<html> <head> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 06/03/17 20:11, Rob Crittenden wrote: </div> <blockquote cite="mid:2a5e833a-5c7d-3385-bf17-620cd42aa805@redhat.com" type="cite"> <pre wrap="">lejeczek wrote: </pre> <blockquote type="cite"> <pre wrap="">hi everyone I've seemingly finely working domain, I mean it all seem fine to me, except for: [04/Mar/2017:14:26:47.439218725 +0000] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) [04/Mar/2017:14:26:47.441155853 +0000] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) [04/Mar/2017:14:31:47.454016982 +0000] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) [04/Mar/2017:14:31:47.482477473 +0000] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) [04/Mar/2017:14:36:46.458508994 +0000] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) [04/Mar/2017:14:36:46.479878884 +0000] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) [04/Mar/2017:14:41:47.389700728 +0000] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) [04/Mar/2017:14:41:47.394379376 +0000] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) being logged quite frequently, as you can see. Setup: ipa-client-4.4.0-14.el7.centos.4.x86_64 ipa-client-common-4.4.0-14.el7.centos.4.noarch ipa-common-4.4.0-14.el7.centos.4.noarch ipa-python-compat-4.4.0-14.el7.centos.4.noarch ipa-server-4.4.0-14.el7.centos.4.x86_64 ipa-server-common-4.4.0-14.el7.centos.4.noarch ipa-server-dns-4.4.0-14.el7.centos.4.noarch Replication, users, logins, all seem normal. But above bothers me as I am afraid it may one day turn out critical and brake stuff down. This is on the first server that initiated the domain, long time ago. There is a second server which logs the same, but only a few entries then goes quiet. Third server's error log is completely free from this error. Would appreciate all help. </pre> </blockquote> <pre wrap=""> The CA replication agreements are handled by ipa-csreplica-manage. You may have leftover agreements from previous installs there. rob </pre> </blockquote> I'm afraid I let over the years for some bits in the domain gone haywire. I found this: dn: cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x cn: ca objectClass: nsContainer objectClass: top dn: cn=certprofiles,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x cn: certprofiles objectClass: nsContainer objectClass: top dn: cn=caacls,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x cn: caacls objectClass: nsContainer objectClass: top dn: cn=cas+nsuniqueid=647ed0b1-b70911e6-b84df1c7-2176fa48,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x cn: cas objectClass: nsContainer objectClass: top dn: cn=cas,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x cn: cas objectClass: nsContainer objectClass: top dn: cn=IECUserRoles,cn=certprofiles,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x description: User profile that includes IECUserRoles extension from request ipaCertProfileStoreIssued: TRUE cn: IECUserRoles objectClass: ipacertprofile objectClass: top dn: cn=caIPAserviceCert,cn=certprofiles,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x description: Standard profile for network services ipaCertProfileStoreIssued: TRUE cn: caIPAserviceCert objectClass: ipacertprofile objectClass: top dn: ipaUniqueID=1ea0be16-fc01-11e5-a664-f04da240c1d2,cn=caacls,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x ipaMemberCertProfile: cn=caIPAserviceCert,cn=certprofiles,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x ipaUniqueID: 1ea0be16-fc01-11e5-a664-f04da240c1d2 ipaEnabledFlag: TRUE hostCategory: all objectClass: ipaassociation objectClass: ipacaacl cn: hosts_services_caIPAserviceCert serviceCategory: all dn: cn=ipa,cn=cas+nsuniqueid=647ed0b1-b70911e6-b84df1c7-2176fa48,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x cn: ipa ipaCaId: 0725f730-9351-4115-aa68-ecb2f47dd805 ipaCaSubjectDN: CN=Certificate Authority,O=PRIVATE.xx.xx.PRIVATE.xx.xx.x objectClass: top objectClass: ipaca ipaCaIssuerDN: CN=Certificate Authority,O=PRIVATE.xx.xx.PRIVATE.xx.xx.x description: IPA CA dn: cn=ipa,cn=cas,cn=ca,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x cn: ipa ipaCaId: ed1bbc62-45c5-4d4a-96fb-0c16129dbad0 ipaCaSubjectDN: CN=Certificate Authority,O=PRIVATE.xx.xx.PRIVATE.xx.xx.x objectClass: top objectClass: ipaca ipaCaIssuerDN: CN=Certificate Authority,O=PRIVATE.xx.xx.PRIVATE.xx.xx.x description: IPA CA is this the culprit? b.w. L. </body> </html>