We are trying to combine services and servers into FreeIPA. We have opanldap for ldap, and a stand alone FreeIPA for CA / certs, this stand alone has the DNS component installed, which we don't want to use in our new environment. We want to migrate the old CA and openladp to a new FreeIPA cluster.
I did what you suggested here:

"Well, you can create a replica with a CA (`ipa-replica-install
--setup-ca` or `ipa-replica-install` and subsequent
`ipa-ca-install`).  They will be exact replicas, all keys and
certificates will be the same on both masters.  Then you can
separate them."

But the separated replica is always broken because of the master's DNS component. By broken I mean we can't log into the portal.

The openldap migration is done, it's just the CA and certs migration that I'm having problems with. 

On Thu, Oct 18, 2018 at 10:27 PM Fraser Tweedale <ftweedal@redhat.com> wrote:
On Thu, Oct 18, 2018 at 10:00:20AM -0400, Ralph Crongeyer via FreeIPA-users wrote:
> Hi Fraser,
> Actually my goal would be to have two identical stand alone servers. For
> instance maybe add a server as a replica and then separate them from each
> other, or maybe export the CA's and issued certs and then import them to a
> new server.But I'm not sure how to do either of those.
>
Well, you can create a replica with a CA (`ipa-replica-install
--setup-ca` or `ipa-replica-install` and subsequent
`ipa-ca-install`).  They will be exact replicas, all keys and
certificates will be the same on both masters.  Then you can
separate them.

> I did try to add a server as a replica and then run ipa-replica-manage del
> server-name on both, but when I try to delete the master from the replica
> it complains that it can't be removed. I tried ipa-replica-manage del
> master-server-name --force and that works but then the ipa tools break and
> I can no longer login to the web portal. So i know I'm doing something
> wrong.
>

I'm not sure what the problem is here.  Maybe someone else can weigh
in.  But in the end, I'm really not sure what problem you're trying
to solve.  Why would you want to create two identical masters and
then "divorce" them?  What problem are you trying to solve?

Cheers,
Fraser

> Any advice would be helpful.
>
> Thanks,
> Ralph
>
>
>
> > On Tue, Oct 16, 2018 at 7:18 PM Fraser Tweedale <ftweedal@redhat.com>
> > wrote:
> >
> >> On Tue, Oct 16, 2018 at 01:23:11PM -0400, Ralph Crongeyer via
> >> FreeIPA-users wrote:
> >> > Hello,
> >> > I have a FreeIPA server that is currently running as a CA only, no
> >> clients
> >> > connect, no LDAP entries have ever been made, no DNS etc... The original
> >> > ipa CA is how it was setup during the initial install.
> >> > A second CA was created, company.com CA, and certs have been created
> >> from
> >> > this CA.
> >> > I've setup two new freeipa boxes and have them replicated and migrated
> >> our
> >> > openldap users and groups.
> >> >
> >> > What we would like to do now is to export the company,com CA from the
> >> > "freeipa CA only" and import it into the new freeipa environment.
> >> > I haven't been able to find anything about doing this in my web
> >> searches so
> >> > far.
> >> >
> >> > Can somebody help me with this?
> >> >
> >> > Thanks,
> >> > Ralph
> >>
> >> Hi Ralph,
> >>
> >> It's not clear what you want to accomplish.  Do you want to:
> >>
> >> - Import the company.com CA certificate into FreeIPA so that IPA
> >>   servers and clients will use it as a trusted CA?
> >>   (Use `ipa-cacert-manage install` to do this).
> >>
> >> - Reissue the IPA CA certificate as a subordinate of the company.com
> >>   CA?  You can use `ipa-cacert-manage renew --external-ca` to do
> >>   this.
> >>
> >> - Something else?
> >>
> >> Cheers,
> >> Fraser
> >>
> >

> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org