On 6/3/20 6:07 PM, Rob Crittenden via FreeIPA-users wrote:
Natxo Asenjo via FreeIPA-users wrote:
> hi,
>
> in the rhel 8 documentation I came across this:
>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
>
> 1.
>
> In the command-line interface, run the *ipa-certupdate* command to
> create a *certmonger* tracking request for the *webserver-ca* and
> *webclient-ca* sub-CAs certificates:
>
> [root@ipaserver ~]# |ipa-certupdate|
>
> Important
>
> Forgetting to run the *ipa-certupdate* command after creating a
> sub-CA means that if the sub-CA certificate expires, end-entity
> certificates issued by the sub-CA are considered invalid even if the
> end-entity certificate has not expired.
>
> Is this also valid for rhel 7? I do not see this in the documentation
>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
> and taking a peek at getcert list on the CA role servers I do not see
> any certmonger tracking request for our sub cas.
Looks like a doc bug to me. I don't see where ipa-certupdate creates
certmonger requests.
I believe the doc is accurate, you can have a look at
https://pagure.io/freeipa/blob/master/f/ipaclient/install/ipa_certupdate....
The command ipa ca-add does not create the tracking request, but
ipa-certupdate does.
flo
I think that note is a bit misleading too since I'm pretty sure
that
validity periods are still tied to the issuing CA period regardless of
time requested for a given certificate.
I cc'd the expert on sub-cas in case I'm wrong on this.
rob
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...