I did run "ipa-server-upgrade" and look like it was
successful but
still in getcert list showing CA_NEED :(
Remind me what the package version of IPA is. I'm confused by the
version 5 in the output about renewal configuration.
You might also want to try running with --debug as depending on release
it will give more information about this.
rob
[root@ldap-ca-master ~]# ipa-server-upgrade
Upgrading IPA:
[1/10]: stopping directory server
[2/10]: saving configuration
[3/10]: disabling listeners
[4/10]: enabling DS global lock
[5/10]: starting directory server
[6/10]: updating schema
[7/10]: upgrading server
[8/10]: stopping directory server
[9/10]: restoring configuration
[10/10]: starting directory server
Done.
Update complete
Upgrading IPA services
Upgrading the configuration of the IPA services
[Verifying that root certificate is published]
[Migrate CRL publish directory]
CRL tree already moved
/etc/dirsrv/slapd-EXAMPLE-COM/certmap.conf is now managed by IPA. It
will be overwritten. A backup of the original will be made.
[Verifying that CA proxy configuration is correct]
[Verifying that KDC configuration is using ipa-kdb backend]
[Fix DS schema file syntax]
Syntax already fixed
[Removing RA cert from DS NSS database]
RA cert already removed
[Enable sidgen and extdom plugins by default]
[Updating HTTPD service IPA configuration]
[Updating mod_nss protocol versions]
Protocol versions already updated
[Updating mod_nss cipher suite]
[Fixing trust flags in /etc/httpd/alias]
Trust flags already processed
[Exporting KRA agent PEM file]
KRA is not enabled
[Removing self-signed CA]
[Removing Dogtag 9 CA]
[Checking for deprecated KDC configuration files]
[Checking for deprecated backups of Samba configuration files]
[Setting up Firefox extension]
[Add missing CA DNS records]
IPA CA DNS records already processed
[Removing deprecated DNS configuration options]
DNS is not configured
[Ensuring minimal number of connections]
DNS is not configured
[Enabling serial autoincrement in DNS]
DNS is not configured
[Updating GSSAPI configuration in DNS]
DNS is not configured
[Updating pid-file configuration in DNS]
DNS is not configured
DNS is not configured
DNS is not configured
DNS is not configured
DNS is not configured
DNS is not configured
DNS is not configured
DNS is not configured
[Upgrading CA schema]
CA schema update complete (no changes)
[Verifying that CA audit signing cert has 2 year validity]
[Update certmonger certificate renewal configuration to version 5]
[Enable PKIX certificate path discovery and validation]
PKIX already enabled
[Authorizing RA Agent to modify profiles]
[Authorizing RA Agent to manage lightweight CAs]
[Ensuring Lightweight CAs container exists in Dogtag database]
[Adding default OCSP URI configuration]
[Ensuring CA is using LDAPProfileSubsystem]
[Migrating certificate profiles to LDAP]
[Ensuring presence of included profiles]
[Add default CA ACL]
Default CA ACL already added
[Set up lightweight CA key retrieval]
Creating principal
Retrieving keytab
Creating Custodia keys
Configuring key retriever
The IPA services were upgraded
The ipa-server-upgrade command was successful
[root@ldap-ca-master ~]# getcert list | grep status
status: NEED_CA
status: NEED_CA
status: NEED_CA
status: NEED_CA
status: NEED_CA
status: NEED_KEY_PAIR
status: NEED_KEY_PAIR
status: NEED_KEY_PAIR
status: NEED_KEY_PAIR
status: NEED_CA
status: NEED_KEY_PAIR
status: NEED_CA
On Tue, Sep 24, 2019 at 3:55 AM Florence Blanc-Renaud <flo(a)redhat.com> wrote:
>
> On 9/23/19 4:10 PM, Satish Patel via FreeIPA-users wrote:
>> Thanks Florence,
>>
>> is it safe to run "ipa-server-upgrade" ?
>>
> Hi,
> generally yes :)
>
> We had a few tickets related to upgrade but they are mainly revealing
> already present issues (for instance because this CLI stops and starts
> the services, expired certs would prevent successful completion).
