Thank you for the quick reply, I will give it a go, I wasn't sure if the links
would work since most the of configuration for the dogtag in centos7 is
and commands like:
"getcert list -d /var/lib/pki-ca/alias -n "subsystemCert cert-pki-ca" | grep
Do not apply, I will try to accommodate for the difference in versions, I might
bug you guys again :)
----- Original Message -----
From: "Rob Crittenden" <rcrit...@redhat.com>
To: "Rui Gomes" <rgo...@rvx.is>, email@example.com
Sent: Thursday, 15 January, 2015 16:20:46
Subject: Re: [Freeipa-users] Promoting ipa 4.1 on Centos 7 replica to master
Rui Gomes wrote:
> Hello Guys,
> I been seeing planting of email about promoting replicas to masters but does
> articles do not seem to apply to ipa 4.1/centos 7 combo.
> I had a ipa 3.0 master on centos 6.4 that died recently(I can still access
> the file system), and I would like to promote my 4.1 replica to the master.
> I tried:
> But they don't seem relevant to that specific setup, centos 7/ipa 4.1 can you
> guys give me some pointer how can I get my 4.1 replica to master?
> Rui Gomes
Every server in IPA is a master, the only distinction being whether it
has a CA installed or not, and to a lesser extend DNS (all masters have
the data, some may just not run the service).
So if you have a master with a CA then you have a full IPA master.
The only thing that distinguishes one master from another is due to
order of installation due to two things that should only be done on one
master: generate the CRL and handle CA subsysutem certificate renewal.
The first IPA master installed is given these duties. To switch the CRL
generator use the first link.
The page is going to be updated soon to reflect how renewal should be
handled on 4.0+ servers. The renewal master is now stored in LDAP so
switching it is a lot easier.
Manage your subscription for the Freeipa-users mailing list:
Go To http://freeipa.org for more info on the project