Chapter 3. Preparing for server loss with replication

Procedure

1. Configure three or more replicas to provide CA services.

   1. To install a new replica with CA services, run ipa-replica-install with the --setup-ca option.

      [root@server ~]# ipa-replica-install --setup-ca

      Copy to Clipboard Toggle word wrap

   2. To install CA services on a preexisting replica, run ipa-ca-install.

      [root@replica ~]# ipa-ca-install

      Copy to Clipboard Toggle word wrap

2. Create CA replication agreements between your CA replicas.

   [root@careplica1 ~]# ipa topologysegment-add
   Suffix name: ca
   Left node: ca-replica1.example.com
   Right node: ca-replica2.example.com
   Segment name [ca-replica1.example.com-to-ca-replica2.example.com]: new_segment
   ---------------------------
   Added segment "new_segment"
   ---------------------------
     Segment name: new_segment
     Left node: ca-replica1.example.com
     Right node: ca-replica2.example.com
     Connectivity: both

   Copy to Clipboard Toggle word wrap
   Warning

   If only one server provides CA services and it is damaged, the entire environment will be lost. If you use the IdM CA, Red Hat strongly recommends having three or more replicas with CA services installed, with CA replication agreements between them.