[Freeipa-users] Re: "certmonger.py", line 317, in request_and_wait_for_cert

then the problem you are seeing is probably BZ 14852017 [RFE] If the umask is too restrictive the installation won't work [1] Did you install the master with a umask different from 022? In this case, some configuration files are probably not accessible by non-root user, and the httpd server - running as apache - cannot read files needed to establish the secure connection to dogtag. You can try to change the permissions for /etc/ipa/ca.crt and /var/lib/ipa/ra-agent.{key|pem} on the master: $ chmod 444 /etc/ipa/ca.crt $ chmod 440 /var/lib/ipa/ra-agent.* and re-try the replica installation. HTH, Flo