 178, in check_client
realm=self.realm,
File "/usr/lib/python2.7/site-packages/ipaserver/secrets/client.py",
line 64, in __init__
self.kemcli = KEMClient(self._server_keys(server, realm),
File "/usr/lib/python2.7/site-packages/ipaserver/secrets/client.py",
line 27, in _server_keys
sk = JWK(**json_decode(self.ikk.find_key(principal, KEY_USAGE_SIG)))
File "/usr/lib/python2.7/site-packages/ipaserver/secrets/kem.py",
line 225, in find_key
return conn.get_key(usage, kid)
File "/usr/lib/python2.7/site-packages/ipaserver/secrets/kem.py",
line 80, in get_key
"public key for %s" % (len(r), principal))
ValueError: Incorrect number of results (0) searching for public key
for host/ldap-b-3.example.com(a)EXAMPLE.COM
[ERROR] One or more tests have failed.