Hi Rob, thanks much.
Some of Flo's blogs about CA helps me to understand better now. Sure "ipa
cacert-manage renew" and "ipa-certupdate" was run before, hopefully not
harmful, "caSigningCert cert-pki-ca" was valid for 18 more years.
You're right, there is mix of old and renewed ones, three requres renewal:
auditSigningCert, subsystemCert and ipaCert , all expired on 2018-08-14.
Time I went back was 7 days earlier, 2018-08-07
Sorry, nothing to revert, please let me know what would you suggest now. The state of
certs is:
status: MONITORING
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
subject: CN=CA
Audit,O=DOMAIN.COM
expires: 2018-08-14 20:49:38 UTC
status: MONITORING
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
subject: CN=OCSP
Subsystem,O=DOMAIN.COM
expires: 2020-10-11 20:15:53 UTC
status: MONITORING
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
subject: CN=CA
Subsystem,O=DOMAIN.COM
expires: 2018-08-14 20:49:36 UTC
status: MONITORING
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
subject: CN=Certificate
Authority,O=DOMAIN.COM
expires: 2038-10-22 18:15:48 UTC
status: MONITORING
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
subject: CN=IPA
RA,O=DOMAIN.COM
expires: 2018-08-14 20:50:00 UTC
status: MONITORING
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
subject:
CN=ca-ldap01.DOMAIN.com,O=DOMAIN.COM
expires: 2020-07-07 01:47:45 UTC