<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>Hi all,</div><div><br></div><div> Any one has successfully do a IPA replica promotion when IPA master(Hub) failed, by following the IPA replica document for 2.1.3 and 2.2.0? </div><div><br></div><div>I've tried at my side and see that all the steps involved are very confusing and may be out-of-dated. my IPA master is installed with Dogtag, and all replicas are installed with Dogtag too through '--setup-ca'.</div><div><br></div><div>In case of ipamaster is not reachable, how can I promote ipareplica01? </div><div><br></div><div>the master.ca.agent.host/port are not setup on either ipareplica01 nor ipareplica02 to forward to IPA master at beginning. do that means all three IPA servers' Dogtag runs independently?</div><div><br></div><div>And what is the value of 'IssuingPointId' in step 3.e and
3.f? </div><div><br></div><div>Is that possible for the document http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/promoting-replica.html#promoting-pki, or wiki/email, to give a SOLID use case instead of depicting statement? which is ambiguous and not easy to follow. </div><div><br></div><div><br></div><div><div>[root@ipamaster ~]# for i in ipamaster ipareplica0{1,2}; do echo ${i}; ssh -x ${i} "cat /var/lib/pki-ca/conf/CS.cfg | egrep 'ca.certStatusUpdateInterval|ca.listenToCloneModifications|master.ca.agent'"; done</div><div>ipamaster</div><div>ipareplica01</div><div>ipareplica02</div><div><br></div><div>[root@ipamaster ~]# for i in ipamaster ipareplica0{1,2}; do echo ${i}; ssh -x ${i} "cat /var/lib/pki-ca/conf/CS.cfg | grep ca.crl | grep enableCRL";
doneipamaster</div><div>ca.crl.MasterCRL.enableCRLCache=true</div><div>ca.crl.MasterCRL.enableCRLUpdates=true</div><div>ipareplica01</div><div>ca.crl.MasterCRL.enableCRLCache=true</div><div>ca.crl.MasterCRL.enableCRLUpdates=true</div><div>ipareplica02</div><div>ca.crl.MasterCRL.enableCRLCache=true</div><div>ca.crl.MasterCRL.enableCRLUpdates=true</div><div>[root@ipamaster ~]# </div></div><div><br></div><div>Thanks.</div><div><br></div><div>--David</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div> </div></div></body></html>