It doesn't have --debug option (in ipa-server-4.4.0)
[root@ldap-ca-master ~]# ipa-server-upgrade --debug
Usage: ipa-server-upgrade [options]
ipa-server-upgrade: error: no such option: --debug
On Wed, Sep 25, 2019 at 8:49 PM Satish Patel <satish.txt(a)gmail.com> wrote:
>
> I am running "ipa-server-4.4.0-14.el7.centos.4.x86_64"
>
> On Wed, Sep 25, 2019 at 5:13 PM Rob Crittenden <rcritten(a)redhat.com> wrote:
> >
> > Satish Patel via FreeIPA-users wrote:
> > > I did run "ipa-server-upgrade" and look like it was successful
but
> > > still in getcert list showing CA_NEED :(
> >
> > Remind me what the package version of IPA is. I'm confused by the
> > version 5 in the output about renewal configuration.
> >
> > You might also want to try running with --debug as depending on release
> > it will give more information about this.
> >
> > rob
> >
> > >
> > >
> > > [root@ldap-ca-master ~]# ipa-server-upgrade
> > > Upgrading IPA:
> > > [1/10]: stopping directory server
> > > [2/10]: saving configuration
> > > [3/10]: disabling listeners
> > > [4/10]: enabling DS global lock
> > > [5/10]: starting directory server
> > > [6/10]: updating schema
> > > [7/10]: upgrading server
> > > [8/10]: stopping directory server
> > > [9/10]: restoring configuration
> > > [10/10]: starting directory server
> > > Done.
> > > Update complete
> > > Upgrading IPA services
> > > Upgrading the configuration of the IPA services
> > > [Verifying that root certificate is published]
> > > [Migrate CRL publish directory]
> > > CRL tree already moved
> > > /etc/dirsrv/slapd-EXAMPLE-COM/certmap.conf is now managed by IPA. It
> > > will be overwritten. A backup of the original will be made.
> > > [Verifying that CA proxy configuration is correct]
> > > [Verifying that KDC configuration is using ipa-kdb backend]
> > > [Fix DS schema file syntax]
> > > Syntax already fixed
> > > [Removing RA cert from DS NSS database]
> > > RA cert already removed
> > > [Enable sidgen and extdom plugins by default]
> > > [Updating HTTPD service IPA configuration]
> > > [Updating mod_nss protocol versions]
> > > Protocol versions already updated
> > > [Updating mod_nss cipher suite]
> > > [Fixing trust flags in /etc/httpd/alias]
> > > Trust flags already processed
> > > [Exporting KRA agent PEM file]
> > > KRA is not enabled
> > > [Removing self-signed CA]
> > > [Removing Dogtag 9 CA]
> > > [Checking for deprecated KDC configuration files]
> > > [Checking for deprecated backups of Samba configuration files]
> > > [Setting up Firefox extension]
> > > [Add missing CA DNS records]
> > > IPA CA DNS records already processed
> > > [Removing deprecated DNS configuration options]
> > > DNS is not configured
> > > [Ensuring minimal number of connections]
> > > DNS is not configured
> > > [Enabling serial autoincrement in DNS]
> > > DNS is not configured
> > > [Updating GSSAPI configuration in DNS]
> > > DNS is not configured
> > > [Updating pid-file configuration in DNS]
> > > DNS is not configured
> > > DNS is not configured
> > > DNS is not configured
> > > DNS is not configured
> > > DNS is not configured
> > > DNS is not configured
> > > DNS is not configured
> > > DNS is not configured
> > > [Upgrading CA schema]
> > > CA schema update complete (no changes)
> > > [Verifying that CA audit signing cert has 2 year validity]
> > > [Update certmonger certificate renewal configuration to version 5]
> > > [Enable PKIX certificate path discovery and validation]
> > > PKIX already enabled
> > > [Authorizing RA Agent to modify profiles]
> > > [Authorizing RA Agent to manage lightweight CAs]
> > > [Ensuring Lightweight CAs container exists in Dogtag database]
> > > [Adding default OCSP URI configuration]
> > > [Ensuring CA is using LDAPProfileSubsystem]
> > > [Migrating certificate profiles to LDAP]
> > > [Ensuring presence of included profiles]
> > > [Add default CA ACL]
> > > Default CA ACL already added
> > > [Set up lightweight CA key retrieval]
> > > Creating principal
> > > Retrieving keytab
> > > Creating Custodia keys
> > > Configuring key retriever
> > > The IPA services were upgraded
> > > The ipa-server-upgrade command was successful
> > >
> > >
> > > [root@ldap-ca-master ~]# getcert list | grep status
> > > status: NEED_CA
> > > status: NEED_CA
> > > status: NEED_CA
> > > status: NEED_CA
> > > status: NEED_CA
> > > status: NEED_KEY_PAIR
> > > status: NEED_KEY_PAIR
> > > status: NEED_KEY_PAIR
> > > status: NEED_KEY_PAIR
> > > status: NEED_CA
> > > status: NEED_KEY_PAIR
> > > status: NEED_CA
> > >
> > > On Tue, Sep 24, 2019 at 3:55 AM Florence Blanc-Renaud
<flo(a)redhat.com> wrote:
> > >>
> > >> On 9/23/19 4:10 PM, Satish Patel via FreeIPA-users wrote:
> > >>> Thanks Florence,
> > >>>
> > >>> is it safe to run "ipa-server-upgrade" ?
