Hi Flo,
On 7/11/19 7:58 PM, Florence Blanc-Renaud via FreeIPA-users wrote:
On 7/11/19 10:19 AM, Harald Dunkel via FreeIPA-users wrote:
>
> The ldapsearch line returns 2 identical certificates on ipa{0,1,2,bak},
> but ipa1 has a 3rd certificate.
>
> Please don't tell me that my ldap instances are out of sync again.
I hate to bring bad news, but it really looks like replication failed between your
instances. Feel free to start a new thread on the users mailing list if you need
assistance.
Wouldn't you agree that freeipa should net get out of sync when
the certificate is renewed? It would be very nice if this issue
could be fixed.
The assumption here is, that freeipa was in sync *before* ipa1
tried to renew the certificate. Is there some way to verify that
the renewal did or did not break synchronization?
Coming back to your original issue, ipa host-del should work if
executed on ipa1 (the one with the renewed cert).
Unfortunately it doesn't:
[root@ipa1 ~]# ipa host-del ppcl027.ac.aixigo.de
ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS
(404)
Every helpful comment is highly appreciated
Harri