Dogtag9ToDogtag10Migration

FreeIPA version 3.1 and newer introduced support for Dogtag/PKI version 10 containing features making FreeIPA and CA integration more seamless. However, due to changes in architecture of the Dogtag 10 software, there is no automatic procedure to simply upgrade FreeIPA Dogtag 9-based instances to Dogtag 10-based instances and a manual procedure is required (related Dogtag article).

Affected systems

All FreeIPA servers which have CA configured and which were installed prior to version 3.1. In Fedora, this is relevant for all FreeIPA servers with CA installed in Fedora 17 or older.

Upgrade procedure

There are 2 options for the procedure:

1. Manual procedure: requires manual installation steps as described in the article in PKI wikipedia

2. FreeIPA migration procedure: migrating FreeIPA servers with CA by creating replicas with CA capability. See details in the next section.

Migrating FreeIPA servers with CA

Baseline of the procedure:

1. Prepare replica file (ipa-replica-prepare) and install a new FreeIPA replica with CA capability (--setup-ca option) version higher or equal to 3.1

2. Shut down the old affected FreeIPA server with CA

3. Verify that CA and other identity management are OK

4. Remove the affected FreeIPA system from the infrastructure

5. Apply for all affected systems

Detailed instructions can be found in article dedicated to migration.