Sequence of events in trying to stand up a new IPA server to
replace (wholesale) our old ones.
1. Built new box, which joined the existing IPA infrastructure as
a client.
2. # ipa-client-install -U --uninstall
3. # ipa-server-install --setup-dns --auto-reverse
--no-forwarders
4. Inserted data using custom scripts which had pulled out and
parsed data from existing servers to set up users, hosts, dns
entries, etc.
5. Tried to connect to server via firefox and was denied due to
SEC_ERROR_REUSED_ISSUER_AND_SERIAL
6. Googled a lot.
7. Tried removing existing CA cert from firefox. No joy. It
refused to be removed.
8. Tried setting up a new profile in firefox. It got the old cert
as well.
9. Tried removing the cert using certutil -D. Now httpd won't
start.
10. Backed up the server using the ipa-backup script.
11. Delete /etc/httpd/alias and restored the data from ipa-backup
using ipa-restore.
12. Httpd won't start. *Sigh*.
13. Ran ipa-server-install -U --uninstall
14. # ipa-server-install as above
15. # ipa-restore -data /path/to/backup
And now I'm back where I was. IPA is running and contains our
user, host, and DNS data (plus others) from the original hosts but
I can't connect to it using firefox. Any other possible solutions
to this problem?
We're using the same realm & network name, and we have to do
that.