Hi folks,
On 7/15/19 2:41 PM, Harald Dunkel via FreeIPA-users wrote:
>
> Good news (sort of): ipa does *not* appear to be out of sync. Some
> new user accounts added recently can be found in ldap on all ipa
> servers. It just failed to distribute the new certificate.
>
> Every suggestion about how to add the lost certificate to ipa0 and
> the others is highly welcome.
>
I found a similar incident on this mailing list.
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
The recommendation was to resubmit the request id via getcert. This is
what I tried:
[root@ipa2 log]# getcert list -n "subsystemCert cert-pki-ca"
Number of certificates and requests being tracked: 9.
Request ID '20181031075940':
status: MONITORING
ca-error: Invalid cookie: u''
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=example AG,C=DE
subject: CN=CA Subsystem,O=example AG,C=DE
expires: 2019-08-01 08:06:59 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
[root@ipa2 log]# getcert resubmit -i 20181031075940
Resubmitting "20181031075940" to "dogtag-ipa-ca-renew-agent".
[root@ipa2 log]# getcert list -n "subsystemCert cert-pki-ca"
Number of certificates and requests being tracked: 9.
Request ID '20181031075940':
status: POST_SAVED_CERT
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=example AG,C=DE
subject: CN=CA Subsystem,O=example AG,C=DE
expires: 2021-06-23 09:56:18 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
AFAICT the new certificate is available on ipa2 now, but ldap was not
updated :-(.
Please note the "invalid cookie" and the new status
"POST_SAVED_CERT".
Is this as expected?
Please check the status again. POST_SAVED_CERT is the status where the
post command is being executed. It should be in MONITORING now.
rob