Hi,
generally yes :)
We had a few tickets related to upgrade but they are mainly revealing
already present issues (for instance because this CLI stops and starts
the services, expired certs would prevent successful completion).
Do i need to provide any option with "ipa-server-upgrade"
command? i
believe few month back when i tried to do "ipa-server-upgrade" it
broke some stuff but anyway i will take snapshot of VM and try in
worst case scenario.
On Mon, Sep 23, 2019 at 2:25 AM Florence Blanc-Renaud <flo(a)redhat.com> wrote:
>
> On 9/21/19 7:41 PM, Satish Patel via FreeIPA-users wrote:
>> Any thought ?
> Hi,
> if you run ipa-server-upgrade on this node, the command will fix the
> tracking of certs. You should see in the output;
> [Update certmonger certificate renewal configuration]
>
> HTH,
> flo
>
>>
>> Sent from my iPhone
>>
>>> On Sep 20, 2019, at 11:35 AM, Satish Patel <satish.txt(a)gmail.com>
wrote:
>>>
>>> Rob sorry, i trim my output thought not necessary but anyway here is
>>> the full list (ignore CAPS letter in output)
>>>
>>> [root@ldap-ca-master ~]# getcert list
>>>
>>> Number of certificates and requests being tracked: 12.
>>>
>>> Request ID '20190915042927':
>>>
>>> status: NEED_CA
>>>
>>> stuck: yes
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>
>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
>>> cert-pki-ca',token='NSS Certificate DB'
>>>
>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> subject: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> expires: 2037-01-05 14:47:24 UTC
>>>
>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915043150':
>>>
>>> status: NEED_CA
>>>
>>> stuck: yes
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>
>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
>>> cert-pki-ca',token='NSS Certificate DB'
>>>
>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> subject:
CN=ldap-ca-master.foo.EXAMPLE.com,O=EXAMPLE.COM
>>>
>>> expires: 2020-11-17 18:30:29 UTC
>>>
>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915043212':
>>>
>>> status: NEED_CA
>>>
>>> stuck: yes
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>
>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
>>> cert-pki-ca',token='NSS Certificate DB'
>>>
>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> subject: CN=OCSP
Subsystem,O=EXAMPLE.COM
>>>
>>> expires: 2020-11-17 18:31:26 UTC
>>>
>>> eku: id-kp-OCSPSigning
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915043224':
>>>
>>> status: NEED_CA
>>>
>>> stuck: yes
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>
>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
>>> cert-pki-ca',token='NSS Certificate DB'
>>>
>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> subject: CN=CA
Audit,O=EXAMPLE.COM
>>>
>>> expires: 2020-11-17 18:32:07 UTC
>>>
>>> key usage: digitalSignature,nonRepudiation
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915043237':
>>>
>>> status: NEED_CA
>>>
>>> stuck: yes
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>
>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
>>> cert-pki-ca',token='NSS Certificate DB'
>>>
>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> subject: CN=CA
Subsystem,O=EXAMPLE.COM
>>>
>>> expires: 2020-11-17 18:31:16 UTC
>>>
>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915043246':
>>>
>>> status: NEED_KEY_PAIR
>>>
>>> stuck: no
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',pin
>>> set
>>>
>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',token='NSS
>>> Certificate DB'
>>>
>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>
>>> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>
>>> expires: 2037-12-31 23:59:59 UTC
>>>
>>> key usage: keyCertSign,cRLSign
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915043304':
>>>
>>> status: NEED_KEY_PAIR
>>>
>>> stuck: no
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
>>> Intermediate',pin set
>>>
>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
>>> Intermediate',token='NSS Certificate DB'
>>>
>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>
>>> subject: CN=Go Daddy Secure Certificate Authority -
>>>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>
>>> expires: 2031-05-03 07:00:00 UTC
>>>
>>> key usage: keyCertSign,cRLSign
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915045112':
>>>
>>> status: NEED_KEY_PAIR
>>>
>>> stuck: no
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM IPA
>>> CA',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>
>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM
>>> IPA CA',token='NSS Certificate DB'
>>>
>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> subject: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> expires: 2037-01-05 14:47:24 UTC
>>>
>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915045148':
>>>
>>> status: NEED_KEY_PAIR
>>>
>>> stuck: no
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>
>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',token='NSS
>>> Certificate DB'
>>>
>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>
>>> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>
>>> expires: 2037-12-31 23:59:59 UTC
>>>
>>> key usage: keyCertSign,cRLSign
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915045156':
>>>
>>> status: NEED_CA
>>>
>>> stuck: yes
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
>>> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>
>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
>>> Certificate DB'
>>>
>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> subject: CN=Object Signing
Cert,O=EXAMPLE.COM
>>>
>>> expires: 2021-01-05 14:49:59 UTC
>>>
>>> key usage: digitalSignature,keyCertSign
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915045206':
>>>
>>> status: NEED_KEY_PAIR
>>>
>>> stuck: no
>>>
>>> key pair storage:
>>> type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
>>> Intermediate',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>
>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
>>> Intermediate',token='NSS Certificate DB'
>>>
>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>
>>> subject: CN=Go Daddy Secure Certificate Authority -
>>>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
>>> Inc.",L=Scottsdale,ST=Arizona,C=US
>>>
>>> expires: 2031-05-03 07:00:00 UTC
>>>
>>> key usage: keyCertSign,cRLSign
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>> Request ID '20190915045216':
>>>
>>> status: NEED_CA
>>>
>>> stuck: yes
>>>
>>> key pair storage:
>>>
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
>>> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>
>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
>>> Certificate DB'
>>>
>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
>>>
>>> subject: CN=IPA
RA,O=EXAMPLE.COM
>>>
>>> expires: 2020-11-17 18:31:36 UTC
>>>
>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>
>>> pre-save command:
>>>
>>> post-save command:
>>>
>>> track: yes
>>>
>>> auto-renew: yes
>>>
>>>> On Fri, Sep 20, 2019 at 10:58 AM Rob Crittenden
<rcritten(a)redhat.com> wrote:
>>>>
>>>> Satish Patel via FreeIPA-users wrote:
>>>>> Few days ago my Master CA was messed up and getcert list was showing
>>>>> empty list (no cert to track)
>>>>>
>>>>> So i run following command to add certs manually:
>>>>>
>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
>>>>> 'ocspSigningCert cert-pki-ca' -P XXXXXXX
>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
>>>>> 'auditSigningCert cert-pki-ca' -P XXXXXXX
>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
'subsystemCert
>>>>> cert-pki-ca' -P XXXXXXX
>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
'Godaddy' -P XXXXXXX
>>>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'Godaddy
>>>>> Intermediate' -P XXXXXXX
>>>>>
>>>>> And after that i am seeing this status (status: NEED_CA ) it
should
>>>>> be MONITORING right?
>>>>>
>>>>> # getcert list
>>>>> Number of certificates and requests being tracked: 12.
>>>>
>>>> You setup the tracking wrong. Your output only shows 3 certs and yet
>>>> certmonger thinks it has 12. Where are the other 9?
>>>>
>>>> rob
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...