Hi, you can download freeipa-healthcheck and run ipa-healthcheck command on the master/replica, it would help you identify any inconsistency in the configuration.
Otherwise, we need more info to help you. It looks like the LDAP server certificate on the master *ldap01*.app.uaap.maxar.com has been replaced (because its subject doesn't contain ldap01 but rather CN=*ldap*. app.uaap.maxar.com,OU=UAAP,O=Maxar Technologies Inc,L=Herndon,ST=Virginia,C=US). If you are using a custom certificate, signed by an external CA (CN=Maxar DS Issuing CA East,DC=DS,DC=Maxar,DC=com), you need to add this external CA to ipa by running on the master: # ipa-cacert-manage install -t CT,C,C /path/to/externalCA.pem and then on all the nodes enrolled into IPA: # ipa-certupdate Those commands will download the external CA and put them in all the required places. flo On Thu, Mar 21, 2024 at 1:07 AM Omar Pagan via FreeIPA-users < [email protected]> wrote: > I don't get it, the cert is valid and the master seems to be working just > fine. Any ideas as to how I need to approach this issue? I can rebuild > the replicas and get the certs updates done on each of the replicas, but I > have tried that a few times and it seems to still be unhappy with it. > Thoughts? > -- > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >
-- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
