Hi Flo, your feedback helps, thanks a lot !!!
Interestingly, 'ipa config-show' read that none of four (4) server is renewal
master. I suspect it's the one that's installed first, indeed it has file
/var/lib/ipa/pki-ca/publish/MasterCRL.bin
Finally I fixed that so ca-ldap01 now reads as "IPA CA renewal master". There is
additional progress, but not complete. I reset clock to time before expiration, not before
"notBefore",
restart certmonger service, here is the status.
There are 3 expired certs, but status read "monitoring", actually on one
it's switching between "monitoring" and "submitting"
status: MONITORING
stuck: no
CA: dogtag-ipa-ca-renew-agent
subject: CN=CA
Audit,O=US.ORACLE.COM
expires: 2018-08-14 20:49:38 UTC
track: yes
auto-renew: yes
status: MONITORING
stuck: no
CA: dogtag-ipa-ca-renew-agent
subject: CN=OCSP
Subsystem,O=US.ORACLE.COM
expires: 2020-10-11 20:15:53 UTC
track: yes
auto-renew: yes
status: switch between MONITORING and SUBMITTING
stuck: no
CA: dogtag-ipa-ca-renew-agent
subject: CN=CA
Subsystem,O=US.ORACLE.COM
expires: 2018-08-14 20:49:36 UTC
track: yes
auto-renew: yes
status: MONITORING
stuck: no
CA: dogtag-ipa-ca-renew-agent
subject: CN=Certificate
Authority,O=US.ORACLE.COM
expires: 2038-10-22 18:15:48 UTC
track: yes
auto-renew: yes
status: MONITORING
stuck: no
CA: dogtag-ipa-ca-renew-agent
subject: CN=IPA
RA,O=US.ORACLE.COM
expires: 2018-08-14 20:50:00 UTC
track: yes
auto-renew: yes
status: MONITORING
stuck: no
CA: dogtag-ipa-renew-agent
subject:
CN=ca-ldap01.us.oracle.com,O=US.ORACLE.COM
expires: 2020-07-07 01:47:45 UTC
track: yes
auto-renew: yes
I believe that track and auto-renew have been always "yes", but seems this
didn't prevent problem. What would be next troubleshoot to finalize resolution, thanks
in advance,
Zarko