I want to setup centralized user management. First to grant access to Linux servers and later also to grant access to other services via LDAP. As i'm new to this, I did some research on Google and I think FreeIPA will fit our requirements.

I installed a CentOS 8 server and installed FreeIPA server. This was pretty straight forward and i'm able to login into the web interface. I do not use the FreeIPA DNS as we have a seperated DNS server. For my test setup I do not use an DNS server at all and just added the client record to the FreeIPA server host file and added the server record tot the FreeIPA client host file. I'm able to ping the server from the client and visa versa by its FQDN and by its hostname.

My client is a Ubuntu server 20.04 client and i installed freeipa-client and tried to configure it with the command ipa-client-install --mkhomedir --no-ntp. I followed the wizard:

  1. IPA server domain = internal.domain.com
  2. IPS server name = ipasrv-hostname
  3. Proceed with fixed DNS values = yes
  4. Configure client with these values = yes
  5. User authorized to enroll computers = admin
  6. password for admin@ipasrv-hostname.internal.domain.com = the password off course
  7. Do you want to download the CA cert from http://axx-fipa-srv01/ipa/config/ca.crt? <= I'm stuck here!

When i choose yes, i receive:

Downloading the CA certificate via HTTP, this is INSECURE
Successfully retrieved CA cert
Joining realm failed: libcurl failed to execute the HTTP POST transaction, explaining:  error setting certificate verify locations:
  CAfile: /etc/ipa/ca.crt
  CApath: /etc/ssl/certs

Installation failed. Rolling back changes.

When i choose no, the configuration directly fails:

Cannot obtain CA certificate
HTTP certificate download declined by user
Installation failed. Rolling back changes.
Disabling client Kerberos and LDAP configurations
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Client uninstall complete.

Off course i checked the logs and googled the error but was not able to solve this yet.

What i'm doing wrong?

Also i'm a bit concerned about the warning that its insecure to receive the CA.crt via the (http) url. I understand why but how can i solve this issue? Manually "install" the certificates on the client? where do i get them from an where do i need to place them?


@Gerald Schneider's comment made me think that it indeed can be a permission issue. As i understand this libcurl failed to execute the HTTP POST transaction, explaining: error setting certificate verify locations well, it means that it tries to "set" something on the FreeIPA server but the server/application is not able to write to the /etc/ipa and /etc/ssl/cert folder. Can i test this?

  • Could be a permission issue. Are you running the command as root (sudo)? May 13, 2020 at 8:27
  • Yes i do. I'm logged in as root (root@fipaclient#)
    – CodeNinja
    May 13, 2020 at 8:28
  • 1
    It looks like I have exactly the same error. Client is running CentOS 8. Nov 16, 2020 at 14:32

1 Answer 1


Check DNS. Found this when I had the same error. I was a satellite location where I had no control of DNS. I ended up putting the ipa servers hostname ('hostname -f') into the hosts file of the client and then it worked.

  • I\m not sure what the solution was but i have it running now. I skipped the IPA server project months ago and decided to give it a retry few weeks ago. I started with a fresh installed server and it worked the first try so i cant say if this is the solution for my issue or not. Thanks for the answer anyway, i hope it helps others!
    – CodeNinja
    Jan 7, 2021 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.