I've got ipa-server 4.5.0. This is topology with 2 servers and and lost my primary. I found this guide "Promote CA to Renewal and CRL Master Procedure in FreeIPA 4.0 or later <https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master&g...;. Server 1 failed in my case. On server 2, I set enableCRLCache, enableCRLUpdates to false in /etc/pki/pki-tomcat/ca/CS.cfg I restarted pki-tomcatd@pki-tomcat I fixed the revokation rule in apache (enabled the rule) I restarted httpd Now the FreeIPA website says "Internal Server Error" and running kinit admin "kinit: Client's credentials have been revoked while getting initial credentials" Before CA promotion the website and kinit seemed to be working fine on server 2. Is kerberos or LDAP or Kerberos broken now? What steps were missed to failover? -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.