Thank you so much! That appears to have worked!
-----
[root@orldc-prod-ipa01 alias]# getcert list | grep
'pki-tomcat.*Server-Cert cert-pki-ca' -A10 -B3
Request ID '20181008203713':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=PASSUR.LOCAL
subject: CN=orldc-prod-ipa01.passur.local,O=PASSUR.LOCAL
expires: 2020-11-24 18:09:49 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
-----
I'll this sit a bit, and then I've got to attack the issues I'm having
on my 'ipa02' system (the first replica). Again, thanks alot for the
help.
On Wed, Dec 5, 2018 at 11:40 AM Rob Crittenden <rcritten(a)redhat.com> wrote:
>
> Christopher Young wrote:
> > Another thing I notice that confuses me... (see attached)
>
> Yes. There are multiple services running on the same machine each with
> their own private key.
>
> > Is it normal to have this many certificate with the same Subject for
> > an IPA server? I'm wondering if somewhere along it renewed and yet
> > didn't update locally or something. I'm really not sure what's
going
> > on here, but what I'm confused about is IF I wanted to generate a new
> > server for the IPA server, how would I go about doing that in a manner
> > where the certificate would have all the right attributes? (and would
> > I want to do that?)
> >
> > Sorry for all the questions. I'm figuring the pieces out as I go.
>
> As Fraser mentioned elsewhere we ran into something that appears similar
> and this is how we got around it. I can't guarantee this will fix things
> for you but it seems like it might and should be safe to try.
>
> By default certmonger renews by serial number. So it tells the CA "hey,
> I want the same type of cert I had for serial number X" and dogtag looks
> it up and generates a new one.
>
> There is another option where a new CSR is sent instead, it just
> requires a bit of manual work to do that.
>
> The steps are (for the case where your certs are still valid):
>
> 1. Stop certmonger
> 2. grep dogtag-ipa-ca-renew-agent /var/lib/certmonger/cas/*
> 3. There should be two. You want the one with
"id=dogtag-ipa-ca-renew-agent"
> 4. Modify that file and add -N to ca_external_helper. It needs to look like:
>
> ca_external_helper=/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit
> -N
>
> -N means don't renew the existing serial number (certmonger will send
> the CSR). For more details on the option see
> certmonger-dogtag-ipa-renew-agent-submit(8).
>
> 5. Start certmonger
>
> certmonger may very well say "Hey! I've got a bunch of certs to renew,
> let me get on that!" So watch the output of getcert list to see if it
> already doing things.
>
> If this doesn't happen then manually resubmit the request doing
> something like:
>
> getcert resubmit -d /etc/pki/pki-tomcat/alias -n 'Server-Cert
> cert-pki-ca'
>
> This change should get you a renewed cert.
>
> AND CAPS SO YOU DON'T MISS THIS NEXT STEP :-)
>
> 6. Stop certmonger and remove the -N option so things should renew in
> the future as they do in a typical environment.
>
> And that should do it.
>
> rob