On 1/29/20 11:12 AM, Daniel PC via FreeIPA-users wrote: Hi Daniel, if each replica is installed with the same set of services as the first server, there is no functional difference (*). For instance, if master was configured with CA, KRA, DNS, AD trust controller and the replicas also host the same services, any replica could replace the master. (*) The only difference is related to the master CA role. This role can be taken by only one server, and consists in CA renewal master and CRL generation master. If the server hosting this role needs to be decommissioned, you can move this role to another master. Please read the book "Planning Identity Management" [1], especially the IdM Terminology chapter [2], and in "Configuring and Managing IdM" the sections related to Changing and resetting IdM CA renewal master [3] and Generating CRL on the IdM CA server [4] HTH, flo [1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/... [2] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/... [3] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/... [4] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...