On 7/17/19 10:00 AM, Harald Dunkel via FreeIPA-users wrote:
On 7/16/19 2:39 PM, Harald Dunkel via FreeIPA-users wrote:
>
> ldapsearch -D cn=directory\ manager -W -b o=ipaca uid=pkidbuser
> userCertificate
>
> does not show the new certificate yet. I thought that the post-save
> command
> for this certificate is supposed to add it to ldap as well. Should I
> have used
> the ipa-getcert command instead?
Hi,
the renewal behaves differently on the renewal master and on other
nodes. On the renewal master, post-save will upload the new cert to the
LDAP entry, and replication will propagate this changes to the other
masters.
On a non-renewal master, the renewal obtains the cert from the local
LDAP, but does not write to LDAP (as the replication is supposed to have
executed this part).
I don't understand in your case how the getcert resubmit managed to
update the cert (because it's supposed to get it from the local LDAP
server), and according to the ldapsearch you did it's not present. Can
you double check the ldap search but with -h ipa2 -p 389 to make sure
the expected server is used?
Also, is there a /etc/ipa/renew.conf file with a ldap_uri different from
the one in /etc/ipa/default.conf on ipa1?
flo
>
PS: Of course I tried to resync, but it didn't work:
[root@ipa2 ~]# ipa-csreplica-manage re-initialize --from ipa1.example.de
Directory Manager password:
Update in progress, 15 seconds elapsed
[ldap://ipa1.example.de:389] reports: Update failed! Status: [Error
(-11) - LDAP error: Connect error]
The slapd error logfile shows
[17/Jul/2019:09:43:31.711035365 +0200] - ERR - setup_ol_tls_conn -
failed: unable to create new TLS context - -1
[17/Jul/2019:09:43:31.716241164 +0200] - ERR - slapi_ldap_init_ext -
failed: unable to set SSL/TLS options
[17/Jul/2019:09:43:31.724077230 +0200] - ERR - setup_ol_tls_conn -
failed: unable to create new TLS context - -1
[17/Jul/2019:09:43:31.732212109 +0200] - ERR - slapi_ldap_init_ext -
failed: unable to set SSL/TLS options
[17/Jul/2019:09:43:31.740314529 +0200] - ERR - slapi_ldap_bind - Error:
could not send startTLS request: error -11 (Connect error) errno 2 (No
such file or directory)
[17/Jul/2019:09:43:31.753988317 +0200] - ERR - slapi_ldap_bind - Error:
could not send startTLS request: error -11 (Connect error) errno 2 (No
such file or directory)
Is there some way to roll back ipa1 to the old certificate, to
make replication work again? There must be some way out of this
mess.
Every helpful comment is highly appreciated
Harri
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...