Red Hat Bugzilla – Bug 814792
Replication errors when CS and DS share a database
Last modified: 2015-03-10 08:05:07 EDT
This is something that we need to revisit when the CS and IPA start sharing same DS instance.
Description of problem:
After CS replication is removed, replica can see a new host is issued a cert,
but doesn't have a copy of it, and throws a serial number error.
In response to a test case to do this, Rob's response:
I wonder if we should doc this. What is happening is the host is
replicating through a different channel, so we can see it. Because the
CS replication was removed we can see that the host has been issued a
valid certificate from our CA but our local install doesn't have a copy
of it, hence the serial # error.
This and a few others point out some pretty scary problems related to
certificate replication, this isn't something people should take lightly.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1.Install master, replica
2.Install CS server on replica
3.Delete the replication agreement, and the data from replica
# ipa-csreplica-manage del ipa-replica1.testrelm -p XXX
4. Add a host, add cert to a host from master
5. Check settings for this host from replica
Error that host?s cert cannot be found:
Certificate operation cannot be completed: EXCEPTION (Certificate serial number
0x2d not found)
if this is doc'd, the user will know to check CS replication, and be prepared.
This is from https://fedorahosted.org/freeipa/ticket/2047.
This is not in RHEL 6.4. Unsetting the flags.
Changing to RHEL 7.