> > >>>
> > >> Hi,
> > >> generally yes :)
> > >>
> > >> We had a few tickets related to upgrade but they are mainly revealing
> > >> already present issues (for instance because this CLI stops and starts
> > >> the services, expired certs would prevent successful completion).
> > >>
> > >>> Do i need to provide any option with "ipa-server-upgrade"
command? i
> > >>> believe few month back when i tried to do
"ipa-server-upgrade" it
> > >>> broke some stuff but anyway i will take snapshot of VM and try in
> > >>> worst case scenario.
> > >> With the VM snapshot you are on the safe side.
> > >>
> > >> flo
> > >>
> > >>>
> > >>> On Mon, Sep 23, 2019 at 2:25 AM Florence Blanc-Renaud
<flo(a)redhat.com> wrote:
> > >>>>
> > >>>> On 9/21/19 7:41 PM, Satish Patel via FreeIPA-users wrote:
> > >>>>> Any thought ?
> > >>>> Hi,
> > >>>> if you run ipa-server-upgrade on this node, the command will
fix the
> > >>>> tracking of certs. You should see in the output;
> > >>>> [Update certmonger certificate renewal configuration]
> > >>>>
> > >>>> HTH,
> > >>>> flo
> > >>>>
> > >>>>>
> > >>>>> Sent from my iPhone
> > >>>>>
> > >>>>>> On Sep 20, 2019, at 11:35 AM, Satish Patel
<satish.txt(a)gmail.com> wrote:
> > >>>>>>
> > >>>>>> Rob sorry, i trim my output thought not necessary but
anyway here is
> > >>>>>> the full list (ignore CAPS letter in output)
> > >>>>>>
> > >>>>>> [root@ldap-ca-master ~]# getcert list
> > >>>>>>
> > >>>>>> Number of certificates and requests being tracked: 12.
> > >>>>>>
> > >>>>>> Request ID '20190915042927':
> > >>>>>>
> > >>>>>> status: NEED_CA
> > >>>>>>
> > >>>>>> stuck: yes
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB',pin
set
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> subject: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> expires: 2037-01-05 14:47:24 UTC
> > >>>>>>
> > >>>>>> key usage:
digitalSignature,nonRepudiation,keyCertSign,cRLSign
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915043150':
> > >>>>>>
> > >>>>>> status: NEED_CA
> > >>>>>>
> > >>>>>> stuck: yes
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB',pin
set
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> subject:
CN=ldap-ca-master.foo.EXAMPLE.com,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> expires: 2020-11-17 18:30:29 UTC
> > >>>>>>
> > >>>>>> key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > >>>>>>
> > >>>>>> eku: id-kp-serverAuth,id-kp-clientAuth
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915043212':
> > >>>>>>
> > >>>>>> status: NEED_CA
> > >>>>>>
> > >>>>>> stuck: yes
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB',pin
set
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> subject: CN=OCSP
Subsystem,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> expires: 2020-11-17 18:31:26 UTC
> > >>>>>>
> > >>>>>> eku: id-kp-OCSPSigning
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915043224':
> > >>>>>>
> > >>>>>> status: NEED_CA
> > >>>>>>
> > >>>>>> stuck: yes
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB',pin
set
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> subject: CN=CA
Audit,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> expires: 2020-11-17 18:32:07 UTC
> > >>>>>>
> > >>>>>> key usage: digitalSignature,nonRepudiation
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915043237':
> > >>>>>>
> > >>>>>> status: NEED_CA
> > >>>>>>
> > >>>>>> stuck: yes
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB',pin
set
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> > >>>>>> cert-pki-ca',token='NSS Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> subject: CN=CA
Subsystem,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> expires: 2020-11-17 18:31:16 UTC
> > >>>>>>
> > >>>>>> key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > >>>>>>
> > >>>>>> eku: id-kp-serverAuth,id-kp-clientAuth
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915043246':
> > >>>>>>
> > >>>>>> status: NEED_KEY_PAIR
> > >>>>>>
> > >>>>>> stuck: no
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',pin
> > >>>>>> set
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',token='NSS
> > >>>>>> Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> > >>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> > >>>>>>
> > >>>>>> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> > >>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> > >>>>>>
> > >>>>>> expires: 2037-12-31 23:59:59 UTC
> > >>>>>>
> > >>>>>> key usage: keyCertSign,cRLSign
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915043304':
> > >>>>>>
> > >>>>>> status: NEED_KEY_PAIR
> > >>>>>>
> > >>>>>> stuck: no
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
> > >>>>>> Intermediate',pin set
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
> > >>>>>> Intermediate',token='NSS Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> > >>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> > >>>>>>
