<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 14, 2016 at 11:22 AM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><span class="">Marc Wiatrowski wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
Hello, I'm having issues with the 3 ipa certificates of type CA: IPA<br>
renewing on 2 of 3 replicas. Particularly on the 2 that are not the CA<br>
master. The other 5 certificates from getcert list do renew and all<br>
certificates on the CA master do look to renew.<br>
<br>
Both servers running ipa-server-3.0.0-50.el6.centos.1.x86_64 I've done<br>
full updates and rebooted.<br>
</blockquote>
<br></span>
Can you check on the replication status for each CA?<br>
<br>
$ ipa-csreplica-manage list -v <a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a><br>
<br>
The hostname is important because including that will show the agreements that host has. Do this for each master with a CA.<br>
<br>
The CA being asked to do the renewal is unaware of the current serial number so it is refusing to proceed.<br>
<br>
rob<br>
<br></blockquote><div><br></div><div><br></div><div><div>[root@spider01o]$ ipa-csreplica-manage list -v <a href="http://spider01a.iglass.net">spider01a.iglass.net</a></div><div>Directory Manager password: </div><div><br></div><div><a href="http://spider01b.iglass.net">spider01b.iglass.net</a></div><div> last init status: None</div><div> last init ended: None</div><div> last update status: 0 Replica acquired successfully: Incremental update succeeded</div><div> last update ended: 2016-06-14 17:49:16+00:00</div><div><a href="http://spider01o.iglass.net">spider01o.iglass.net</a></div><div> last init status: None</div><div> last init ended: None</div><div> last update status: 0 Replica acquired successfully: Incremental update started</div><div> last update ended: 2016-06-14 17:55:20+00:00</div><div><br></div><div>[root@spider01o]$ ipa-csreplica-manage list -v <a href="http://spider01o.iglass.net">spider01o.iglass.net</a></div><div>Directory Manager password: </div><div><br></div><div><a href="http://spider01a.iglass.net">spider01a.iglass.net</a></div><div> last init status: None</div><div> last init ended: None</div><div> last update status: 0 Replica acquired successfully: Incremental update started</div><div> last update ended: 2016-06-14 17:57:44+00:00</div><div><a href="http://spider01b.iglass.net">spider01b.iglass.net</a></div><div> last init status: None</div><div> last init ended: None</div><div> last update status: 0 Replica acquired successfully: Incremental update started</div><div> last update ended: 2016-06-14 17:57:41+00:00</div><div><br></div><div>[root@spider01o]$ ipa-csreplica-manage list -v <a href="http://spider01b.iglass.net">spider01b.iglass.net</a></div><div>Directory Manager password: </div><div><br></div><div><a href="http://spider01a.iglass.net">spider01a.iglass.net</a></div><div> last init status: 0 Total update succeeded</div><div> last init ended: 2016-06-03 19:43:12+00:00</div><div> last update status: 0 Replica acquired successfully: Incremental update succeeded</div><div> last update ended: 2016-06-14 17:44:17+00:00</div><div><a href="http://spider01o.iglass.net">spider01o.iglass.net</a></div><div> last init status: 0 Total update succeeded</div><div> last init ended: 2016-06-03 19:44:38+00:00</div><div> last update status: 0 Replica acquired successfully: Incremental update started</div><div> last update ended: 2016-06-14 17:57:53+00:00</div><div><a href="http://spider01a.iglass.net">spider01a.iglass.net</a></div><div> last init status: None</div><div> last init ended: None</div><div> last update status: 0 Replica acquired successfully: Incremental update succeeded</div><div> last update ended: 2016-06-14 17:44:13+00:00</div><div><a href="http://spider01o.iglass.net">spider01o.iglass.net</a></div><div> last init status: None</div><div> last init ended: None</div><div> last update status: 0 Replica acquired successfully: Incremental update started</div><div> last update ended: 2016-06-14 17:57:54+00:00</div></div><div><br></div><div><br></div><div>Not sure what this is telling... This an issue with the last being doubled? Thanks</div><div><br></div></div></div></div>