Update: after 20-30 minutes, the ca replication errors stopped, leaving only the new IPACertRevocation error and the 404 code: [root(a)ipa1.id.example.com ~]# ipa-healthcheck --failures-only ... ra.get_certificate(): Request failed with status 404: Non-2xx response from CA REST API: 404. Certificate ID 0x13 not found (404) [ { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "c447d225-c712-4a77-b174-81f6ba008128", "when": "20211202025711Z", "duration": "3.825151", "kw": { "key": "20211130180109", "serial": 19, "error": "Certificate operation cannot be completed: Request failed with status 404: Non-2xx response from CA REST API: 404. Certificate ID 0x13 not found (404)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } } ] -----Original Message----- From: Dungan, Scott A. via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt; Sent: Wednesday, December 1, 2021 5:18 PM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt; Cc: Dungan, Scott A. <sdungan(a)caltech.edu&gt; Subject: [Freeipa-users] Re: ipa-healthcheck: ReplicationCheck ERROR Hi, Rob. I think I got ahead of myself and may have made things worse: Because servers iap2 and ipa3 are in agreement (ldif matches) and had no healthcheck errors, and ipa1 did, I assumed that ipa1 needed to be re-initialized. The small number of changes that would be lost on ipa1 was/is considered negligible. To re-initialize ipa1, I ran the following: [root(a)ipa1.id.example.com ~]# ipa-csreplica-manage re-initialize --from ipa3.id.example.com Directory Manager password: Update in progress, 7 seconds elapsed Update succeeded Looks good, but when I do a healthcheck again, now I get additional errors as well as the original: [root(a)ipa1.id.example.com ~]# ipa-healthcheck --failures-only ... ra.get_certificate(): Request failed with status 404: Non-2xx response from CA REST API: 404. Certificate ID 0x13 not found (404 [ { "source": "ipahealthcheck.ds.replication", "check": "ReplicationCheck", "result": "ERROR", "uuid": "023f04e2-e8d8-459e-b2cb-bb516e30db07", "when": "20211202005925Z", "duration": "0.301820", "kw": { "key": "DSREPLLE0003", "items": [ "Replication", "Agreement" ], "msg": "The replication agreement (catoipa2.id.example.com) under \"o=ipaca\" is not in synchronization.\nStatus messa: error (18) can't acquire replica (incremental update transient warning. backing off, will retry update later.)" } }, { "source": "ipahealthcheck.ds.replication", "check": "ReplicationCheck", "result": "ERROR", "uuid": "6b7499ce-2138-415d-88ac-bf24f6f3a6db", "when": "20211202005925Z", "duration": "0.301851", "kw": { "key": "DSREPLLE0003", "items": [ "Replication", "Agreement" ], "msg": "The replication agreement (catoipa3.id.example.com) under \"o=ipaca\" is not in synchronization.\nStatus messa: error (18) can't acquire replica (incremental update transient warning. backing off, will retry update later.)" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "b02a8f85-985f-4b80-a099-fb3d415b2005", "when": "20211202005935Z", "duration": "2.663208", "kw": { "key": "20211130180109", "serial": 19, "error": "Certificate operation cannot be completed: Request failed with status 404: Non-2xx response from CA REST API: 40 Certificate ID 0x13 not found (404)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } } ] -----Original Message----- From: Rob Crittenden <rcritten(a)redhat.com&gt; Sent: Wednesday, December 1, 2021 11:50 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt; Cc: Dungan, Scott A. <sdungan(a)caltech.edu&gt; Subject: Re: [Freeipa-users] ipa-healthcheck: ReplicationCheck ERROR Dungan, Scott A. via FreeIPA-users wrote: You use ipa-csreplica-manage to manage the CA replication agreements. But yes, it looks like you need to re-initialize some of them. I'd suggest dump the ldif of the two to be re-inited and see if there are any entries there not recorded in the one you will re-init from to see if there is any potential data loss. rob _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure