Well, I did try it, but no luck. Although it runs through, not all the
services are configured.
Opening a ticket with RedHat, we have an account.
On 2/22/19 10:04, Florence Blanc-Renaud wrote:
> On 2/22/19 12:14 AM, Kat via FreeIPA-users wrote:
>> Hi all -
>> Trying to add a new replica and client install is fine, but replica
>> install goes all along until it hits:
>> Configuring ipa-custodia
>> [1/4]: Generating ipa-custodia config file
>> [2/4]: Generating ipa-custodia keys
>> [3/4]: starting ipa-custodia
>> [4/4]: configuring ipa-custodia to start on boot
>> Done configuring ipa-custodia.
>> Your system may be partly configured.
>> Run /usr/sbin/ipa-server-install --uninstall to clean up.
>> ipapython.admintool: ERROR 406 Client Error: Failed to validate
>> message: No recipient matched the provided key["Failed:
>> [ValueError('Decryption failed.',)]"]
>> ipapython.admintool: ERROR The ipa-replica-install command failed.
>> See /var/log/ipareplica-install.log for more information
>> If I check in the custodia-log on the master it is replicating from I
>> 2019-02-21 17:59:25 - SimpleCredsAuth-[auth:simple] - PASS:
>> '22565' authenticated as '48, 48'
>> 2019-02-21 17:59:25 - SimpleHeaderAuth-[auth:header] - PASS:
>> '22565' authenticated as '(null)'
>> 2019-02-21 17:59:25 - IPAKEMKeys-[authz:kemkeys] - PASS:
>> '22565' authorized for '/keys'
>> 2019-02-21 17:59:25 - Secrets-[/keys] - DENIED:
>> '(null)' requested key 'ca/caSigningCert cert-pki-ca'
>> Any thoughts?
> I don't have a lot of knowledge re. custodia, but the recent versions
> of IPA include a fix in ipa-server-upgrade that checks if any keys are
> missing and re-creates them (please see
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives: