On 23/03/2024 13:48, Sam Morris via FreeIPA-users wrote:
It looks like my CRL renewal master (RHEL 8) is not producing the
CRL
correctly.
This was because it had "ca.certStatusUpdateInterval=0" set in
/etc/pki/pki-tomcat/ca/CS.cfg - ouch.
I think I got into this state when I decommissioned a previous IPA
server that was the CRL generator. This is described at two different
places in the documentation, and one of them doesn't mention that
ca.certStatusUpdateInterval should be changed to be unset when enabling
CRL generation on a server. See
https://issues.redhat.com/browse/RHEL-30280?focusedId=24411869&page=c...
for the details.
--
Sam Morris <
https://robots.org.uk/>
CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9