Hi all,<br><br>  It seems something broke somewhere along the lines when I was trying to set up Windows Sync.  Please take a look at the following outputs.  I can connect both directions manually via SSL, but the actual ipa-replica-manage script seems to be pulling certs from somewhere else.  The current sync between ipaserver-01 & ipaserver-02 is working fine.  If anyone has any suggestions, I would be open to them.  Thanks!<br>
<br>example.local = active directory domain<br><a href="http://example.com">example.com</a> = ipa realm<br>-----<br><br>[root@ipaserver-01 ~]# certutil -L -d /etc/dirsrv/slapd-EXAMPLE-COM/<br><br>Certificate Nickname                                         Trust Attributes<br>
                                                             SSL,S/MIME,JAR/XPI<br><br>DigiCertCA                                                   CT,,C<br>AD CA cert                                                   CT,,C<br>
ipaserver-01                                                 u,u,u<br><br>#-----<br># everything looks right<br>#-----<br><br>[root@ipaserver-01 ~]#<br>[root@ipaserver-01 ~]# /usr/lib64/mozldap/ldapsearch -h adserver-01.example.local -p 636 -Z -P /etc/dirsrv/slapd-EXAMPLE-COM/cert8.db -D "passsync@example.local" -w 'notrealpassword' -s base -b "" "objectclass=*"<br>
version: 1<br>dn:<br>currentTime: 20110111153848.0Z<br>...<br>...<br>supportedControl: 1.2.840.113556.1.4.1948<br>supportedControl: 1.2.840.113556.1.4.1974<br>supportedControl: 1.2.840.113556.1.4.1341<br>supportedControl: 1.2.840.113556.1.4.2026<br>
supportedLDAPVersion: 3<br>supportedLDAPVersion: 2<br>supportedLDAPPolicies: MaxPoolThreads<br>...<br>...<br>dnsHostName: adserver-01.example.local<br>ldapServiceName: example.local:adserver-01$@example.local<br>...<br>...<br>
isSynchronized: TRUE<br>isGlobalCatalogReady: TRUE<br>domainFunctionality: 3<br>forestFunctionality: 3<br>domainControllerFunctionality: 3<br>[root@ipaserver-01 ~]#<br><br>#-----<br># good valid results for the query [reduced for clarity]<br>
#-----<br><br><br>[root@ipaserver-01 ~]# ipa-replica-manage list<br>Directory Manager password:<br>unexpected error: {'info': 'error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed', 'desc': "Can't contact LDAP server"}<br>
[root@ipaserver-01 ~]#<br><br>#-----<br># welp, it looks like something is broken somewhere..<br>#-----<br>