hi,
in the rhel 8 documentation I came across this:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
1.
In the command-line interface, run the *ipa-certupdate* command to
create a *certmonger* tracking request for the *webserver-ca* and
*webclient-ca* sub-CAs certificates:
[root@ipaserver ~]# ipa-certupdate
Important
Forgetting to run the *ipa-certupdate* command after creating a sub-CA
means that if the sub-CA certificate expires, end-entity certificates
issued by the sub-CA are considered invalid even if the end-entity
certificate has not expired.
Is this also valid for rhel 7? I do not see this in the documentation
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
and taking a peek at getcert list on the CA role servers I do not see any
certmonger tracking request for our sub cas.
--
Regards,
natxo