Florence Blanc-Renaud wrote:
Hi,
On Wed, Oct 18, 2023 at 4:11 PM Frederic Ayrault
<fred(a)lix.polytechnique.fr <mailto:fred@lix.polytechnique.fr>> wrote:
Bonjour,
Le 18/10/2023 à 15:33, Florence Blanc-Renaud a écrit :
> Hi,
>
>
> CNRS2 and CNRS2-Standard are part of the CA chain that issued your
> HTTP and LDAP server certificates, they should not be removed.
> When you install a new embedded IPA CA, it doesn't replace the
> existing HTTP and LDAP server certificates with new ones issued by
> IPA CA. You will be able to remove CNRS2 and CNRS2-standard (IF
> you don't use any other cert issued by them) only when the HTTP
> and LDAP server certs are replaced with new ones issued by IPA CA
> (which is a manual operation).
I was thinking/hoping the new IPA CA will replace the old one :-(
How should I proceed ?
The process is documented in
https://access.redhat.com/documentation/fr-fr/red_hat_enterprise_linux/7/...
You need to follow the steps using the integrated CA (the new one that
you installed with ipa-ca-install).
Right, so ipa-ca-install did effectively replace the old CA, but you're
not done yet. As Flo points out, the HTTP and 389-ds (and who knows
about PKINIT) certs were issued by a 3rd party.
At this point in the thread I can't even remember which version of
RHEL/IPA you are running. I think it's RHEL 7 so here are some pointers
there.
You should be able to use certmonger to get new certs but it will
involve some more manual effort.
See what your nicknames are before starting to ensure there is no conflict.
# certutil -L -d /etc/httpd/alias
# certutil -L -d /etc/dirsrv/slapd-REALM
I'm using the IPA-standard Server-Cert in these examples
# getcert request -d /etc/httpd/alias -n Server-Cert -p
/etc/httpd/alias/pwdfile.txt -D <IPA FQDN> -K HTTP/<IPA FQDN> -C
/usr/libexec/ipa/certmonger/restart_httpd -v -w
Assuming I didn't mess up the command and the request status goes into
MONITORING you can try switching to the new cert. Edit
/etc/httpd/conf.d/nss.conf and replace the value of NSSNickname with
Server-Cert. I'd save a copy of that value just in case so you need to
go back.
Restart Apache.
If all went well you now have an IPA-issued certificate for it.
For 389. Remember that REALM here replaces dots with dashes, so
EXAMPLE.TEST becomes EXAMPLE-TEST
# getcert request -d /etc/dirsrv/slapd-INSTANCE -n Server-Cert -p
/etc/dirsrv/slapd-INSTANCE/pwdfile.txt -D <IPA FQDN> -K ldap/<IPA FQDN>
-C "/usr/libexec/ipa/certmonger/restart_dirsrv REALM" -v -w
Once it issues stop the dirsrv service (important, don't forget)
Edit /etc/dirsrv/slapd-REALM/dse.ldif
Replace the value in nsSSLPersonalitySSL with Server-Cert
Restart dirsrv
Hopefully profit.
The old certificates will still be in the NSS database(s) if you need to
revert.
rob
>
>
Thank you
Regards,
Frederic