Pressed Send too soon:
Some additional information from the new IPA Host:
---
ipa-getcert list:
Request ID '20190219024400':
status: CA_REJECTED
ca-error: Server at https://<new-IPA-host>/ipa/xml failed request, will
retry: 4035 (RPC failed at server. Request failed with status 404: Non-2xx response from
CA REST API: 404. ).
stuck: yes
key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
---
/var/log/httpd/error_log:
[Tue Feb 19 03:48:32.410674 2019] [auth_gssapi:error] [pid 15991] [client
10.137.7.5:33828] NO AUTH DATA Client did not send any authentication headers, referer:
https://<new-IPA-Host>/ipa/xml
[Tue Feb 19 03:48:32.578948 2019] [:error] [pid 15677] ipa: INFO: [xmlserver]
host/<new-IPA-Host>@<domain>: cert_request(u'....',
profile_id=u'KDCs_PKINIT_Certs',
principal=u'krbtgt/<domain>@<domain>', add=True,
version=u'2.51'): HTTPRequestError
The cert_request payload matches the payload received at the IPA Master Host.