CA not configured on second replica but it is configured

[Pavlo Pocheptsov]

Hi list.
ipa2 node was promoted to ca with ipa-ca-instal
and it shows all is good on its side:

[root@ipa2 ~]# ipa-replica-manage list
ipa3: master
ipa2: master
[root@ipa2 ~]# ipa-csreplica-manage list
ipa3: master
ipa2: *master*
[root@ipa2 ~]# ipa config-show |grep CA
  Certificate Subject base: O=removed
  IPA CA servers: *ipa2, ipa3*
  IPA CA renewal master: ipa3
[root@ipa2 ~]# ipa server-role-find | grep -A1 -B1 CA
  Server name: ipa2
  Role name: CA server
  Role status: *enabled*
--
  Server name: ipa3
  Role name: CA server
  Role status: *enabled*
[root@ipa2 ~]# ipa-replica-manage list-ruv
Replica Update Vectors:
ipa2:389: 11
ipa3:389: 9
Certificate Server Replica Update Vectors:
ipa2:389: 12
ipa3:389: 10

But ipa3 node doesn't see ipa2 as ca master:

[root@ipa3 ~]# ipa-replica-manage list
ipa3: master
ipa2: master
[root@ipa3 ~]# ipa-csreplica-manage list
ipa3: master
ipa2: *CA not configured*
[root@ipa3 ~]# ipa config-show |grep CA
  Certificate Subject base: O=removed
  IPA CA servers: *ipa3*  <----- no ipa2 here
  IPA CA renewal master: ipa3
[root@ipa3 ~]# ipa server-role-find | grep -B1 -A1 CA
  Server name: ipa2
  Role name: CA server
  Role status: *absent*
--
  Server name: ipa3
  Role name: CA server
  Role status: enabled
[root@ipa3 ~]# ipa-replica-manage list-ruv
Replica Update Vectors:
ipa3:389: 9
ipa2:389: 11
Certificate Server Replica Update Vectors:
ipa3:389: 10
ipa2:389: 12

Centos 7.9
FreeIPA, version: 4.6.8

What is the real situation here? Is there CA replication btw replicas or no?
Is it possible to fix this and make ipa2 CA role visible on ipa3?
Any extra information I can provide to fully understand the issue?

Pavel

[Rob Crittenden]

Pavlo Pocheptsov via FreeIPA-users wrote:
>  Hi list.
>  ipa2 node was promoted to ca with ipa-ca-instal
>  and it shows all is good on its side:
>  
>  [root@ipa2 ~]# ipa-replica-manage list
>  ipa3: master
>  ipa2: master
>  [root@ipa2 ~]# ipa-csreplica-manage list
>  ipa3: master
>  ipa2: *master*
>  [root@ipa2 ~]# ipa config-show |grep CA
>    Certificate Subject base: O=removed
>    IPA CA servers: *ipa2, ipa3*
>    IPA CA renewal master: ipa3
>  [root@ipa2 ~]# ipa server-role-find | grep -A1 -B1 CA
>    Server name: ipa2
>    Role name: CA server
>    Role status: *enabled*
>  --
>    Server name: ipa3
>    Role name: CA server
>    Role status: *enabled*
>  [root@ipa2 ~]# ipa-replica-manage list-ruv
>  Replica Update Vectors:
>  ipa2:389: 11
>  ipa3:389: 9
>  Certificate Server Replica Update Vectors:
>  ipa2:389: 12
>  ipa3:389: 10
>  
>  But ipa3 node doesn't see ipa2 as ca master:
>  
>  [root@ipa3 ~]# ipa-replica-manage list
>  ipa3: master
>  ipa2: master
>  [root@ipa3 ~]# ipa-csreplica-manage list
>  ipa3: master
>  ipa2: *CA not configured*
>  [root@ipa3 ~]# ipa config-show |grep CA
>    Certificate Subject base: O=removed
>    IPA CA servers: *ipa3*  <----- no ipa2 here
>    IPA CA renewal master: ipa3
>  [root@ipa3 ~]# ipa server-role-find | grep -B1 -A1 CA
>    Server name: ipa2
>    Role name: CA server
>    Role status: *absent*
>  --
>    Server name: ipa3
>    Role name: CA server
>    Role status: enabled
>  [root@ipa3 ~]# ipa-replica-manage list-ruv
>  Replica Update Vectors:
>  ipa3:389: 9
>  ipa2:389: 11
>  Certificate Server Replica Update Vectors:
>  ipa3:389: 10
>  ipa2:389: 12
>  
>  Centos 7.9
>  FreeIPA, version: 4.6.8
>  
>  What is the real situation here? Is there CA replication btw replicas or no?
>  Is it possible to fix this and make ipa2 CA role visible on ipa3?
>  Any extra information I can provide to fully understand the issue? 
I'd look for replication issues.

