Hello Rob,
I saw this post last night (Finland time) and decided to give it a shot first thing in the
morning.
My setup:
2x CentOS 7.7 (ipa-server 4.6.5) with a cross forest trust to 2012 R2 AD domain.
Ran ipa-healthcheck --failures-only on the first master and it returned 0 issues as
expected. Then I ran it on the replica and it printed out this:
[
{
"source": "ipahealthcheck.ipa.certs",
"kw": {
"msg": "Request for certificate failed, <TagSet object, tags
0:32:16> not in asn1Spec: <OctetString schema object, tagSet <TagSet object, tags
0:0:4>, encoding iso-8859-1>",
"key": "20181207074138"
},
"uuid": "34135eaf-31be-49a2-b101-b449b904d5af",
"duration": "2.261236",
"when": "20191106055010Z",
"check": "IPACertRevocation",
"result": "ERROR"
},
{
"source": "ipahealthcheck.ipa.certs",
"kw": {
"msg": "Request for certificate failed, <TagSet object, tags
0:32:16> not in asn1Spec: <OctetString schema object, tagSet <TagSet object, tags
0:0:4>, encoding iso-8859-1>",
"key": "20181207073914"
},
"uuid": "018787f8-dfc3-4b4b-ac16-777d3f651282",
"duration": "3.471975",
"when": "20191106055011Z",
"check": "IPACertRevocation",
"result": "ERROR"
},
{
"source": "ipahealthcheck.ipa.certs",
"kw": {
"msg": "Request for certificate failed, <TagSet object, tags
0:32:16> not in asn1Spec: <OctetString schema object, tagSet <TagSet object, tags
0:0:4>, encoding iso-8859-1>",
"key": "20181207073850"
},
"uuid": "8e4573f8-9a74-4b6e-ac2c-45cddb181521",
"duration": "3.782566",
"when": "20191106055011Z",
"check": "IPACertRevocation",
"result": "ERROR"
},
{
"source": "ipahealthcheck.ipa.certs",
"kw": {
"msg": "Request for certificate failed, <TagSet object, tags
0:32:16> not in asn1Spec: <OctetString schema object, tagSet <TagSet object, tags
0:0:4>, encoding iso-8859-1>",
"key": "20181207074203"
},
"uuid": "02628931-d6c6-479e-b473-e93f626841eb",
"duration": "4.037205",
"when": "20191106055012Z",
"check": "IPACertRevocation",
"result": "ERROR"
}
]
The replica has never had any problems and
https://github.com/peterpakos/checkipaconsistency reports no problems.
I was wondering if this is something that I should fix on the replica or something that
needs to be fixed in your magnificent tool that you so kindly backported?
I can provide any diagnostics and/or logs as needed.
- Kimmo