21.5. Installing an IdM replica without integrated DNS and without a CA

• Without integrated DNS
• Without a certificate authority (CA) by providing the required certificates manually. The assumption here is that the first server was installed without a CA.

Prerequisites

• Ensure your system is prepared for an IdM replica installation.

Procedure

• Enter ipa-replica-install, and provide the required certificate files by adding these options:

  • --dirsrv-cert-file
  • --dirsrv-pin
  • --http-cert-file
  • --http-pin

  Additionally, you must specify either --no-pkinit or both --pkinit-cert-file and --pkinit-pin.

  For details about the files that are provided using these options, see Certificates required to install an IdM server without a CA.

  For example:

  # ipa-replica-install \
      --dirsrv-cert-file /tmp/server.crt \
      --dirsrv-cert-file /tmp/server.key \
      --dirsrv-pin secret \
      --http-cert-file /tmp/server.crt \
      --http-cert-file /tmp/server.key \
      --http-pin secret \
      --no-pkinit

  注記

  Do not add the --ca-cert-file option. The ipa-replica-install utility takes this part of the certificate information automatically from the first server you installed.

Next steps

• In large deployments, you might want to tune specific parameters of IdM replicas for better performance. Consult the Tuning Performance in Identity Management title to find tuning instructions to best suit your scenario.