User poses the following problem: I have a couple of machines in a running freeipa-1.2.1 in a master/replica set up. However the the master server in this scenario is now out of warranty and needs to be retired. I have another machine readied to assume its role (with a different hostname and ip number, however), or preferably, I could promote the existing replica to master. There doesn't seem to be an easy way to accomplish this, short of starting again (which is not a practical option for me). And the answer is: The only difference between a replica and the initial IPA install (the "master") is that the first server owns the self-signed CA. You should be able to do this to make your "replica" the master: - copy /var/lib/ipa/ca_serialno from master to replica - import the CA into the replica DS NSS database with: # cd /etc/dirsrv/slapd-REALM # pk12util -i /path/to/cacert.p12 -d . The password on the PKCS#12 file is on the original server in /etc/dirsrv/slapd-REALM/pwdfile.txt as is the file cacert.p12 (which you backed up elsewhere too, right?) - Delete the existing replication agreements: # ipa-replica-manage del master.example.com Now you should have 2 identical IPA servers, neither of which know about each other. Shut down the old master and stand up the new box. Create a replica file on the newly promoted master and install that on the new box. You should be back in business.
*** This bug has been marked as a duplicate of bug 646238 ***