<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Century Gothic";
panose-1:2 11 5 2 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Following instructions from here…<o:p></o:p></p>
<p class="MsoNormal"><a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/migrating-ipa-proc.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/migrating-ipa-proc.html</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">RHEL6 server<o:p></o:p></p>
<p class="MsoNormal"># rpm -qa ipa-server<o:p></o:p></p>
<p class="MsoNormal">ipa-server-3.0.0-42.el6.x86_64<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">RHEL7 server<o:p></o:p></p>
<p class="MsoNormal"># rpm -q ipa-server<o:p></o:p></p>
<p class="MsoNormal">ipa-server-4.1.0-18.el7_1.4.x86_64<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am down to the part where I am trying to make the new RHEL7 server the master CA server<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the RHEL6 system, I <o:p></o:p></p>
<p class="MsoNormal"># getcert list -d /var/lib/pki-ca/alias -n "subsystemCert cert-pki-ca"<o:p></o:p></p>
<p class="MsoNormal">Number of certificates and requests being tracked: 8.<o:p></o:p></p>
<p class="MsoNormal">Request ID '20141022190721':<o:p></o:p></p>
<p class="MsoNormal"> status: MONITORING<o:p></o:p></p>
<p class="MsoNormal"> stuck: no<o:p></o:p></p>
<p class="MsoNormal"> key pair storage: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin=OBSCURED<o:p></o:p></p>
<p class="MsoNormal"> certificate: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'<o:p></o:p></p>
<p class="MsoNormal"> CA: dogtag-ipa-renew-agent<o:p></o:p></p>
<p class="MsoNormal"> issuer: CN=Certificate Authority,O=STT.LOCAL<o:p></o:p></p>
<p class="MsoNormal"> subject: CN=CA Subsystem,O=STT.LOCAL<o:p></o:p></p>
<p class="MsoNormal"> expires: 2016-10-11 19:06:36 UTC<o:p></o:p></p>
<p class="MsoNormal"> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment<o:p></o:p></p>
<p class="MsoNormal"> eku: id-kp-serverAuth,id-kp-clientAuth<o:p></o:p></p>
<p class="MsoNormal"> pre-save command:<o:p></o:p></p>
<p class="MsoNormal"> post-save command:<o:p></o:p></p>
<p class="MsoNormal"> track: yes<o:p></o:p></p>
<p class="MsoNormal"> auto-renew: yes<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">and the ‘post-save’ command is empty, doesn’t track the page. Should I just ignore? I note that the output from this (save for different file path on RHEL6) indicates that the original RHEL6 is still CA Master<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;line-height:15.0pt;background:white">
<span style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#2E3436">The CRL generation master can be determined by looking at CS.cfg on each CA:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;line-height:15.0pt;background:whitesmoke;word-break:break-all">
<span style="font-size:10.0pt;font-family:Consolas;color:#333333"># grep ca.crl.MasterCRL.enableCRLUpdates /etc/pki/pki-tomcat/ca/CS.cfg<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:7.5pt;line-height:15.0pt;background:whitesmoke;word-break:break-all">
<span style="font-size:10.0pt;font-family:Consolas;color:#333333">ca.crl.MasterCRL.enableCRLUpdates=true<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Also, when I set up the second new IPA master, do I also make it a CA?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:black">Craig White<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:black">System Administrator<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:#A6A6A6">O</span><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:black">
</span><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif"">623-201-8179
<span style="color:#A6A6A6">M</span><span style="color:black"> 602-377-9752<o:p></o:p></span></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="180" height="52" id="Picture_x0020_2" src="cid:image001.png@01D0EBDF.B2113190" alt="cid:image001.png@01CF86FE.42D51630"><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:black">SkyTouch Technology
</span><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:#A6A6A6">4225 E. Windrose Dr. Phoenix, AZ 85032</span><span style="font-size:9.0pt;font-family:"Century Gothic","sans-serif";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>