This is principals: [root@hostname ~]# kadmin.local list_principals | grep hostname.domain.com ldap/[email protected] host/[email protected] HTTP/[email protected] dogtag/[email protected]
[root@hostname ~]# hostname -f hostname.domain.com [root@hostname ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem \ -noout -subject subject=O=DOMAIN.COM, CN=IPA RA About our architecture: First, I created the first FreeIPA server with version 4.11.0 and then continued to install 4 FreeIPA replicas in a circular architecture (multi-master) as follows: core1 <---> core2 <---> core3 <---> core4 <---> core5 <---> core1 After that, I upgraded the FreeIPA version to 4.13.1 (I didn't change hostname of core) Set IPA CA renewal master to core5 Remove core1: core2 (v4.11) <---> core3 (v4.11) <---> core4 (v4.11) <---> core5 (v4.11) Install core1 with FreeIPA v4.13.1: core1 (v4.13) <---> core2 (v4.11) <---> core3 (v4.11) <---> core4 (v4.11) <---> core5 (v4.11) <---> core1 (v4.13) Remove core2: core3 (v4.11) <---> core4 (v4.11) <---> core5 (v4.11) <---> core1 (v4.13) Install core2 with FreeIPA v4.13.1: core1 (v4.13) <---> core2 (v4.13) <---> core3 (v4.11) <---> core4 (v4.11) <---> core5 (v4.11) <---> core1 (v4.13) ..... Set IPA CA renewal master to core1 Remove core5: core1 (v4.13) <---> core2 (v4.13) <---> core3 (v4.13) <---> core4 (v4.13) Install core5 with FreeIPA v4.13.1: core1 (v4.13) <---> core2 (v4.13) <---> core3 (v4.13) <---> core4 (v4.13) <---> core5 (v4.13) <---> core1 (v4.13) With all cores with FreeIPA v4.11, I tried to renew certificates. It was successfully, but after upgrading to FreeIPA v4.13, it was not -- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
