On Thu, 2018-10-04 at 09:21 -0400, Rob Crittenden via FreeIPA-users
wrote:
As part of a larger IPA "health" checker and driven largely
by
necessity
I have the beginning of a certificate checking tool available at
https://github.com/rcritten/checkcerts
It works for me in IPA 4.5.4, IPA 4.6.0 and IPA master (basically
4.7+
patches). YMMV.
There is not much of a user-friendly interface to it. There are only
two
options, debug and verbose, which increase the amount of debug output
(and it is immense).
The UI is limited because I expect it to be rolled up into some
larger
tool at some point and don't want to have to throw away a ton of
framework code.
It needs to be run on an IPA master and checks the things I thought
of
to check. I've only done limited testing on mostly brand new installs
so
I'd appreciate feedback. Don't freak out of it spits out errors as it
could just be bugs on my part :-)
It is read-only so it shouldn't blow up anything.
So if you want to run it against your system and send me the any
output
I can try to figure out if it is my tool that is the issue or your
system (it is supposed to help pro-actively diagnose issues after
all).
To use just clone it from git (or download ipa-checkcerts.py from the
repo)
Run it as root:
here is a tar file with the output with no options and with
--verbose
from my system. Please let me know when you need more information.
The free-ipa was setup a number of years ago (on Centos 7.1?) and
upgraded since with every new release.
I already fixed some permission issues. The
Kind regards, Louis
P.s. /var/lib/ipa/ra-agent.pem contains the following:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 55 (0x37)
Signature Algorithm: sha256WithRSAEncryption
Issuer:
O=HOME.FAZANT.NET, CN=Certificate Authority
Validity
Not Before: Apr 29 13:23:17 2018 GMT
Not After : Apr 18 13:23:17 2020 GMT
Subject:
O=HOME.FAZANT.NET, CN=IPA RA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ea:41:9f:cc:2f:15:bc:b0:dc:ea:46:88:46:5d:
51:60:ca:66:ad:62:37:92:c9:85:9a:7d:8d:4a:c0:
8a:ef:c0:93:8b:3c:af:c1:e4:2e:b6:6d:be:ba:86:
33:95:bf:37:79:fb:a4:52:2c:99:6f:34:16:95:ed:
4e:c4:3c:9a:c0:c7:43:aa:17:9d:64:de:6f:12:9e:
a7:5d:8f:80:d5:68:23:08:3d:03:b0:08:0d:29:6b:
cf:b2:01:e9:39:82:54:63:c1:19:6c:6b:d6:df:9b:
b7:dd:1e:cf:42:82:01:47:a4:07:57:e5:f7:b0:e3:
a0:99:6e:52:d3:81:a8:dd:e1:94:1a:3a:d6:29:7a:
02:e4:31:94:37:44:b0:18:73:6d:de:b9:a8:a5:b3:
44:18:b9:66:7c:c0:53:bb:c0:5d:83:0f:31:c3:23:
fb:44:57:23:6c:7e:c2:7b:15:3e:a3:11:b3:56:4e:
3e:f4:4f:0e:7b:49:f4:8c:42:b3:91:1b:2c:ea:b6:
c7:fd:e7:9c:37:78:e3:a3:c7:2c:bf:e8:79:3b:85:
f2:33:a0:a1:de:22:5c:59:e7:2b:44:3e:c4:8d:8b:
a3:b8:b5:29:b9:17:6c:80:76:cc:25:d3:07:bd:6f:
a3:7f:b5:83:bd:c5:49:a9:38:fd:9a:d1:04:20:b7:
63:6b
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:5C:36:EB:08:E2:0C:1F:19:0A:B3:0F:80:21:DA:EF:22:F
7:A9:3C:3D
Authority Information Access:
OCSP -
URI:http://ipa-ca.home.fazant.net/ca/ocsp
X509v3 Key Usage: critical
Digital Signature, Non Repudiation, Key Encipherment,
Data Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client
Authentication
Signature Algorithm: sha256WithRSAEncryption
5d:f1:ec:81:c7:a9:10:b2:d2:7b:22:51:bd:85:87:67:6b:8c:
f9:14:2b:6b:38:47:0a:72:d6:8b:48:ab:18:42:c7:d3:bb:36:
27:e1:ab:7c:80:08:d0:40:ea:cf:96:23:87:bb:94:df:26:54:
d0:8a:3e:fe:75:a3:c7:de:42:2e:ba:f4:b5:7e:74:7a:91:98:
d6:2a:40:e0:0d:92:56:d6:04:f7:ee:78:19:70:df:81:32:fa:
9d:c7:e4:9d:48:3f:e7:c2:6f:4e:28:e7:c6:1c:ae:f9:58:17:
6e:f1:f1:14:7a:43:51:8c:45:f1:51:b9:90:92:3c:7e:12:9c:
f4:e4:cb:14:e2:7e:c2:78:ea:68:97:20:96:dd:ea:d4:fb:59:
03:87:ef:70:9d:d6:40:d3:a1:a3:d8:21:0a:8c:d9:61:47:28:
88:d3:45:0b:3e:ad:cf:39:ac:0b:30:5b:41:5a:0e:cc:8f:69:
ab:7d:74:ce:9b:15:82:4e:94:09:fe:6f:12:d9:2f:6e:c8:e0:
86:09:58:bf:ad:16:22:97:aa:4b:12:58:7f:b0:30:1f:ce:57:
e7:ca:c5:ef:82:54:79:75:ba:cf:99:ba:e1:e4:a2:d8:b5:e3:
42:06:26:51:1a:95:68:60:ba:1c:eb:80:1f:f6:a2:45:b5:5a:
69:d7:34:03