What if I lose my IPA CA?
I can't find any documentation how we'd handle this in IPA, so before a customer runs into it... What happens if someone sets up multiple IPA servers and only has a CA installed on one of them, and that server goes away forever for some reason (they deleted the replica, horrific failure, etc)? Let's also assume they saved the original CA PKCS#12 file. Is there some mechanism to either stand up a new dogtag instance with this CA's key? Would it be better to stand up a new server as a subordinate of this CA? I'm not entirely sure of the mechanics we'd use for either of these, but its a start. thanks rob
On 08/29/2012 06:04 AM, Rob Crittenden wrote:
I can't find any documentation how we'd handle this in IPA, so before a customer runs into it...
What happens if someone sets up multiple IPA servers and only has a CA installed on one of them, and that server goes away forever for some reason (they deleted the replica, horrific failure, etc)?
Let's also assume they saved the original CA PKCS#12 file.
You may need to save more than the original CA PKCS#12 file. You should save also CA's internal database and remember how it was customize.
Is there some mechanism to either stand up a new dogtag instance with this CA's key? Would it be better to stand up a new server as a subordinate of this CA?
I'm not entirely sure of the mechanics we'd use for either of these, but its a start.
thanks
rob
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
participants (2)
-
Andrew Wnuk -
Rob Crittenden