Hi Fraser,
Actually my goal would be to have two identical stand alone servers. For instance maybe add a server as a replica and then separate them from each other, or maybe export the CA's and issued certs and then import them to a new server.But I'm not sure how to do either of those.

I did try to add a server as a replica and then run ipa-replica-manage del server-name on both, but when I try to delete the master from the replica it complains that it can't be removed. I tried ipa-replica-manage del master-server-name --force and that works but then the ipa tools break and I can no longer login to the web portal. So i know I'm doing something wrong.

Any advice would be helpful.

Thanks,
Ralph 



On Tue, Oct 16, 2018 at 7:18 PM Fraser Tweedale <ftweedal@redhat.com> wrote:
On Tue, Oct 16, 2018 at 01:23:11PM -0400, Ralph Crongeyer via FreeIPA-users wrote:
> Hello,
> I have a FreeIPA server that is currently running as a CA only, no clients
> connect, no LDAP entries have ever been made, no DNS etc... The original
> ipa CA is how it was setup during the initial install.
> A second CA was created, company.com CA, and certs have been created from
> this CA.
> I've setup two new freeipa boxes and have them replicated and migrated our
> openldap users and groups.
>
> What we would like to do now is to export the company,com CA from the
> "freeipa CA only" and import it into the new freeipa environment.
> I haven't been able to find anything about doing this in my web searches so
> far.
>
> Can somebody help me with this?
>
> Thanks,
> Ralph

Hi Ralph,

It's not clear what you want to accomplish.  Do you want to:

- Import the company.com CA certificate into FreeIPA so that IPA
  servers and clients will use it as a trusted CA?
  (Use `ipa-cacert-manage install` to do this).

- Reissue the IPA CA certificate as a subordinate of the company.com
  CA?  You can use `ipa-cacert-manage renew --external-ca` to do
  this.

- Something else?

Cheers,
Fraser