On Thu, 2018-10-04 at 09:21 -0400, Rob Crittenden via FreeIPA-users wrote:
As part of a larger IPA "health" checker and driven largely by necessity I have the beginning of a certificate checking tool available at https://github.com/rcritten/checkcerts
It works for me in IPA 4.5.4, IPA 4.6.0 and IPA master (basically 4.7+ patches). YMMV.
There is not much of a user-friendly interface to it. There are only two options, debug and verbose, which increase the amount of debug output (and it is immense).
The UI is limited because I expect it to be rolled up into some larger tool at some point and don't want to have to throw away a ton of framework code.
It needs to be run on an IPA master and checks the things I thought of to check. I've only done limited testing on mostly brand new installs so I'd appreciate feedback. Don't freak out of it spits out errors as it could just be bugs on my part :-)
It is read-only so it shouldn't blow up anything.
So if you want to run it against your system and send me the any output I can try to figure out if it is my tool that is the issue or your system (it is supposed to help pro-actively diagnose issues after all).
To use just clone it from git (or download ipa-checkcerts.py from the repo)
Run it as root:
here is a tar file with the output with no options and with --verbose from my system. Please let me know when you need more information. The free-ipa was setup a number of years ago (on Centos 7.1?) and upgraded since with every new release. I already fixed some permission issues. The
Kind regards, Louis
P.s. /var/lib/ipa/ra-agent.pem contains the following: Certificate: Data: Version: 3 (0x2) Serial Number: 55 (0x37) Signature Algorithm: sha256WithRSAEncryption Issuer: O=HOME.FAZANT.NET, CN=Certificate Authority Validity Not Before: Apr 29 13:23:17 2018 GMT Not After : Apr 18 13:23:17 2020 GMT Subject: O=HOME.FAZANT.NET, CN=IPA RA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:ea:41:9f:cc:2f:15:bc:b0:dc:ea:46:88:46:5d: 51:60:ca:66:ad:62:37:92:c9:85:9a:7d:8d:4a:c0: 8a:ef:c0:93:8b:3c:af:c1:e4:2e:b6:6d:be:ba:86: 33:95:bf:37:79:fb:a4:52:2c:99:6f:34:16:95:ed: 4e:c4:3c:9a:c0:c7:43:aa:17:9d:64:de:6f:12:9e: a7:5d:8f:80:d5:68:23:08:3d:03:b0:08:0d:29:6b: cf:b2:01:e9:39:82:54:63:c1:19:6c:6b:d6:df:9b: b7:dd:1e:cf:42:82:01:47:a4:07:57:e5:f7:b0:e3: a0:99:6e:52:d3:81:a8:dd:e1:94:1a:3a:d6:29:7a: 02:e4:31:94:37:44:b0:18:73:6d:de:b9:a8:a5:b3: 44:18:b9:66:7c:c0:53:bb:c0:5d:83:0f:31:c3:23: fb:44:57:23:6c:7e:c2:7b:15:3e:a3:11:b3:56:4e: 3e:f4:4f:0e:7b:49:f4:8c:42:b3:91:1b:2c:ea:b6: c7:fd:e7:9c:37:78:e3:a3:c7:2c:bf:e8:79:3b:85: f2:33:a0:a1:de:22:5c:59:e7:2b:44:3e:c4:8d:8b: a3:b8:b5:29:b9:17:6c:80:76:cc:25:d3:07:bd:6f: a3:7f:b5:83:bd:c5:49:a9:38:fd:9a:d1:04:20:b7: 63:6b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:5C:36:EB:08:E2:0C:1F:19:0A:B3:0F:80:21:DA:EF:22:F 7:A9:3C:3D
Authority Information Access: OCSP - URI:http://ipa-ca.home.fazant.net/ca/ocsp
X509v3 Key Usage: critical Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication Signature Algorithm: sha256WithRSAEncryption 5d:f1:ec:81:c7:a9:10:b2:d2:7b:22:51:bd:85:87:67:6b:8c: f9:14:2b:6b:38:47:0a:72:d6:8b:48:ab:18:42:c7:d3:bb:36: 27:e1:ab:7c:80:08:d0:40:ea:cf:96:23:87:bb:94:df:26:54: d0:8a:3e:fe:75:a3:c7:de:42:2e:ba:f4:b5:7e:74:7a:91:98: d6:2a:40:e0:0d:92:56:d6:04:f7:ee:78:19:70:df:81:32:fa: 9d:c7:e4:9d:48:3f:e7:c2:6f:4e:28:e7:c6:1c:ae:f9:58:17: 6e:f1:f1:14:7a:43:51:8c:45:f1:51:b9:90:92:3c:7e:12:9c: f4:e4:cb:14:e2:7e:c2:78:ea:68:97:20:96:dd:ea:d4:fb:59: 03:87:ef:70:9d:d6:40:d3:a1:a3:d8:21:0a:8c:d9:61:47:28: 88:d3:45:0b:3e:ad:cf:39:ac:0b:30:5b:41:5a:0e:cc:8f:69: ab:7d:74:ce:9b:15:82:4e:94:09:fe:6f:12:d9:2f:6e:c8:e0: 86:09:58:bf:ad:16:22:97:aa:4b:12:58:7f:b0:30:1f:ce:57: e7:ca:c5:ef:82:54:79:75:ba:cf:99:ba:e1:e4:a2:d8:b5:e3: 42:06:26:51:1a:95:68:60:ba:1c:eb:80:1f:f6:a2:45:b5:5a: 69:d7:34:03