<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 05/21/2012 04:30 PM, David Copperfield wrote:
<blockquote
cite="mid:1337632230.67472.YahooMailNeo@web125701.mail.ne1.yahoo.com"
type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255); font-family: times new roman,new york,times,serif;
font-size: 12pt;">
<div>Hi all,</div>
<div><br>
</div>
<div> Any one has successfully do a IPA replica promotion when
IPA master(Hub) failed, by following the IPA replica document
for 2.1.3 and 2.2.0? </div>
<div><br>
</div>
</div>
</blockquote>
<blockquote
cite="mid:1337632230.67472.YahooMailNeo@web125701.mail.ne1.yahoo.com"
type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255); font-family: times new roman,new york,times,serif;
font-size: 12pt;">
<div>I've tried at my side and see that all the steps involved
are very confusing and may be out-of-dated. my IPA master is
installed with Dogtag, and all replicas are installed with
Dogtag too through '--setup-ca'.</div>
<div><br>
</div>
<div>In case of ipamaster is not reachable, how can I promote
ipareplica01? </div>
<div><br>
</div>
<div>the master.ca.agent.host/port are not setup on either
ipareplica01 nor ipareplica02 to forward to IPA master at
beginning. do that means all three IPA servers' Dogtag runs
independently?</div>
<div><br>
</div>
<div>And what is the value of 'IssuingPointId' in step 3.e and
3.f? </div>
<div><br>
</div>
<div>Is that possible for the document
<a class="moz-txt-link-freetext" href="http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/promoting-replica.html#promoting-pki">http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/promoting-replica.html#promoting-pki</a>,
or wiki/email, to give a SOLID use case instead of depicting
statement? which is ambiguous and not easy to follow. <br>
</div>
</div>
</blockquote>
<br>
<br>
This procedure is in fact a bit confusing and we have a bug to clean
it up.<br>
<a class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/show_bug.cgi?id=813880">https://bugzilla.redhat.com/show_bug.cgi?id=813880</a><br>
<br>
The purpose of this procedure however is simple: to define which of
the CA instances has to be the authoritative source for the CRLs.
Only one CA can be an authoritative source at a time so if you lost
a replica that was responsible for this (and by default this is the
first master you install) you need to go to some other replica that
has CA and follow this procedure to make it be the source for the
CRLs.<br>
This is the goal of the "promotion". There is nothing else to it.<br>
<br>
HTH. <br>
<br>
<blockquote
cite="mid:1337632230.67472.YahooMailNeo@web125701.mail.ne1.yahoo.com"
type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255); font-family: times new roman,new york,times,serif;
font-size: 12pt;">
<div><br>
</div>
<div><br>
</div>
<div>
<div>[root@ipamaster ~]# for i in ipamaster ipareplica0{1,2};
do echo ${i}; ssh -x ${i} "cat /var/lib/pki-ca/conf/CS.cfg |
egrep
'ca.certStatusUpdateInterval|ca.listenToCloneModifications|master.ca.agent'";
done</div>
<div>ipamaster</div>
<div>ipareplica01</div>
<div>ipareplica02</div>
<div><br>
</div>
<div>[root@ipamaster ~]# for i in ipamaster ipareplica0{1,2};
do echo ${i}; ssh -x ${i} "cat /var/lib/pki-ca/conf/CS.cfg |
grep ca.crl | grep enableCRL"; doneipamaster</div>
<div>ca.crl.MasterCRL.enableCRLCache=true</div>
<div>ca.crl.MasterCRL.enableCRLUpdates=true</div>
<div>ipareplica01</div>
<div>ca.crl.MasterCRL.enableCRLCache=true</div>
<div>ca.crl.MasterCRL.enableCRLUpdates=true</div>
<div>ipareplica02</div>
<div>ca.crl.MasterCRL.enableCRLCache=true</div>
<div>ca.crl.MasterCRL.enableCRLUpdates=true</div>
<div>[root@ipamaster ~]# </div>
</div>
<div><br>
</div>
<div>Thanks.</div>
<div><br>
</div>
<div>--David</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div> </div>
</div>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>