Nevermind. I was mucking up the certificate. got it fixed. <div class="gmail_quote">---------- Forwarded message ---------- From: Nate Marks <<a href="mailto:npmarks@gmail.com">npmarks@gmail.com</a>> Date: Fri, Dec 21, 2012 at 6:36 AM Subject: user sync works, passsync eludes me To: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Here's what the log says: LDAP bind error in connect 81: Can't contact LDAP server Can not connect to ldap server in SyncPasswords I keep changing the passsync config values by re-running the msi with the modify option. I'm not sure if that's the way to do this, but my current options are: hostname: IPA server FQDN. it seems to resolve fine port number: 636 username: (i checked this in ldap:uid=passsync,cn=sysaccounts,cn=etc,dc=<domain>,dc=<tld> password: matches the one set in ipa-replica-manage connect --passsync option certtoken: string copied from the IPA server (/etc/dirsrv/slapd-<MYHOST>/pwdfile.txt) search base : same as win-subtree value so close, but stuck. thanks in advance for any help ! nate </div>