Günther J. Niederwimmer via FreeIPA-users wrote:
Hello,
Am Freitag, 30. März 2018, 15:45:49 CEST schrieb Florence Blanc-Renaud:
> On 03/30/2018 03:22 PM, Günther J. Niederwimmer via FreeIPA-users wrote:
>> Am Freitag, 30. März 2018, 14:27:13 CEST schrieb Florence Blanc-Renaud via
>>
>> FreeIPA-users:
>>> On 03/30/2018 01:19 PM, Günther J. Niederwimmer via FreeIPA-users wrote:
>>>>
>>>> can any help me to find out the correct way to renew the certificates
>>>> After a Problem I found out my certificates are not renewed on my two
>>>> ipa
>>>> servers ?
>>>>
>>>> My ipa servers Version is 4.5.0-22-22
>>>> Centos 7.4
>>>>
>>>> All i found on the list or goo.... is not working for me :-(.
>>>>
>>>> have any a a link to the correct way to renew the certificates.
>>>>
>>>> Thanks for a answer,
>>>
>>> Hi,
>>>
>>> first of all, which certificates are expired? Are there multiple masters
>>> in your topology where the CA component is installed?
>>> If the CA is installed on multiple nodes, find the CA renewal master:
>>> # ipa config-show | grep 'CA renewal master'
>
> Hi,
>
>> on each server I have the output this is the master ??
>>
>> ipa config-show | grep 'CA renewal master'
>>
>> IPA CA renewal master: ipa.xxxxxxx.at
>>
>> ipa config-show | grep 'CA renewal master'
>>
>> IPA CA renewal master: ipa1.xxxxxxx.at
>
> Is it a copy/paste error or do you see a different output (ipa or ipa1)
> depending on the host where the command is run?
>
> If the output is inconsistent, this issue needs to be fixed first. You
> can refer to
>
https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master
> and make sure that only one host is CA renewal master.
Now I set "ipa1" to Renewal Master, on this Server now I have new Certificates
and pki-tomcatd and ipa-otpd Service are running ;-), but the old master "ipa"
have the old certificates ??
What is the way to have also on the old Master "ipa" the new certificates ?
Can Freeipa do this alone, or have I to resync the LADP server with a command
??
Assuming replication is working the "old" master should have the updated
certs in LDAP.
You try restarting certmonger to pick up those certs. It should pull
them out of LDAP.
rob
>>> If the certs did not renew properly, the CA renewal master needs to be
>>> fixed first. Once all the certs on this machine are updated, you can
>>> start fixing the other ones.
is now fixed ;-)
>>> Check which certificates are expired:
>>> # getcert list | grep -E "Request ID|status|certificate|expires"
>>>
>>> Once the expired certificates are identified, please provide any
>>> specific error messages obtained in the output of 'getcert list -i
>>> <request ID>', this may help diagnose the issue.
>>
Thanks for the a answer,