On Sunday, January 12, 2020 3:11:57 PM CST Anthony Joseph Messina via FreeIPA-
users wrote:
I am running into trouble with certmonger renewal of KRA subsystem
certs on
the renewal master, and CA/KRA subsystem certs on the replica. Any help is
appreciated as my renewal window ends in 8 days.
This is Fedora 31 with freeipa-server-4.8.4-2.fc31.x86_64 on both master and
replica. These systems have been upgraded using the recommended method of
creating new replicas since 4.6.3.
## The renewal master... The cert is renewed, but the ca-error below is
concerning (the same for "CN=KRA Transport Certificate" and "CN=KRA
Storage
Certificate") Request ID '20191117031707':
status: MONITORING
ca-error: Server at
"http://ipa482a.example.com:8080/ca/ee/ca/profileSubmit" replied: Missing
credential: sessionID stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-kra',token='NSS Certificate DB',pin set certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=EXAMPLE.COM
subject: CN=KRA
Audit,O=EXAMPLE.COM
expires: 2022-01-01 12:37:19 CST
key usage: digitalSignature,nonRepudiation
## The replica... The cert is not renewed and the ca-error is different.
Request ID '20191117040017':
status: MONITORING
ca-error: Invalid cookie: ''
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-kra',token='NSS Certificate DB',pin set certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=MESSINET.COM
subject: CN=KRA
Audit,O=MESSINET.COM
expires: 2020-01-21 20:22:24 CST
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-kra" track: yes
auto-renew: yes