| Summary: | Improvement: promoting and recycling replicas/servers | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Deon Ballard <dlackey> |
| Component: | doc-Identity_Management_Guide | Assignee: | Deon Ballard <dlackey> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | ecs-bugs |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.3 | CC: | dpal, jskeoch, rcritten |
| Target Milestone: | rc | Keywords: | Documentation |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-07-03 02:54:41 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Deon Ballard
2012-04-18 16:22:27 UTC
So, for part 1: Only the first CA generates the CRL. All this promotion change does is defines which of the remaining servers will generate the CRL. We want to change the language of "promotion" but it is still true that all the CAs are peers. For selfsign, the CA cert needs to be imported into the Apache databsae (/etc/httpd/alias), not 389-ds. The cacert.p12 is the file generated during installation that was saved by the user. Part 2: This probably needs to come from dev, but there needs to be a blessed procedure for wiping out a server or replica cleanly (part 2a) and then re-installing it later (part 2b). Okay, changes... For comment #1. Working backwards, self-signed CAs (for other reasons) have been dropped from the documentation entirely. While still possible to configure, this is very much not a recommended or supported option. Less said, the better. All that "promoting" a replica means is having one server take over CRL generation for the domain. That is, hopefully, more clear here: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/promoting-replica.html For comment #2, there is a procedure to remove a replica: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/removing-replica.html There is no specific procedure for re-installing a replica. |