Currently when setting up PKI replication the DS master's credentials are transferred PKI clone such that the clone can create the replication agreements on DS master and clone. There are some issues with this mechanism:

• the DS master should be considered a private database for the PKI master, so the DS master credentials should not be passed to the clone even if it's done via SSL and only used temporarily during installation
• there might be situations where the PKI clone is not allowed to access the DS master directly except for replication
• the PKI clone will have full access to the DS master, which means it can accidentally or unintentionally mess up the DS master configuration
• suppose in the future we want to support read-only replica where the clone is untrusted to perform changes to the database, the clone should not be trusted to change the DS master configuration either

To address these problems, the replication agreement for the DS master has to be created separately. This can be done transparently with a single command, for example:

$ pki-server replica-prepare <clone's hostname>

This command should prepare everything needed to setup a replication on the master's side, which includes:

• exporting only the certificates and keys needed by the clone into PKCS #12 file
• creating the DS master's replication agreement
• optional: export DS master database to speed up the import on the clone

This will also help troubleshooting cloning issues since now it will be possible to verify that the master has everything needed for cloning before even starting the installation on the clone.

Also note that IPA already uses the same mechanism, but this mechanism should be supported formally by PKI.