rob

[Pavlo Pocheptsov]

Hi Rob and thanks for your answer.
Indeed, I see this error:

[root@ipa2 ~]# ipa-replica-manage -v list ipa2.fluent.local
>  ipa3.fluent.local: replica
>    last update status: Error (18) Replication error acquiring replica:
>  Incremental update transient warning.  Backing off, will retry update
>  later. (transient warning)
>    last update ended: 1970-01-01 00:00:00+00:00
>  
Is it possible to remove a reclipa with "ipa-replica-manage del ipa2" and
then connect it again with the same name?

On Mon, 23 May 2022 at 23:08, Rob Crittenden <rcritten(a)redhat.com&gt; wrote:

>  Pavlo Pocheptsov via FreeIPA-users wrote:
>  > Hi list.
>  > ipa2 node was promoted to ca with ipa-ca-instal
>  > and it shows all is good on its side:
>  >
>  > [root@ipa2 ~]# ipa-replica-manage list
>  > ipa3: master
>  > ipa2: master
>  > [root@ipa2 ~]# ipa-csreplica-manage list
>  > ipa3: master
>  > ipa2: *master*
>  > [root@ipa2 ~]# ipa config-show |grep CA
>  >   Certificate Subject base: O=removed
>  >   IPA CA servers: *ipa2, ipa3*
>  >   IPA CA renewal master: ipa3
>  > [root@ipa2 ~]# ipa server-role-find | grep -A1 -B1 CA
>  >   Server name: ipa2
>  >   Role name: CA server
>  >   Role status: *enabled*
>  > --
>  >   Server name: ipa3
>  >   Role name: CA server
>  >   Role status: *enabled*
>  > [root@ipa2 ~]# ipa-replica-manage list-ruv
>  > Replica Update Vectors:
>  > ipa2:389: 11
>  > ipa3:389: 9
>  > Certificate Server Replica Update Vectors:
>  > ipa2:389: 12
>  > ipa3:389: 10
>  >
>  > But ipa3 node doesn't see ipa2 as ca master:
>  >
>  > [root@ipa3 ~]# ipa-replica-manage list
>  > ipa3: master
>  > ipa2: master
>  > [root@ipa3 ~]# ipa-csreplica-manage list
>  > ipa3: master
>  > ipa2: *CA not configured*
>  > [root@ipa3 ~]# ipa config-show |grep CA
>  >   Certificate Subject base: O=removed
>  >   IPA CA servers: *ipa3*  <----- no ipa2 here
>  >   IPA CA renewal master: ipa3
>  > [root@ipa3 ~]# ipa server-role-find | grep -B1 -A1 CA
>  >   Server name: ipa2
>  >   Role name: CA server
>  >   Role status: *absent*
>  > --
>  >   Server name: ipa3
>  >   Role name: CA server
>  >   Role status: enabled
>  > [root@ipa3 ~]# ipa-replica-manage list-ruv
>  > Replica Update Vectors:
>  > ipa3:389: 9
>  > ipa2:389: 11
>  > Certificate Server Replica Update Vectors:
>  > ipa3:389: 10
>  > ipa2:389: 12
>  >
>  > Centos 7.9
>  > FreeIPA, version: 4.6.8
>  >
>  > What is the real situation here? Is there CA replication btw replicas or
>  no?
>  > Is it possible to fix this and make ipa2 CA role visible on ipa3?
>  > Any extra information I can provide to fully understand the issue?
>
>  I'd look for replication issues.
>
>  rob
>
>