Hello everyone.

I send you this mail because I try to connect an ipa-client 4.6.4 on RHEL7 to an ipa-server 3.0.0 on RHEL6 and I get the following message when I try to register the client to the server :
###
ipa-client-install  \
--domain=<MY_DOMAIN> \
--realm=<MY_REALM> \
--server=<MY_IPA_MASTER> \
--principal=admin \
--password='<admin_password>'  \
--mkhomedir  \
--hostname=<MY_CLIENT_HOST> \
--no-ntp \
--no-ssh \
--no-sshd \
--unattended \

###

And here is the error I got :
###
WARNING: yacc table file version is out of date
Client hostname: <MY_CLIENT_HOST>
Realm: <MY_REALM>
DNS Domain: <MY_DOMAIN>
IPA Server: <MY_IPA_MASTER>
BaseDN: dc=<MY_REALM>

Skipping synchronizing time with NTP server.
Please make sure the following ports are opened in the firewall settings:
     TCP: 80, 88, 389
     UDP: 88 (at least one of TCP/UDP ports 88 has to be open)
Also note that following ports are necessary for ipa-client working properly after enrollment:
     TCP: 464
     UDP: 464, 123 (if NTP enabled)
Installation failed. Rolling back changes.
Unconfigured automount client failed: Command 'ipa-client-automount --uninstall --debug' returned non-zero exit status 1
Failed to start certmonger: Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1
Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1
Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
[root@<MY_CLIENT_HOST> ~]# /bin/systemctl start certmonger.service
Job for certmonger.service failed because the control process exited with error code. See "systemctl status certmonger.service" and "journalctl -xe" for details.
[root@<MY_CLIENT_HOST> ~]# systemctl status certmonger.service
● certmonger.service - Certificate monitoring and PKI enrollment
   Loaded: loaded (/usr/lib/systemd/system/certmonger.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Mon 2019-08-26 11:42:20 CEST; 27s ago
  Process: 21027 ExecStart=/usr/sbin/certmonger -S -p /var/run/certmonger.pid -n $OPTS (code=exited, status=1/FAILURE)
Main PID: 21027 (code=exited, status=1/FAILURE)

Aug 26 11:42:20 <MY_CLIENT_HOST> systemd[1]: Starting Certificate monitoring and PKI enrollment...
Aug 26 11:42:20 <MY_CLIENT_HOST> certmonger[21027]: 2019-08-26 11:42:20 [21027] Unable to set well-known bus name "org.fedorahosted.certmonger": Connection ":1.21663" is not allowed to own the service "or...tion file(-1).
Aug 26 11:42:20 <MY_CLIENT_HOST> certmonger[21027]: Error connecting to D-Bus.
Aug 26 11:42:20 <MY_CLIENT_HOST> systemd[1]: certmonger.service: main process exited, code=exited, status=1/FAILURE
Aug 26 11:42:20 <MY_CLIENT_HOST> systemd[1]: Failed to start Certificate monitoring and PKI enrollment.
Aug 26 11:42:20 <MY_CLIENT_HOST> systemd[1]: Unit certmonger.service entered failed state.
Aug 26 11:42:20 <MY_CLIENT_HOST> systemd[1]: certmonger.service failed.
###

When I retried the command, it said the client was already configured so I tried to unconfigure it with the following command :
###
ipa-client-install -U --uninstall
###

But then I got the following error :
###
The ipa-client-install command failed, exception: CalledProcessError: Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1
Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1

###

When I enable debug and check the logs, I can see a first error here :
###
Starting external process
args=/usr/bin/certutil -d dbm:/etc/ipa/nssdb -L -n Local IPA host -a -f /etc/ipa/nssdb/pwdfile.txt
Process finished, return code=255
stdout=
stderr=certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.

###

When I check the content of /etc/ipa/nssdb, I can find only this pwdfile.txt indeed.
When I check the content of this folder on another RHEL7 host, I see more content :
###
# ls -l /etc/ipa/nssdb/
total 80
-rw-r--r-- 1 root root 65536 Aug  9  2018 cert8.db
-rw-r--r-- 1 root root 16384 Aug  9  2018 key3.db
-rw------- 1 root root    40 Aug  9  2018 pwdfile.txt
-rw-r--r-- 1 root root 16384 Aug  9  2018 secmod.db

###

May you help me to understand and solve this problem please ?

I tried to use a client version lower than the 4.4.0 instead of 4.6.4 to register to a 3.0.0 server but I still have the same problem.


How can I properly uninstall the ipa-client to begin again from the start ?

Best regards.

Lune