Editing Tornedo.tetrain.com Upgrade Plan (section)

=== 8.6 Full validation — DONE ===

* '''Kerberos ticket issuance''': <code><nowiki>kinit -kt /etc/krb5.keytab host/ipa.tetrain.com</nowiki></code> on the box itself issued a valid <code><nowiki>krbtgt/TORNEDO.TETRAIN.COM</nowiki></code> ticket — KDC fully operational.
* '''Full LDAP+API roundtrip''': <code><nowiki>ipa user-show admin</nowiki></code> returned complete, correct user data — proves 389-ds + httpd + the IPA API framework all work together correctly on this server.
* '''Web UI''': <code><nowiki>https://ipa.tetrain.com/ipa/ui/</nowiki></code> responds <code><nowiki>HTTP 200</nowiki></code>.
* '''CA issuance''': implicitly proven — the certs from the install itself (fresh <code><nowiki>2028-07-23</nowiki></code> expiries) were issued live by this server's own CA during setup, not copied from elsewhere.
* '''Real external client reachability''': tested from <code><nowiki>koha.tetra.in</nowiki></code> (an actual production server already enrolled against the *old* <code><nowiki>tornedo.tetrain.com</nowiki></code>) — all 6 ports (389/636/88/464/80/443) open to the new server, and an ad-hoc <code><nowiki>ldapsearch</nowiki></code> returned the correct naming contexts (<code><nowiki>dc=tornedo,dc=tetrain,dc=com</nowiki></code>, <code><nowiki>o=ipaca</nowiki></code>), matching the domain exactly. This is the closest proxy available for "will real clients actually be able to use this server" without touching any production client's persistent config.

<code><nowiki>ipa.tetrain.com</nowiki></code> is a fully healthy, fully validated replica at this point.