Harald Dunkel wrote:
Hi Rob,
On 7/23/19 4:01 PM, Rob Crittenden wrote:
>
> It's a red herring. There is a chicken and egg problem here. The KDC
> uses LDAP as its backend and 389-ds needs a ticket. 389-ds starts first,
> can't get a ticket and then eventually recovers once the KDC is running.
>
> rob
>
You mean pki-tomcatd doesn't start because slapd did not recover yet?
It waited for a pretty long time (5 or 10 minutes), so I wonder how
long pki-tomcatd would have to wait? How comes this wasn't an issue
until some certs got renewed?
This has nothing to do with pki-tomcatd.
I would guess this chicken-and-egg problem always existed, but now
somebody shot the rooster.
BTW, it would be nice to have an option in ipactl to restart a single
service, e.g.
ipactl restart pki-tomcatd
This is already possible using systemctl.
rob