Hi Rob,
On 7/23/19 5:16 PM, Rob Crittenden wrote:
I keep saying to ignore this. It doesn't work because the CA isn't
running because the certs aren't updated.
When certmonger pulls the cert out of the IPA tree it will update the
NSS database and whatever other configuration needs to be updated,
including the CA LDAP database.
You need to go back in time (ensure that ntpd/chrondy is not running),
start IPA so it is fully running and then force certmonger to retrieve
the updated certs.
Freeipa is in production 24/7. The masters are containers without a
local clock. And since java is involved, the faketime library is no
solution, either.
What exactly do you mean by "go back in time"? Beyond the "not
before"
date of the new certificate? Turning back the clock doesn't make the
bad certificate go away. Do I have to do this on all masters, the ca
masters or only on the renewal master?
The "force certmonger to retrieve the updated certs" is not clear to
me, either.
I would *highly* appreciate another solution for this. AFAICT the
previous certificate expires in a few days on Aug 1 08:06:59 2019 GMT.
Do I have to expect the same problem in 2 years again, when the new
certificate expires? How can I tell freeipa to generate certificates that
last for 10 years?
Regards
Harri