LDAP / Replication on 5.x -> 6.x Upgrade

[Fox_sibirsky]

When Upgrade from 6.04 -> to 6.06 I caught this error:
Also I use self-signed certificates

Copy /opt/zimbra/conf/ca/ca.pem /opt/zimbra/conf/ca/ca.key from master to replica
And run
zimbra@host:$ ln -f -s ca.pem /opt/zimbra/conf/ca/`openssl x509 -hash -noout -in /opt/zimbra/conf/ca/ca.pem`.0

[Vladimir]

Originally Posted by gareth

Hi, I took this up with quanah offline and between us I think we identified 3 critical bugs, typically associated with upgrading, specifically in the context of LDAP/master/slave setups. I was given some patches and eventually got it working, took many days of time.

Apparently the fixes would not be in the next release, but would be in the next but one release .. not really been tracking it since then. I've no intention of upgrading that setup again - even now all the logging is broken to the extent the online console says everything is down -even tho' it's working fine.

I reckon those 'bugs' probably cost me two man weeks of work to circumvent / fix, and the upgrade was required due to another critical bug in the calendaring system that wasn't back-patched.

Bit of a mess really ...

I just ran into this problem. Any chance that Zimbra can tell us what the patches are supposed to be and how to fix this?

[quanah]

The problem is in zmcertmgr, and what is hopefully the final fix for this (there have been a large number of different causes for it, it's not been any single one issue) went into p4 today for the 6.0.8 release.

[itipopema]

HI

We upgraded from 6.0.4 (with master and slave ldap replication) to 7.1 .... but starting with this upgrade we see permanent problem on slave with:
Error, ldap_start_tls failed (-11)
do_syncrepl: rid=100 rc -11 retrying

We tried and copied ca.pem files from master to slave but this doesn't work. Could you pls advice what to do??

Our installation is NE.

Thx,
Marcin

[Fox_sibirsky]

zimbra$ ln -f -s ca.pem /opt/zimbra/conf/ca/`openssl x509 -hash -noout -in /opt/zimbra/conf/ca/ca.pem`.0

Do you run this on replica?

May be you certificate is expired? Release note file has manual about it