freeipa

#8974 RHEL 8.5 IPA Replica setup fails against a RHEL 7.9 IPA server
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 8): Bug 1999142

Created attachment 1819099
replica install log
Description of problem:
IPA replica setup is failing when server is RHEL7.9 and replica is RHEL 8.5
Version-Release number of selected component (if applicable):
RHEL 7.9 Server packages:
ipa-server-4.6.8-5.el7_9.7.x86_64
ipa-server-dns-4.6.8-5.el7_9.7.noarch
389-ds-base-1.3.10.2-12.el7_9.x86_64
pki-base-10.5.18-16.el7_9.noarch
RHEL 8.5 replica packages:
ipa-server-4.9.6-4.module+el8.5.0+11912+1b4496cf.x86_64
ipa-server-dns-4.9.6-4.module+el8.5.0+11912+1b4496cf.noarch
389-ds-base-1.4.3.23-10.module+el8.5.0+12398+47000435.x86_64
pki-base-10.11.0-2.module+el8.5.0+12220+9cc212a8.noarch
How reproducible:
Always
Steps to Reproduce:
1.Setup IPA server on a RHEL 7.9 system
2.Setup IPA replica on a RHEL 8.5 system
3.
Actual results:
RHEL 8.5 replica setup against RHEL 7.9 server fails
Expected results:
Replica setup should be successful
Additional info:
https://pagure.io/freeipa/issue/8738

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1999142

Metadata Update from @rcritten:
- Issue assigned to rcritten

https://github.com/freeipa/freeipa/pull/5995

Metadata Update from @rcritten:
- Custom field changelog adjusted to When creating a new replica against an older existing server that lacks the sanToCNDefaultImpl capability, the ACME certificate profile cannot be added. Running ipa-server-upgrade manually after ipa-replica-install has completed will correctly add in the missing profile.

master:

  • 4414d50d2a5452477eea40bec58266b19f43065e Catch and log errors when adding CA profiles

ipa-4-9:

  • a6e708ab4006d6623c37de1692de5362fcdb5dd6 Catch and log errors when adding CA profiles

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
When creating a new replica against an older existing server that lacks the sanToCNDefaultImpl capability, the ACME certificate profile cannot be added. Running ipa-server-upgrade manually after ipa-replica-install has completed will correctly add in the missing profile.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.