rui liang via FreeIPA-users wrote:
No because of the older version you have.
What you might be able to do if this is running on a VM is snapshot it
then bring a copy up on an isolated network so you can try the renewal
and see how long things may be offline and get the procedure down.
Moving forward I'd suggest:
- Upgrading more frequently to keep up with bug fixes
- Creating at least one additional CA to avoid a single point of failure
- Running ipa-healthcheck to watch for issues
rob
rui liang via FreeIPA-users wrote:
No because of the older version you have.
What you might be able to do if this is running on a VM is snapshot it
then bring a copy up on an isolated network so you can try the renewal
and see how long things may be offline and get the procedure down.
Moving forward I'd suggest:
- Upgrading more frequently to keep up with bug fixes
- Creating at least one additional CA to avoid a single point of failure
- Running ipa-healthcheck to watch for issues
rob
I also tried to install it in this way before, but it was the same mistake as
above and failed.
ssh
fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com
1:#ipa host-add
fs-hiido-ca2-65-155.hiido.host.yydevops.com --random
2:#ipa hostgroup-add-member ipaservers --hosts
fs-hiido-ca2-65-155.hiido.host.yydevops.com
ssh
fs-hiido-ca2-65-155.hiido.host.yydevops.com
3:#apt install -y freeipa-server
4: #ipa-replica-install -p 'xxx' --server
fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com --domain
hiido.host.yydevops.com
--realm
YYDEVOPS.COM