Editing Tornedo.tetrain.com Upgrade Plan (section)

=== 8.1 Chosen approach ===

* Clients (all 110 enrolled hosts) reference the server exclusively by DNS hostname (<code><nowiki>tornedo.tetrain.com</nowiki></code>) in <code><nowiki>sssd.conf</nowiki></code>/<code><nowiki>krb5.conf</nowiki></code> — confirmed by inspecting a real enrolled client (<code><nowiki>nic.tetra.in</nowiki></code>), never a raw IP. This makes an identity handoff (new server assumes the same hostname via DNS repoint at cutover) viable with '''zero client-side reconfiguration''' — the only alternative (repoint 110 clients, ~80 of which are other companies' servers) was ruled out as an operational non-starter.
* '''Two-hop replica bridge''', not a direct jump: a direct replica attempt from the old server (IPA 4.6, 2017-era Dogtag/NSS stack) straight to a new AlmaLinux 9 box (IPA 4.13) failed the CA-cloning step with <code><nowiki>403 Forbidden</nowiki></code> on the CA's REST API — a genuine protocol/auth incompatibility across ~7 major IPA versions, not a config error (confirmed: not a network issue, not clock skew). Same "don't skip versions" principle as leapp, applied to IPA replica compatibility. Fix: bridge through an intermediate replica on a version roughly in between.