>
>> Do i need to provide any option with "ipa-server-upgrade" command? i
>> believe few month back when i tried to do "ipa-server-upgrade" it
>> broke some stuff but anyway i will take snapshot of VM and try in
>> worst case scenario.
> With the VM snapshot you are on the safe side.
>
> flo
>
>>
>> On Mon, Sep 23, 2019 at 2:25 AM Florence Blanc-Renaud <flo(a)redhat.com>
wrote:
>>>
>>> On 9/21/19 7:41 PM, Satish Patel via FreeIPA-users wrote:
>>>> Any thought ?
>>> Hi,
>>> if you run ipa-server-upgrade on this node, the command will fix the
>>> tracking of certs. You should see in the output;
>>> [Update certmonger certificate renewal configuration]
>>>
>>> HTH,
>>> flo
>>>
>>>>
>>>> Sent from my iPhone
>>>>
>>>>> On Sep 20, 2019, at 11:35 AM, Satish Patel
<satish.txt(a)gmail.com> wrote:
>>>>>
>>>>> Rob sorry, i trim my output thought not necessary but anyway here is
>>>>> the full list (ignore CAPS letter in output)
>>>>>
>>>>> [root@ldap-ca-master ~]# getcert list
>>>>>
>>>>> Number of certificates and requests being tracked: 12.
>>>>>
>>>>> Request ID '20190915042927':
>>>>>
>>>>> status: NEED_CA
>>>>>
>>>>> stuck: yes
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
>>>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
>>>>> cert-pki-ca',token='NSS Certificate DB'
>>>>>
>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> subject: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> expires: 2037-01-05 14:47:24 UTC
>>>>>
>>>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915043150':
>>>>>
>>>>> status: NEED_CA
>>>>>
>>>>> stuck: yes
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
>>>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
>>>>> cert-pki-ca',token='NSS Certificate DB'
>>>>>
>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> subject:
CN=ldap-ca-master.foo.EXAMPLE.com,O=EXAMPLE.COM
>>>>>
>>>>> expires: 2020-11-17 18:30:29 UTC
>>>>>
>>>>> key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>>>
>>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915043212':
>>>>>
>>>>> status: NEED_CA
>>>>>
>>>>> stuck: yes
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
>>>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
>>>>> cert-pki-ca',token='NSS Certificate DB'
>>>>>
>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> subject: CN=OCSP
Subsystem,O=EXAMPLE.COM
>>>>>
>>>>> expires: 2020-11-17 18:31:26 UTC
>>>>>
>>>>> eku: id-kp-OCSPSigning
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915043224':
>>>>>
>>>>> status: NEED_CA
>>>>>
>>>>> stuck: yes
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
>>>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
>>>>> cert-pki-ca',token='NSS Certificate DB'
>>>>>
>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> subject: CN=CA
Audit,O=EXAMPLE.COM
>>>>>
>>>>> expires: 2020-11-17 18:32:07 UTC
>>>>>
>>>>> key usage: digitalSignature,nonRepudiation
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915043237':
>>>>>
>>>>> status: NEED_CA
>>>>>
>>>>> stuck: yes
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
>>>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
>>>>> cert-pki-ca',token='NSS Certificate DB'
>>>>>
>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> subject: CN=CA
Subsystem,O=EXAMPLE.COM
>>>>>
>>>>> expires: 2020-11-17 18:31:16 UTC
>>>>>
>>>>> key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>>>
>>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915043246':
>>>>>
>>>>> status: NEED_KEY_PAIR
>>>>>
>>>>> stuck: no
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',pin
>>>>> set
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',token='NSS
>>>>> Certificate DB'
>>>>>
>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>>>
>>>>> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>>>
>>>>> expires: 2037-12-31 23:59:59 UTC
>>>>>
>>>>> key usage: keyCertSign,cRLSign
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915043304':
>>>>>
>>>>> status: NEED_KEY_PAIR
>>>>>
>>>>> stuck: no
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
>>>>> Intermediate',pin set
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
>>>>> Intermediate',token='NSS Certificate DB'
>>>>>
>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>>>
>>>>> subject: CN=Go Daddy Secure Certificate Authority -
>>>>>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>>>
>>>>> expires: 2031-05-03 07:00:00 UTC
>>>>>
>>>>> key usage: keyCertSign,cRLSign
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915045112':
>>>>>
>>>>> status: NEED_KEY_PAIR
>>>>>
>>>>> stuck: no
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM IPA
>>>>> CA',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM
>>>>> IPA CA',token='NSS Certificate DB'
>>>>>
>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> subject: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> expires: 2037-01-05 14:47:24 UTC
>>>>>
>>>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915045148':
>>>>>
>>>>> status: NEED_KEY_PAIR
>>>>>
>>>>> stuck: no
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',token='NSS
>>>>> Certificate DB'
>>>>>
>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>>>
>>>>> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>>>
>>>>> expires: 2037-12-31 23:59:59 UTC
>>>>>
>>>>> key usage: keyCertSign,cRLSign
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915045156':
>>>>>
>>>>> status: NEED_CA
>>>>>
>>>>> stuck: yes
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
>>>>> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
>>>>> Certificate DB'
>>>>>
>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> subject: CN=Object Signing
Cert,O=EXAMPLE.COM
>>>>>
>>>>> expires: 2021-01-05 14:49:59 UTC
>>>>>
>>>>> key usage: digitalSignature,keyCertSign
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915045206':
>>>>>
>>>>> status: NEED_KEY_PAIR
>>>>>
>>>>> stuck: no
>>>>>
>>>>> key pair storage:
>>>>> type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
>>>>> Intermediate',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
>>>>> Intermediate',token='NSS Certificate DB'
>>>>>
>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>>>
>>>>> subject: CN=Go Daddy Secure Certificate Authority -
>>>>>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>>>
>>>>> expires: 2031-05-03 07:00:00 UTC
>>>>>
>>>>> key usage: keyCertSign,cRLSign
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>> Request ID '20190915045216':
>>>>>
>>>>> status: NEED_CA
>>>>>
>>>>> stuck: yes
>>>>>
>>>>> key pair storage:
>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
>>>>> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>>>
>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
>>>>> Certificate DB'
>>>>>
>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>>>
>>>>> subject: CN=IPA
RA,O=EXAMPLE.COM
>>>>>
>>>>> expires: 2020-11-17 18:31:36 UTC
>>>>>
>>>>> key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>>>
>>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>>>
>>>>> pre-save command:
>>>>>
>>>>> post-save command:
>>>>>
>>>>> track: yes
>>>>>
>>>>> auto-renew: yes
>>>>>
>>>>>> On Fri, Sep 20, 2019 at 10:58 AM Rob Crittenden
<rcritten(a)redhat.com> wrote:
>>>>>>
>>>>>> Satish Patel via FreeIPA-users wrote:
>>>>>>> Few days ago my Master CA was messed up and getcert list was
showing
>>>>>>> empty list (no cert to track)
>>>>>>>
>>>>>>> So i run following command to add certs manually:
>>>>>>>
>>>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
>>>>>>> 'ocspSigningCert cert-pki-ca' -P XXXXXXX
>>>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
>>>>>>> 'auditSigningCert cert-pki-ca' -P XXXXXXX
>>>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
'subsystemCert
>>>>>>> cert-pki-ca' -P XXXXXXX
>>>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
'Godaddy' -P XXXXXXX
>>>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
'Godaddy
>>>>>>> Intermediate' -P XXXXXXX
>>>>>>>
>>>>>>> And after that i am seeing this status (status: NEED_CA )
it should
>>>>>>> be MONITORING right?
>>>>>>>
>>>>>>> # getcert list
>>>>>>> Number of certificates and requests being tracked: 12.
>>>>>>
>>>>>> You setup the tracking wrong. Your output only shows 3 certs and
yet
>>>>>> certmonger thinks it has 12. Where are the other 9?
>>>>>>
>>>>>> rob
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
>>>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>
>>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...