Stay with me while i explain my issue because its little complex, We
had 2 working ldap running in datacenter-A for many months and life
Last year company decided to shutdown datacenter-A and migrate
everything from there to new datacenter-B.
This is what i did for migration, I have created two new LDAP server
in Datacenter-B and run create replica from Datacenter-A ( but my bad
luck we forgot to do --setup-ca option which create CA replica) In
short we have no CA running in new datacenter-B
Fun part start now. so finally few months back we shutdown
datacenter-A and archived all data (LDAP was running in VMware so we
archived vmdk), after 8 month we found our LDAP server running under
load so we decided to create more replica and we found we have no CA
master so we can't create replica. Damn it.
We dig into datacenter-A archived and start ldap-ca-master start on
new IP address we gave it same DNS name so it won't create any issue,
when i start ldap-ca-master it started throwing error that some certs
expired blah..blah.. so finally i renew them and this LDAP looks good
now CA is also running.
ldap-ca-master (This is old datacenter LDAP with CA, awakened few days ago)
ldap-b-1 (new datacenter LDAP without CA)
ldap-b-2 (new datacenter LDAP without CA)
Now i am trying to create new ldap-b-3 in new datacenter using
ldap-b-1 as my master to create new replica and somehow i am getting
RuntimeError: Certificate issuance failed (CA_REJECTED: Server at
failed request, will retry: 4035
(RPC failed at server. Request failed with status 404: Non-2xx
response from CA REST API: 404. ).)
Installation failed. Rolling back changes.
Unenrolling client from IPA server
Unenrolling host failed: RPC failed at server. invalid 'hostname': An
IPA master host cannot be deleted or disabled
1. My all other ldap running 4.5.x but new replica is on 4.6 not sure
that is the issue here or not?
2. I can see ldap-ca-master node isn't fully sync with ldap-b-1 and
ldap-b-2 because i brought that machine in life after 8 month (do you
think i should do force sync ldap-ca-master to sync with ldap-b-1 ?)
3. Should i use ldap-ca-master to create replica or i can pick any
node to create replica?
What are the options i have here to troubleshoot this issue?
Look in /etc/httpd/conf.d/ipa-pki-proxy.conf for a section like:
Show us the full contents.
See what URL is being requested in /var/log/httpd/access_log
ipa-replica-manage list -v `hostname` on all the masters will show you
the current status.