Wed Feb 14 07:08:38 PST 2024
[root@ef-idm01
~]# getcert
list | egrep '^Request|status:|subject:|expir'
Request ID '20230530175932':
expires: 2025-05-30 10:59:53 PDT
Request ID '20230530180022':
expires: 2025-05-30 11:00:30 PDT
Request ID '20230530180438':
expires: 2024-01-02 07:58:28 PST
[root@ef-idm01
~]# ipa-cert-fix
ipa-cert-fix is intended for recovery when expired certificates
prevent the normal operation of IPA. It should ONLY be used
in such scenarios, and backup of the system, especially certificates
and keys, is STRONGLY RECOMMENDED.
The following certificates will be renewed:
Expires: 2024-01-02 15:58:28
Enter "yes" to proceed: yes
Renewed IPA IPA RA certificate:
Expires: 2026-02-03 20:18:20
Note: Monitor the certmonger-initiated renewal of
certificates after ipa-cert-fix and wait for its completion before
any other administrative task.
The ipa-cert-fix command was successful
I checked the cert expiration several times yesterday, but it never updated on this server.
I waited a full day to let certmonger do its thing, below is my result this morning.
[root@ef-idm01 ~]# ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting ipa-custodia Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
ipa: INFO: The ipactl command was successful
[root@ef-idm01 ~]#
ipactl status
Directory Service: RUNNING
ipa-custodia Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
[root@ef-idm01 ~]#
getcert list | egrep '^Request|status:|subject:|expir'
Request ID '20230530175932':
expires: 2025-05-30 10:59:53 PDT
Request ID '20230530180022':
expires: 2025-05-30 11:00:30 PDT
Request ID '20230530180438':
expires: 2024-01-02 07:58:28 PST
[root@ef-idm01 ~]# ipa-cert-fix
The ipa-cert-fix command was successful
[root@ef-idm01 ~]#
getcert list | egrep '^Request|status:|subject:|expir'
Request ID '20230530175932':
expires: 2025-05-30 10:59:53 PDT
Request ID '20230530180022':
expires: 2025-05-30 11:00:30 PDT
Request ID '20230530180438':
expires: 2024-01-02 07:58:28 PST
How can I sort out this one remaining issue?
Do I just make assign another server as the renewal master?
thanx
- grant