<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">Hey there - </div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">I’m working a FreeIPA box (ipa-server-3.0.0-42) - Our original PKI “master” was nuked a while ago and I have a suspicion that none of the other “master” freeipa replicas were “promoted” (sorry for the over-use of “ ) </div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">So we went ahead and ran through these instructions and are currently in a weird state:</div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><a href="http://www.freeipa.org/page/IPA_2x_Certificate_Renewal">http://www.freeipa.org/page/IPA_2x_Certificate_Renewal</a></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">krb5 won’t start and the getcert list command is returning CA_UNREACHABLE</div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div><font face="Calibri,sans-serif">krb5kdc: Server error - while fetching master key K/M for realm </font></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><div>status: CA_UNREACHABLE</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ca-error: Error setting up ccache for "host" service on client using default keytab: Cannot contact any KDC for realm </div></div><br><div><br></div><div>So I don’t think I can promote another master/replica ?</div><div><br></div><div><br></div><div>Thanks, </div><div><br></div><div>—Mike</div><div><br></div></body></html>