Am Freitag, 30. März 2018, 14:27:13 CEST schrieb Florence Blanc-Renaud via
FreeIPA-users:
On 03/30/2018 01:19 PM, Günther J. Niederwimmer via FreeIPA-users
wrote:
> Hello,
>
> can any help me to find out the correct way to renew the certificates
> After a Problem I found out my certificates are not renewed on my two ipa
> servers ?
>
> My ipa servers Version is 4.5.0-22-22
> Centos 7.4
>
> All i found on the list or goo.... is not working for me :-(.
>
> have any a a link to the correct way to renew the certificates.
>
> Thanks for a answer,
>
Hi,
first of all, which certificates are expired? Are there multiple masters
in your topology where the CA component is installed?
Request ID '20171205024933':
status: CA_UNREACHABLE
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/
alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate
DB'
expires: 2018-03-08 12:57:27 UTC
Request ID '20171205024934':
status: CA_UNREACHABLE
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/
alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate
DB'
expires: 2018-03-08 12:57:25 UTC
Request ID '20171205024935':
status: CA_UNREACHABLE
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/
alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate
DB'
expires: 2018-03-08 12:57:26 UTC
Request ID '20171205024937':
status: CA_UNREACHABLE
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
expires: 2018-03-08 12:58:59 UTC
all of the certificate have this Error
Check if the CA is installed on multiple nodes:
# ipa server-role-find --role='CA server'
Request ID '20171205024937':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=ESSLMAIER.AT
subject: CN=IPA RA,O=ESSLMAIER.AT
expires: 2018-03-08 12:58:59 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Number of certificates and requests being tracked: 9.
Request ID '20171205024933':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/
alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate
DB',pin
set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/
alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate
DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=ESSLMAIER.AT
subject: CN=CA Audit,O=ESSLMAIER.AT
expires: 2018-03-08 12:57:27 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
and so on
If the CA is installed on multiple nodes, find the CA renewal
master:
# ipa config-show | grep 'CA renewal master'
on each server I have the output this is the master ??
ipa config-show | grep 'CA renewal master'
IPA CA renewal master: ipa.xxxxxxx.at
ipa config-show | grep 'CA renewal master'
IPA CA renewal master: ipa1.xxxxxxx.at
If the certs did not renew properly, the CA renewal master needs to
be
fixed first. Once all the certs on this machine are updated, you can
start fixing the other ones.
Check which certificates are expired:
# getcert list | grep -E "Request ID|status|certificate|expires"
Once the expired certificates are identified, please provide any
specific error messages obtained in the output of 'getcert list -i
<request ID>', this may help diagnose the issue.
Thanks for the a answer,
--
mit freundlichen Grüssen / best regards,
Günther J. Niederwimmer