Corey Devenport via FreeIPA-users wrote:
I'm pretty sure this is expected to be single-valued. The
usercertificate should be ok being multi-valued.
So should I delete one of the descriptions from LDAP? Then the question is which one, the
ipa servers seem to all have the 805175304 description, so should I remove the 804978693
description?
I have tried editing the ra-agent.pem to use the other cert associated with the other
certificate, but this doesn't seem to change anything
It's a separate package not installed by default.
rob
I was able to install ipa-healthcheck, and running it gave the same ole error of not being
able to communicate with CMS:
Loading instance: pki-tomcat
Loading global Tomcat config: /etc/tomcat/tomcat.conf
Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf
Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf
Loading password config: /etc/pki/pki-tomcat/password.conf
Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
Loading subsystem: ca
Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg
Getting sslserver cert info for ca from CS.cfg
Getting subsystem cert info for ca from CS.cfg
Getting audit_signing cert info for ca from CS.cfg
Getting ocsp_signing cert info for ca from CS.cfg
Getting signing cert info for ca from CS.cfg
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
Unhandler rdtype 28
Unhandler rdtype 28
Unhandler rdtype 28