For clarity I want to restate the fix is as follows, which will retain the service restart functionality, tested on cent7 / ipa 4.4.0
as root, one liner:
getcert resubmit -i $(getcert list -d /etc/httpd/alias -n "Server-Cert" | grep -o '[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]') -D `hostname -f` -C /usr/libexec/ipa/certmonger/restart_httpd;
/usr/libexec/ipa/certmonger/restart_httpd
Thank You,
-Jake
From: "Prasun Gera" <prasun.gera@gmail.com>
To: "freeipa-users" <freeipa-users@lists.fedorahosted.org>
Cc: "Jake" <email@ml.jacobdevans.com>, "Alexander Bokovoy" <abokovoy@redhat.com>
Sent: Tuesday, May 23, 2017 4:09:14 PM
Subject: Re: [Freeipa-users] Re: Chrome 58 - CN for IPA management console to include SANs
I posted this in the earlier thread, but didn't get a response. I was able to fix this on the master, but "getcert list -d /etc/httpd/alias -n "Server-Cert" on the replica doesn't return anything. Are the replica's SSL certs handled differently ?