<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi Martin, thanks for your response! <div class=""><br class=""><div><blockquote type="cite" class=""><div class=""><blockquote type="cite" class="">What I realize now is the certificate CRL points to the server that no longer exists and I'd like to get that cleaned up. I found <a href="http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master" class="">http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master</a> <<a href="http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master" class="">http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master</a>>, is that relevant for my situation?<br class=""></blockquote><br class="">Yes, this is the procedure to follow for servers older than FreeIPA 4.1. Jan is<br class="">that correct? If yes, the page deserves a warning/update.<br class=""><br class=""></div></blockquote></div><br class=""></div><div class="">Ooof! I forgot that vendor repos were so far behind. I'm still at 3.3.3-28. </div><div class=""><br class=""></div><div class="">Is it reasonable and desirable to run one of my two servers with the image documented at <a href="http://seven.centos.org/2014/12/freeipa-4-1-2-and-centos" class="">http://seven.centos.org/2014/12/freeipa-4-1-2-and-centos</a>? I'm interested in integrating Shiro or some other RBAC against IPA at some point in the next few months, but I'd wait if the Docker image is a prelude to 4.x hitting vendor repos soon.</div><div class=""><br class=""></div><div class="">Cheers, Brian</div></body></html>