Hi guys.

for what 'ipa-healthcheck' complains of:

  {
    "source": "ipahealthcheck.ds.replication",
    "check": "ReplicationCheck",
    "result": "WARNING",
    "uuid": "720d7af6-5a11-486f-a610-f6f06ec4d9e2",
    "when": "20230526202306Z",
    "duration": "0.054683",
    "kw": {
      "key": "DSREPLLE0002",
      "items": [
        "Replication",
        "Conflict Entries"
      ],
      "msg": "There were 1 conflict entries found under the replication suffix \"o=ipaca\"."
    }
  },

and old trick finds not culprit:

-> $ ldapsearch -LLL -H ldaps://$(hostname) -Y GSSAPI -D 'cn=Directory Manager' -b 'o=ipaca' '(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))' nsds5ReplConflict
SASL/GSSAPI authentication started
SASL username: admin@MINE.PRIV
SASL SSF: 256
SASL data security layer installed.

where is it hiding?
many thanks, L.