Dungan, Scott A. via FreeIPA-users wrote:
When running a ipa-healthcheck we are seeing one ERROR condition
under
the ipahealthcheck.ipa.certs section:
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPACertTracking",
"result": "ERROR",
"uuid": "df8e46a4-427b-4b40-8db8-e09633d6d903",
"when": "20210405174840Z",
"duration": "1.014180",
"kw": {
"key": "cert-database=/etc/pki/pki-tomcat/alias,
cert-nickname=caSigningCert cert-pki-ca,
ca-name=dogtag-ipa-ca-renew-agent,
cert-presave-command=/usr/libexec/ipa/certmonger/stop_pkicad,
cert-postsave-command=/usr/libexec/ipa/certmonger/renew_ca_cert
\"caSigningCert cert-pki-ca\", template-profile=caCACert",
"msg": "Missing tracking for
cert-database=/etc/pki/pki-tomcat/alias, cert-nickname=caSigningCert
cert-pki-ca, ca-name=dogtag-ipa-ca-renew-agent,
cert-presave-command=/usr/libexec/ipa/certmonger/stop_pkicad,
cert-postsave-command=/usr/libexec/ipa/certmonger/renew_ca_cert
\"caSigningCert cert-pki-ca\", template-profile=caCACert"
}
},
I am not sure what to do about this or where to look for more
information. Any help pointing me in the right direction would be much
appreciated.
This means that you have a CA configured on the server but the IPA CA
signing cert isn't tracked by certmonger. Running ipa-server-upgrade
should fix it.
rob