I want to setup centralized user management. First to grant access to Linux servers and later also to grant access to other services via LDAP. As i'm new to this, I did some research on Google and I think FreeIPA will fit our requirements.

I installed a CentOS 8 server and installed FreeIPA server. This was pretty straight forward and i'm able to login into the web interface. I do not use the FreeIPA DNS as we have a seperated DNS server. For my test setup I do not use an DNS server at all and just added the client record to the FreeIPA server host file and added the server record tot the FreeIPA client host file. I'm able to ping the server from the client and visa versa by its FQDN and by its hostname.

My client is a Ubuntu server 20.04 client and i installed freeipa-client and tried to configure it with the command ipa-client-install --mkhomedir --no-ntp. I followed the wizard:

  1. IPA server domain = internal.domain.com
  2. IPS server name = ipasrv-hostname
  3. Proceed with fixed DNS values = yes
  4. Configure client with these values = yes
  5. User authorized to enroll computers = admin
  6. password for [email protected] = the password off course
  7. Do you want to download the CA cert from http://axx-fipa-srv01/ipa/config/ca.crt? <= I'm stuck here!

When i choose yes, i receive:

Downloading the CA certificate via HTTP, this is INSECURE
Successfully retrieved CA cert
Joining realm failed: libcurl failed to execute the HTTP POST transaction, explaining:  error setting certificate verify locations:
  CAfile: /etc/ipa/ca.crt
  CApath: /etc/ssl/certs

Installation failed. Rolling back changes.

When i choose no, the configuration directly fails:

Cannot obtain CA certificate
HTTP certificate download declined by user
Installation failed. Rolling back changes.
Disabling client Kerberos and LDAP configurations
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Client uninstall complete.

Off course i checked the logs and googled the error but was not able to solve this yet.

What i'm doing wrong?

Also i'm a bit concerned about the warning that its insecure to receive the CA.crt via the (http) url. I understand why but how can i solve this issue? Manually "install" the certificates on the client? where do i get them from an where do i need to place them?


@Gerald Schneider's comment made me think that it indeed can be a permission issue. As i understand this libcurl failed to execute the HTTP POST transaction, explaining: error setting certificate verify locations well, it means that it tries to "set" something on the FreeIPA server but the server/application is not able to write to the /etc/ipa and /etc/ssl/cert folder. Can i test this?

  • Could be a permission issue. Are you running the command as root (sudo)? Commented May 13, 2020 at 8:27
  • Yes i do. I'm logged in as root (root@fipaclient#)
    – CodeNinja
    Commented May 13, 2020 at 8:28
  • 2
    It looks like I have exactly the same error. Client is running CentOS 8. Commented Nov 16, 2020 at 14:32

2 Answers 2


Check DNS. Found this when I had the same error. I was a satellite location where I had no control of DNS. I ended up putting the ipa servers hostname ('hostname -f') into the hosts file of the client and then it worked.

  • I\m not sure what the solution was but i have it running now. I skipped the IPA server project months ago and decided to give it a retry few weeks ago. I started with a fresh installed server and it worked the first try so i cant say if this is the solution for my issue or not. Thanks for the answer anyway, i hope it helps others!
    – CodeNinja
    Commented Jan 7, 2021 at 19:18

Saying "no" to some questions (hitting enter) and ignoring warnings worked for me.

WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd                                                     
DNS discovery failed to determine your DNS domain                                                                                                     
Provide the domain name of your IPA server (ex: example.com): yipee.yo                                                                                 
Provide your IPA server name (ex: ipa.example.com): forecast.yipee.yo                                                                                   
The failure to use DNS to find your IPA server indicates that your resolv.conf file is not properly configured.                                       
Autodiscovery of servers for failover cannot work with this configuration.                                                                            
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to 
other servers in case of failure.                                                                                                                     
Proceed with fixed values and no DNS discovery? [no]: yes
Do you want to configure chrony with NTP server or pool address? [no]: 

Name resolution always worked fine on this VM. Not sure why the ipa-client-install script borks on the DNS. The client is Ubuntu 22 LTS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .