Update.
Thanks to the invaluable help of Florence. Truly terrific.
What we ended up doing.
Investigate why it happened. No idea.
Check that certificates on the other CA are still valid. Check
Move CRL to the working CA. Check
Figure out the parameters to pass to getcert to start-tracking the 8 certificates. Check
Execute the following commands to start tracking the certificates.
getcert start-tracking -d /etc/httpd/alias -n "Server-Cert" -c IPA -p /etc/httpd/alias/pwdfile.txt -C '/usr/libexec/ipa/certmonger/restart_httpd'
getcert start-tracking -d /etc/dirsrv/slapd-UNI-LU -n "Server-Cert" -c IPA -p /etc/dirsrv/slapd-UNI-LU/pwdfile.txt -C '/usr/libexec/ipa/certmonger/restart_dirsrv UNI-LU’
Figure out Pin for hidden Pin entry
grep internal /etc/pki/pki-tomcat/password.conf
Run the commands by pvodiing pin on CLI
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" -c dogtag-ipa-renew-agent -P <pin code> -B '/usr/libexec/ipa/certmonger/stop_pkicad' -C '/usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca”'
Realize a helper command was missing. Add it.
getcert add-ca -c dogtag-ipa-ca-renew-agent -e /usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit
Add the remaining certificates
getcert start-tracking -d /etc/httpd/alias -n "ipaCert" -c dogtag-ipa-ca-renew-agent -p /etc/httpd/alias/pwdfile.txt -B '/usr/libexec/ipa/certmonger/renew_ra_cert_pre' -C '/usr/libexec/ipa/certmonger/renew_ra_cert'
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "caSigningCert cert-pki-ca" -c dogtag-ipa-ca-renew-agent -P <pin code> -B '/usr/libexec/ipa/certmonger/stop_pkicad' -C '/usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"'
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "subsystemCert cert-pki-ca" -c dogtag-ipa-ca-renew-agent -P <pin code> -B '/usr/libexec/ipa/certmonger/stop_pkicad' -C '/usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"'
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "ocspSigningCert cert-pki-ca" -c dogtag-ipa-ca-renew-agent -P <pin code> -B '/usr/libexec/ipa/certmonger/stop_pkicad' -C '/usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"'
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "auditSigningCert cert-pki-ca" -c dogtag-ipa-ca-renew-agent -P <pin code> -B '/usr/libexec/ipa/certmonger/stop_pkicad' -C '/usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"'
Check that the certificates match the other CA.
getcert list
Check that all are Monitoring.
[root@toto2 ~]# getcert list | grep MONITORING | wc -l
8
Check that Serials match between the two CA servers.
certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "auditSigningCert cert-pki-ca" | grep Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "caSigningCert cert-pki-ca" | grep Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "subsystemCert cert-pki-ca" | grep Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "ocspSigningCert cert-pki-ca" | grep Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "auditSigningCert cert-pki-ca" | grep Serial
The other 3 are supposed to be different.
After that, we move the CRL back to the original server, and assume everything is Ok.
If anybody has any comments on this process, please do let the community know as I hope im not the only one with this problem.
Kind regards,
Christophe
--
Dr Christophe Trefois, Dipl.-Ing.
Technical Specialist / Post-Doc
UNIVERSITÉ DU LUXEMBOURG
LUXEMBOURG CENTRE FOR SYSTEMS BIOMEDICINE
Campus Belval | House of Biomedicine
6, avenue du Swing
L-4367 Belvaux
T: +352 46 66 44 6124
F: +352 46 66 44 6949
http://www.uni.lu/lcsb
----
This message is confidential and may contain privileged information.
It is intended for the named recipient only.
If you receive it in error please notify me and permanently delete the original message and any copies.
----
Hi,
I just saw that my CA CRL master is not tracking any certs.
However, my other CA master replica is tracking 8 certificates.
Is this normal and expected?
Thanks,
Christophe
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project