I suspect that was the issue -

Of course moved on to something else (hostname removed)

Request ID '20140520151448':
        status: CA_UNREACHABLE
        ca-error: Server at https://ldapserver/ipa/xml failed request, will
retry: 4301 (RPC failed at server.  Certificate operation cannot be
completed: Unable to communicate with CMS (Not Found)).

I assuming this new error is a result of my failed attempt at updating the

Any idea if I was heading down the correct path? - I would have assumed
these certs would have renewed themselves since I¹m +3.0.

I see the Configure renewal section but its an odd situation where we have
to renew and reconfigureŠ


On 8/28/15, 7:45 PM, "Rob Crittenden" <rcrit...@redhat.com> wrote:

>Mike LoSapio wrote:
>> Hey there -
>> I¹m working a FreeIPA box (ipa-server-3.0.0-42) - Our original PKI
>> ³master² was nuked a while ago and I have a suspicion that none of the
>> other ³master² freeipa replicas were ³promoted² (sorry for the over-use
>> of ³ )
>> So we went ahead and ran through these instructions and are currently in
>> a weird state:
>> krb5 won¹t start and the getcert list command is returning
>> krb5kdc: Server error - while fetching master key K/M for realm
>See if the LDAP server is running.
>> ca-error: Error setting up ccache for "host" service on client using
>> default keytab: Cannot contact any KDC for realm
>This makes sense since the KDC isn't running.
>> So I don¹t think I can promote another master/replica ?
>There really is no promotion, all IPA servers are masters. The only
>difference is what extra services (CA, DNS) may be running and who
>controls renewal and CRL generation. See

Attachment: smime.p7s
Description: S/MIME cryptographic signature

Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to