pki-bot
commented
3 years ago Comment from jmagne (@jmagne) at 2015-07-08 01:30:34
A related ticket was found first that will be closing: Ticket 1358
During work on a ticket to diagnose an issue with creating a clone of an OCSP using pkispawn, this problem was discovered as follows:
Create the master ca and ocsp on a host.
On the same host create a clone of the ocsp after creating another directory server instance to hold the data for all the clones.
This failed due to another ticket as described.
Used pkidestroy to dispose of the aborted ocsp clone instance attempt.
Re-ran the same pkispawn test, using the exact same install cfg file to re-attempt the clone with the exact same parameters. This operation failed earlier than the previous test due to a different case. This time it failed because the cloned OCSP's debug log is reporting a problem with negotiating the various replication agreement steps.
This issue was migrated from Pagure Issue #1467. Originally filed by jmagne (@jmagne) on 2015-07-08 01:29:27:
As of now due to some error, we only support cloning two OCSP servers. Of course we want to support an arbitrary number of clones for this feature to be truly useful.
The theory on the problem has to do with replica id's of the various clones. The CA and KRA make use of a framework designed to maintain replica id ranges, in order to avoid such collisions.
The fix will likely be to implement the replica ranges for the OCSP as done in the CA and KRA.