Hi, I had a similar issue when I installed the IPA cluster. Here is my workaround to bypass the (y/N) prompt. Install the replica and setup ca at the same time using the following command.
[replica]$ kinit admin [replica]$ echo -ne '\n' | ipa-replica-install --setup-ca # The ipa-replica-install command was successful -- vahit On Mon, 25 Mar 2024 at 22:45, Omar via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote: > Attached file here. Thanks, > > //omar > > On Fri, Mar 22, 2024 at 4:53 AM Florence Blanc-Renaud <f...@redhat.com> > wrote: > >> Hi, >> >> you can download freeipa-healthcheck and run ipa-healthcheck command on >> the master/replica, it would help you identify any inconsistency in the >> configuration. >> >> Otherwise, we need more info to help you. It looks like the LDAP server >> certificate on the master *ldap01*.app.uaap.maxar.com has been replaced >> (because its subject doesn't contain ldap01 but rather CN=*ldap*. >> app.uaap.maxar.com,OU=UAAP,O=Maxar Technologies >> Inc,L=Herndon,ST=Virginia,C=US). >> If you are using a custom certificate, signed by an external CA (CN=Maxar >> DS Issuing CA East,DC=DS,DC=Maxar,DC=com), you need to add this external CA >> to ipa by running on the master: >> # ipa-cacert-manage install -t CT,C,C /path/to/externalCA.pem >> and then on all the nodes enrolled into IPA: >> # ipa-certupdate >> >> Those commands will download the external CA and put them in all the >> required places. >> flo >> >> On Thu, Mar 21, 2024 at 1:07 AM Omar Pagan via FreeIPA-users < >> freeipa-users@lists.fedorahosted.org> wrote: >> >>> I don't get it, the cert is valid and the master seems to be working >>> just fine. Any ideas as to how I need to approach this issue? I can >>> rebuild the replicas and get the certs updates done on each of the >>> replicas, but I have tried that a few times and it seems to still be >>> unhappy with it. Thoughts? >>> -- >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org >>> To unsubscribe send an email to >>> freeipa-users-le...@lists.fedorahosted.org >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org >>> Do not reply to spam, report it: >>> https://pagure.io/fedora-infrastructure/new_issue >>> >> -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >
-- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
