Hello Rob,
I saw this post last night (Finland time) and decided to give it a shot first thing in the morning. My setup: 2x CentOS 7.7 (ipa-server 4.6.5) with a cross forest trust to 2012 R2 AD domain. Ran ipa-healthcheck --failures-only on the first master and it returned 0 issues as expected. Then I ran it on the replica and it printed out this: [ { "source": "ipahealthcheck.ipa.certs", "kw": { "msg": "Request for certificate failed, <TagSet object, tags 0:32:16> not in asn1Spec: <OctetString schema object, tagSet <TagSet object, tags 0:0:4>, encoding iso-8859-1>", "key": "20181207074138" }, "uuid": "34135eaf-31be-49a2-b101-b449b904d5af", "duration": "2.261236", "when": "20191106055010Z", "check": "IPACertRevocation", "result": "ERROR" }, { "source": "ipahealthcheck.ipa.certs", "kw": { "msg": "Request for certificate failed, <TagSet object, tags 0:32:16> not in asn1Spec: <OctetString schema object, tagSet <TagSet object, tags 0:0:4>, encoding iso-8859-1>", "key": "20181207073914" }, "uuid": "018787f8-dfc3-4b4b-ac16-777d3f651282", "duration": "3.471975", "when": "20191106055011Z", "check": "IPACertRevocation", "result": "ERROR" }, { "source": "ipahealthcheck.ipa.certs", "kw": { "msg": "Request for certificate failed, <TagSet object, tags 0:32:16> not in asn1Spec: <OctetString schema object, tagSet <TagSet object, tags 0:0:4>, encoding iso-8859-1>", "key": "20181207073850" }, "uuid": "8e4573f8-9a74-4b6e-ac2c-45cddb181521", "duration": "3.782566", "when": "20191106055011Z", "check": "IPACertRevocation", "result": "ERROR" }, { "source": "ipahealthcheck.ipa.certs", "kw": { "msg": "Request for certificate failed, <TagSet object, tags 0:32:16> not in asn1Spec: <OctetString schema object, tagSet <TagSet object, tags 0:0:4>, encoding iso-8859-1>", "key": "20181207074203" }, "uuid": "02628931-d6c6-479e-b473-e93f626841eb", "duration": "4.037205", "when": "20191106055012Z", "check": "IPACertRevocation", "result": "ERROR" } ]
The replica has never had any problems and https://github.com/peterpakos/checkipaconsistency reports no problems. I was wondering if this is something that I should fix on the replica or something that needs to be fixed in your magnificent tool that you so kindly backported?
I can provide any diagnostics and/or logs as needed.
- Kimmo