As part of a larger IPA "health" checker and driven largely by necessity
I have the beginning of a certificate checking tool available at
https://github.com/rcritten/checkcerts
It works for me in IPA 4.5.4, IPA 4.6.0 and IPA master (basically 4.7+
patches). YMMV.
There is not much of a user-friendly interface to it. There are only two
options, debug and verbose, which increase the amount of debug output
(and it is immense).
The UI is limited because I expect it to be rolled up into some larger
tool at some point and don't want to have to throw away a ton of
framework code.
It needs to be run on an IPA master and checks the things I thought of
to check. I've only done limited testing on mostly brand new installs so
I'd appreciate feedback. Don't freak out of it spits out errors as it
could just be bugs on my part :-)
It is read-only so it shouldn't blow up anything.
So if you want to run it against your system and send me the any output
I can try to figure out if it is my tool that is the issue or your
system (it is supposed to help pro-actively diagnose issues after all).
To use just clone it from git (or download ipa-checkcerts.py from the repo)
Run it as root:
# kinit admin
# python ipa-checkcerts.py
IPA version 4.5.4-10.el7_5.3
Check CA status
Check tracking
Check NSS trust
Check dates
Checking certificates in CS.cfg
Comparing certificates to requests in LDAP
Checking RA certificate
Checking authorities
Checking host keytab
Validating certificates
Checking renewal master
End-to-end cert API test
Checking permissions and ownership
All checks passed
thanks
rob