Description of problem:

I have been trying to set up replication in a clone to use TLS. Doing so during the initial set up requires care so your 389-ds instance comes pre-configured with a set of certificates.

If this is done incorrectly, such as not properly trusting the CA or not restarting 389-ds after configuring the NSS database and adding the SSL config, the initial replication setup will fail.

dogtag does not detect this failure, it just loops looking for the root to appear in the directory server, which it never will because replication is not working.

Rich Megginson says that the agreement status can be monitored to detect this kind of error.