Hi,
thank you for your hint. I tried to delete the files and re-run the
"ipa-pkinit-manage enable". Unfortunately, it still seemed to get stuck.
---
I found some valuable information then in the "/var/log/messages":
certmonger: 2019-02-19 02:29:18 [14377] Error 7 connecting to
https://<new_ipa_host>:8443/ca/ee/ca/profileSubmitSSLClient: Couldn't connect to
server.
...<repeats>....
Well, there is no CA on this host (and 8443 is not listening). However, I tried to install
the replica with the "--setup-ca" argument once and this may be an issue.
This lead me to issue 7795:
https://pagure.io/freeipa/issue/7795
---
I tried to apply the patch you submitted at
https://pagure.io/freeipa/c/778521053336a4ba09923b4b1f9cac0dff72f634 to the
/usr/lib/python2.7/site-packages/ipaserver/install/krbinstance.py. Since the package
"ipaserver.masters" is not part of my release version, I simply set
localhost_has_ca to False.
---
After re-running the approach above (rm key/crt and ipa-pkinit-manage enable), we now get
in log/messages:
...
certmonger: Request for certificate to be stored in file
"/var/kerberos/krb5kdc/kdc.crt" rejected by CA.
...
I tried kdestroy / kinit admin to make sure, the new IPA has valid tickets - didn't
change the situation.
---
So, I check the logs on the IPA master:
/var/log/httpd/error_log:
[:error] [pid 23785] ipa: INFO: [xmlserver] host/<new-IPA>@<domain>:
cert_request(u'', profile_id=u'KDCs_PKINIT_Certs',
principal=u'krbtgt/<domain>@<domain>', add=True,
version=u'2.51'): ACIError
I looked for some log files processed by the CA on port 8443, but nothing seemed
suspicious there (e.g. /var/log/pki/pki-tomcat/ca/debug).
---
Right now:
openssl x509 -noout -text -in /var/kerberos/krb5kdc/kdc.crt | grep Issuer
Issuer: O=DE.BIGDATA.DIR, CN=<new-IPA-Host>
That is not the CA.
---
I will try the Replication on a fresh host tomorrow.
Kind regards
Adrian