<div dir="ltr"><div><div><div>Hi Honza, </div>That gave me the exact same output. Any ideas? </div>Regards, </div>D </div><div class="gmail_extra"> <div class="gmail_quote">2015-04-15 7:33 GMT+02:00 Jan Cholasta <<a href="mailto:jcholast@redhat.com" target="_blank">jcholast@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi, Dne 14.4.2015 v 19:47 Rob Crittenden napsal(a): <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> David Dejaeghere wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hi Rob, So you want to output of the command using pk12 with server cert and key? or with the ca chain in there too? </blockquote> Oddly enough it is failing in exactly the same place. Those GoDaddy CA certs are still being loaded from somewhere, I'm not sure where, and I suspect that is the source of the problem. </blockquote> They are in the default CA certificate bundle (in the ca-certificate package). I guess NSS loads it automatically. <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I'm going to forward the log to a colleague who has worked on this code more recently than I have. Maybe he will have an idea. </blockquote> Could you try if the following works? # mv /usr/share/pki/ca-trust-source/ca-bundle.trust.crt /root/ca-bundle.trust.crt # update-ca-trust # ipa-replica-prepare ... # mv /root/ca-bundle.trust.crt /usr/share/pki/ca-trust-source/ca-bundle.trust.crt # update-ca-trust <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> rob </blockquote> Honza -- Jan Cholasta </blockquote></div> </div>