On ma, 03 joulu 2018, 74cmonty via FreeIPA-users wrote:
OK... following your advise and delete the "old" files.
Then run ipa-pkinit-manage enable and get this output:
[root@ipa-replica ~]# rm /var/kerberos/krb5kdc/kdc.crt
rm: reguläre Datei '/var/kerberos/krb5kdc/kdc.crt' entfernen? y
[root@ipa-replica ~]# rm /var/kerberos/krb5kdc/kdc.key
rm: reguläre Datei '/var/kerberos/krb5kdc/kdc.key' entfernen? y
[root@ipa-replica ~]# ipa-pkinit-manage enable
Configuring Kerberos KDC (krb5kdc)
[1/1]: installing X509 Certificate for PKINIT
PKINIT certificate request failed: Certificate issuance failed (CA_UNREACHABLE: Error 7
connecting to
https://ipa-replica.biszumbitterenen.de:8443/ca/ee/ca/profileSubmitSSLClient: Couldn't
connect to server.)
As this line says, certmonger was unable to to talk to
https://ipa-replica.biszumbitterenen.de:8443/ca/ee/ca/profileSubmitSSLClient
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland