On 6/18/20 12:55 PM, Rob Crittenden wrote: > Orion Poplawski via FreeIPA-users wrote: >> I'm trying run ipa-replica-install on a non-IPA joined CentOS 8.2 system: >> >> ipa-replica-install --principal admin --admin-password='SECRET' >> >> Configuring client side components >> This program will set up IPA client. >> Version 4.8.4 >> >> Using existing certificate '/etc/ipa/ca.crt'. >> Skip SERVER1: cannot verify if this is an IPA server >> Skip SERVER2: cannot verify if this is an IPA server >> Skip SERVER3: cannot verify if this is an IPA server >> Unable to find IPA Server to join >> The ipa-client-install command failed. See /var/log/ipaclient-install.log for >> more information >> >> ipaclient-install.log has: >> >> 2020-06-18T18:22:05Z DEBUG [LDAP server check] >> 2020-06-18T18:22:05Z DEBUG Verifying that SERVER1 (realm NWRA.COM) is an IPA >> server >> 2020-06-18T18:22:05Z DEBUG Init LDAP connection to: ldap://SERVER1:389 >> 2020-06-18T18:22:05Z DEBUG Error checking LDAP: Connect error: >> error:1416F086:SSL routines:tls_process_server_certificate:certificate verify >> failed (self signed certificate in certificate chain) >> 2020-06-18T18:22:05Z WARNING Skip SERVER1: cannot verify if this is an IPA >> server >> >> How can I resolve this? > > Is that existing IPA CA cert in /etc/ipa/ca.crt the one for your > installation? > > rob
Thanks for that - that was a stale /etc/ipa/ca.crt from a previous attempt and before IPA certs were updated. Removing that allowed the install to proceed. -- Orion Poplawski Manager of NWRA Technical Systems 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane [email protected] Boulder, CO 80301 https://www.nwra.com/
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
