There is a section on promoting a replica to a server. It's really not well explained what is happening or why because replicas and servers are functionally identical, with one exception. There are two problems that need to be addressed: 1. The replica promotion process itself needs to be clarified. 2. There needs to be a larger explanation on how to decommission and re-install replicas and servers.
So, for part 1: Only the first CA generates the CRL. All this promotion change does is defines which of the remaining servers will generate the CRL. We want to change the language of "promotion" but it is still true that all the CAs are peers. For selfsign, the CA cert needs to be imported into the Apache databsae (/etc/httpd/alias), not 389-ds. The cacert.p12 is the file generated during installation that was saved by the user.
Part 2: This probably needs to come from dev, but there needs to be a blessed procedure for wiping out a server or replica cleanly (part 2a) and then re-installing it later (part 2b).
Okay, changes... For comment #1. Working backwards, self-signed CAs (for other reasons) have been dropped from the documentation entirely. While still possible to configure, this is very much not a recommended or supported option. Less said, the better. All that "promoting" a replica means is having one server take over CRL generation for the domain. That is, hopefully, more clear here: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/promoting-replica.html For comment #2, there is a procedure to remove a replica: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/removing-replica.html There is no specific procedure for re-installing a replica.