Hi Rob,
On 7/17/19 9:27 PM, Rob Crittenden via FreeIPA-users wrote:
The renewal certificates are passed via the main IPA backend. Check to
see if that replication is working.
It is not:
[root@ipa1 ~]# ipa-csreplica-manage list -v ipa0.example.de
Directory Manager password:
ipa1.example.de
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (-11) Problem connecting to replica - LDAP error: Connect
error (connection error)
last update ended: 1970-01-01 00:00:00+00:00
The others show connection errors as well. ipa-replica-manage (without
"cs") doesn't mention any connection problems.
Is it possible that these connection errors occur *because* the
new certificate is not installed yet, and because the old certificate
is not trusted anymore?
Please note also that pki-tomcatd refuses to start on any host except
for ipa1. Error message: Authentication error. See below for the debug
log. Might be unrelated.
Regards
Harri