Hi Rob,
On 7/19/19 3:45 PM, Rob Crittenden wrote:
Harald Dunkel via FreeIPA-users wrote:
>
> AFAICS the new certificates are in ldap on the non-renewal masters (e.g.
> ipa0). Here is the output of the suggested getcert session on ipa0:
>
> [root@ipa0 ~]# date
> Fri Jul 19 11:21:00 CEST 2019
> [root@ipa0 ~]# getcert resubmit -d /etc/pki/pki-tomcat/alias/ -n
> 'subsystemCert cert-pki-ca'
> Resubmitting "20181031072253" to "dogtag-ipa-ca-renew-agent".
> [root@ipa0 ~]# journalctl -xe
> Jul 19 11:20:54 ipa0.example.de server[2612]: at
>
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
...
> Jul 19 11:21:14 ipa0.example.de dogtag-ipa-ca-renew-agent-submit[32209]:
> Updated certificate not available
...
This is the important bit. The updated certificate is not in
cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX. This is why I asked if IPA
replication was working (not the CA replication). I'd start by looking
at this subtree on all masters to see what, if anything, is in it.
I haven't found a ldapsearch command to show me the certificate as a
pem file yet, but according to jxplorer ipa1 and ipa0 have the same
certificates in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX. Same "Thumprints".
I double checked esp. the CA Subsystem certificate.
The ldap database is in sync, wrt. the certificates in
cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX
ipa-replica-manage doesn't indicate any problems, either.
On ipa0:
[root@ipa0 ~]# ipa-replica-manage list -v ipa0.example.de
Directory Manager password:
ipa1.example.de: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:27:00+00:00
[root@ipa0 ~]# ipa-replica-manage list -v ipa1.example.de
Directory Manager password:
ipa0.example.de: replica
last init status: Error (0) Total update succeeded
last init ended: 2019-07-17 10:06:24+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:28:42+00:00
ipa2.example.de: replica
last init status: Error (0) Total update succeeded
last init ended: 2019-07-17 09:54:57+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:28:42+00:00
ipa3.example.de: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:28:42+00:00
ipa4.example.de: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:28:42+00:00
ipa5.example.de: replica
last init status: Error (0) Total update succeeded
last init ended: 2019-07-17 10:55:45+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:28:42+00:00
On ipa1:
[root@ipa1 ~]# ipa-replica-manage list -v ipa0.example.de
Directory Manager password:
ipa1.example.de: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:31:07+00:00
[root@ipa1 ~]# ipa-replica-manage list -v ipa1.example.de
Directory Manager password:
ipa0.example.de: replica
last init status: Error (0) Total update succeeded
last init ended: 2019-07-17 10:06:24+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:31:26+00:00
ipa2.example.de: replica
last init status: Error (0) Total update succeeded
last init ended: 2019-07-17 09:54:57+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:31:26+00:00
ipa3.example.de: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:31:26+00:00
ipa4.example.de: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:31:26+00:00
ipa5.example.de: replica
last init status: Error (0) Total update succeeded
last init ended: 2019-07-17 10:55:45+00:00
last update status: Error (0) Replica acquired successfully: Incremental update
succeeded
last update ended: 2019-07-19 15:31:26+00:00
New users are replicated to all ipa servers as well. AFAICS ldap
is in sync.
Would you suggest to do a re-initialize on ipa0 from ipa1 (the renewal-master)?
Regards
Harri