<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">(Not sure if this message went through initially, this is a resend.)</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""><br></div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">I'm trying to add a freeIPA client on a Ubuntu 14.04.02 Version and it's failing. Here is somebackground information. We lost (RIP) our main IPA server ipa.mydomain.com a while ago, but we were able to fail over to a replica called ipa2. Since then we've built a redundant ipa3.mydomain.com replica. Since then all the systems that were there previously work fine. But adding new IPA hosts fail.</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""><br id="yui_3_16_0_1_1436472607516_33469" class=""></div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">The main error below (I believe) is:</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""><br id="yui_3_16_0_1_1436472607516_33473" class=""></div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""></div><div class="" dir="ltr" id="yiv4792566804yui_3_16_0_1_1436468735730_3998"><span class="" id="yiv4792566804yui_3_16_0_1_1436468735730_4000">Joining realm failed: libcurl failed to execute the HTTP POST transaction, explaining: SSL: certificate subject name 'ipa2.mydomain.com' does not match target host name 'ipa.mydomain.com'</span></div><div class="" dir="ltr" id="yiv4792566804yui_3_16_0_1_1436468735730_3998"><span class="" id="yui_3_16_0_1_1436472607516_33479"><br id="yui_3_16_0_1_1436472607516_33481" class=""></span></div><div class="" dir="ltr" id="yiv4792566804yui_3_16_0_1_1436468735730_3998"><span class="" id="yui_3_16_0_1_1436472607516_33484">Any idea how to fix?</span></div><div class="" dir="ltr" id="yiv4792566804yui_3_16_0_1_1436468735730_3998"><span class="" id="yui_3_16_0_1_1436472607516_33487"><br id="yui_3_16_0_1_1436472607516_33489" class=""></span></div><div class="" dir="ltr" id="yiv4792566804yui_3_16_0_1_1436468735730_3998"><span class="" id="yui_3_16_0_1_1436472607516_33492">Thanks in advance!</span></div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""><br id="yui_3_16_0_1_1436472607516_33495" class=""></div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""><br id="yui_3_16_0_1_1436472607516_33498" class=""></div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">root@myhost:~# ipa-client-install -N --hostname myhost.mydomain.com --mkhomedir</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">DNS domain 'COM' is not configured for automatic KDC address lookup.</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">KDC address will be set to fixed value.</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Discovery was successful!</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Hostname: myhost.mydomain.com</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Realm: COM</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">DNS Domain: mydomain.com</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">IPA Server: ipa.mydomain.com</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">BaseDN: dc=COM</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""><br id="yiv4792566804yui_3_16_0_1_1436468735730_3891" class=""></div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Continue to configure the system with these values? [no]: yes</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">User authorized to enroll computers: admin</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Synchronizing time with KDC...</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Password for admin@COM: </div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Unable to download CA cert from LDAP.</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Do you want to download the CA cert from http://ipa.mydomain.com/ipa/config/ca.crt?</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">(this is INSECURE) [no]: yes</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Downloading the CA certificate via HTTP, this is INSECURE</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Successfully retrieved CA cert</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""> Subject: CN=Certificate Authority,O=COM</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""> Issuer: CN=Certificate Authority,O=COM</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""> Valid From: Thu Apr 04 23:20:27 2013 UTC</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""> Valid Until: Mon Apr 04 23:20:27 2033 UTC</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""><br id="yiv4792566804yui_3_16_0_1_1436468735730_3908" class=""></div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Joining realm failed: libcurl failed to execute the HTTP POST transaction, explaining: SSL: certificate subject name 'ipa2.mydomain.com' does not match target host name 'ipa.mydomain.com'</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class=""><br id="yiv4792566804yui_3_16_0_1_1436468735730_3912" class=""></div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Installation failed. Rolling back changes.</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">certmonger failed to start: Command '/usr/sbin/service certmonger start ' returned non-zero exit status 1</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">certmonger failed to stop: [Errno 2] No such file or directory: '/var/run/ipa/services.list'</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Disabling client Kerberos and LDAP configurations</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">SSSD service could not be stopped</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Restoring client configuration files</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">nscd daemon is not installed, skip configuration</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">nslcd daemon is not installed, skip configuration</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">/etc/ipa/default.conf could not be removed: [Errno 2] No such file or directory: '/etc/ipa/default.conf'</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Please remove /etc/ipa/default.conf manually, as it can cause subsequent installation to fail.</div><div id="yiv4792566804yui_3_16_0_1_1436468735730_3785" dir="ltr" class="">Client uninstall complete.</div></div></body></html>