<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>I recently had to upgrade all my Fedora IPA servers to C7. It
went well, and we've been up and running nicely on 4.4.0 on C7 for
the past month or so.</p>
<p>Today, someone came and asked me to generate a new certificate
for their web server. All was good until I went to the IPA UI and
tried to perform Actions->New Certificate, which did nothing. I
tried each of our 3 servers in turn. All came back with no popup
window and no error, either.</p>
<p>I suspect the problem might be that we no longer have a CA server
due to the method I used to upgrade the servers. I likely missed a
"--setup-ca" in there somewhere, so my rolling update rolled over
the CA.</p>
<p>What's my best hope of recovery? I never ran this before, so I'm
not sure if this shows that I'm missing a CA or not:<br>
</p>
<blockquote>
<p><font size="-1" face="Courier New, Courier, monospace"># ipa
ca-find<br>
------------<br>
1 CA matched<br>
------------<br>
Name: ipa<br>
Description IPA CA<br>
Authority ID: 3ce3346[...]<br>
Subject DN: CN=Certificate Authority, O=DAMASCUSGRP.COM<br>
Issuer DN: CN=Certificate Authority,O=DAMASCUSGRP.COM<br>
----------------------------<br>
Number of entries returned 1<br>
</font><font face="Courier New, Courier, monospace"><font
size="-1">----------------------------<br>
# ipa ca-add dg --desc "Damascus Group" --subject "CN=DG CA,
O=DAMASCUSGRP.COM"<br>
ipa: ERROR: Failed to authenticate to CA REST API<br>
# klist<br>
Ticket cache: KEYRING:persistent:0:0<br>
Default principal: <a class="moz-txt-link-abbreviated" href="mailto:admin@DAMASCUSGRP.COM">admin@DAMASCUSGRP.COM</a><br>
<br>
Valid starting Expires Service principal<br>
04/25/2017 18:48:26 04/26/2017 18:48:21
<a class="moz-txt-link-abbreviated" href="mailto:krbtgt/DAMASCUSGRP.COM@DAMASCUSGRP.COM">krbtgt/DAMASCUSGRP.COM@DAMASCUSGRP.COM</a><br>
#</font><br>
</font></p>
</blockquote>
<br>
What's my best path of recovery?<br>
<br>
<div class="moz-signature">-- <br>
<div><b>Bret Wortman</b></div>
<div>The Damascus Group<br>
</div>
<br>
</div>
</body>
</html>