Re: [Freeipa-devel] Proposal: reverse stance on installing CA on new masters

2015-04-09 Thread Simo Sorce
On Thu, 2015-04-09 at 16:52 -0400, Rob Crittenden wrote: Simo Sorce wrote: On Thu, 2015-04-09 at 15:42 -0400, Rob Crittenden wrote: Petr Vobornik wrote: On 04/09/2015 04:05 PM, Rob Crittenden wrote: Right now when a new master is installed it is not configured with a CA unless one

Re: [Freeipa-devel] Proposal: reverse stance on installing CA on new masters

2015-04-09 Thread Simo Sorce
On Thu, 2015-04-09 at 15:42 -0400, Rob Crittenden wrote: Petr Vobornik wrote: On 04/09/2015 04:05 PM, Rob Crittenden wrote: Right now when a new master is installed it is not configured with a CA unless one passes in --setup-ca (or afterward runs ipa-ca-install). Over and over we've

Re: [Freeipa-devel] Proposal: reverse stance on installing CA on new masters

2015-04-09 Thread Rob Crittenden
Simo Sorce wrote: On Thu, 2015-04-09 at 15:42 -0400, Rob Crittenden wrote: Petr Vobornik wrote: On 04/09/2015 04:05 PM, Rob Crittenden wrote: Right now when a new master is installed it is not configured with a CA unless one passes in --setup-ca (or afterward runs ipa-ca-install). Over and

Re: [Freeipa-devel] Proposal: reverse stance on installing CA on new masters

2015-04-09 Thread Rob Crittenden
Petr Vobornik wrote: On 04/09/2015 04:05 PM, Rob Crittenden wrote: Right now when a new master is installed it is not configured with a CA unless one passes in --setup-ca (or afterward runs ipa-ca-install). Over and over we've seen people who have multiple masters and a single CA, in some

Re: [Freeipa-devel] Proposal: reverse stance on installing CA on new masters

2015-04-09 Thread Petr Vobornik
On 04/09/2015 04:05 PM, Rob Crittenden wrote: Right now when a new master is installed it is not configured with a CA unless one passes in --setup-ca (or afterward runs ipa-ca-install). Over and over we've seen people who have multiple masters and a single CA, in some cases that CA machine is