> > >>>>>> subject: CN=Go Daddy Secure Certificate Authority -
> > >>>>>>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
> > >>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> > >>>>>>
> > >>>>>> expires: 2031-05-03 07:00:00 UTC
> > >>>>>>
> > >>>>>> key usage: keyCertSign,cRLSign
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915045112':
> > >>>>>>
> > >>>>>> status: NEED_KEY_PAIR
> > >>>>>>
> > >>>>>> stuck: no
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM IPA
> > >>>>>> CA',pinfile='/etc/httpd/alias/pwdfile.txt'
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM
> > >>>>>> IPA CA',token='NSS Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> subject: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> expires: 2037-01-05 14:47:24 UTC
> > >>>>>>
> > >>>>>> key usage:
digitalSignature,nonRepudiation,keyCertSign,cRLSign
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915045148':
> > >>>>>>
> > >>>>>> status: NEED_KEY_PAIR
> > >>>>>>
> > >>>>>> stuck: no
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',pinfile='/etc/httpd/alias/pwdfile.txt'
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',token='NSS
> > >>>>>> Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> > >>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> > >>>>>>
> > >>>>>> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> > >>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> > >>>>>>
> > >>>>>> expires: 2037-12-31 23:59:59 UTC
> > >>>>>>
> > >>>>>> key usage: keyCertSign,cRLSign
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915045156':
> > >>>>>>
> > >>>>>> status: NEED_CA
> > >>>>>>
> > >>>>>> stuck: yes
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
> > >>>>>> Certificate
DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
> > >>>>>> Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> subject: CN=Object Signing
Cert,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> expires: 2021-01-05 14:49:59 UTC
> > >>>>>>
> > >>>>>> key usage: digitalSignature,keyCertSign
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915045206':
> > >>>>>>
> > >>>>>> status: NEED_KEY_PAIR
> > >>>>>>
> > >>>>>> stuck: no
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
> > >>>>>>
Intermediate',pinfile='/etc/httpd/alias/pwdfile.txt'
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
> > >>>>>> Intermediate',token='NSS Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> > >>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> > >>>>>>
> > >>>>>> subject: CN=Go Daddy Secure Certificate Authority -
> > >>>>>>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
> > >>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> > >>>>>>
> > >>>>>> expires: 2031-05-03 07:00:00 UTC
> > >>>>>>
> > >>>>>> key usage: keyCertSign,cRLSign
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>> Request ID '20190915045216':
> > >>>>>>
> > >>>>>> status: NEED_CA
> > >>>>>>
> > >>>>>> stuck: yes
> > >>>>>>
> > >>>>>> key pair storage:
> > >>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
> > >>>>>> Certificate
DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> > >>>>>>
> > >>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
> > >>>>>> Certificate DB'
> > >>>>>>
> > >>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> subject: CN=IPA
RA,O=EXAMPLE.COM
> > >>>>>>
> > >>>>>> expires: 2020-11-17 18:31:36 UTC
> > >>>>>>
> > >>>>>> key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > >>>>>>
> > >>>>>> eku: id-kp-serverAuth,id-kp-clientAuth
> > >>>>>>
> > >>>>>> pre-save command:
> > >>>>>>
> > >>>>>> post-save command:
> > >>>>>>
> > >>>>>> track: yes
> > >>>>>>
> > >>>>>> auto-renew: yes
> > >>>>>>
> > >>>>>>> On Fri, Sep 20, 2019 at 10:58 AM Rob Crittenden
<rcritten(a)redhat.com> wrote:
> > >>>>>>>
> > >>>>>>> Satish Patel via FreeIPA-users wrote:
> > >>>>>>>> Few days ago my Master CA was messed up and
getcert list was showing
> > >>>>>>>> empty list (no cert to track)
> > >>>>>>>>
> > >>>>>>>> So i run following command to add certs
manually:
> > >>>>>>>>
> > >>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n
> > >>>>>>>> 'ocspSigningCert cert-pki-ca' -P
XXXXXXX
> > >>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n
> > >>>>>>>> 'auditSigningCert cert-pki-ca' -P
XXXXXXX
> > >>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n 'subsystemCert
> > >>>>>>>> cert-pki-ca' -P XXXXXXX
> > >>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n 'Godaddy' -P XXXXXXX
> > >>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n 'Godaddy
> > >>>>>>>> Intermediate' -P XXXXXXX
> > >>>>>>>>
> > >>>>>>>> And after that i am seeing this status
(status: NEED_CA ) it should
> > >>>>>>>> be MONITORING right?
> > >>>>>>>>
> > >>>>>>>> # getcert list
> > >>>>>>>> Number of certificates and requests being
tracked: 12.
> > >>>>>>>
> > >>>>>>> You setup the tracking wrong. Your output only
shows 3 certs and yet
> > >>>>>>> certmonger thinks it has 12. Where are the other
9?
> > >>>>>>>
> > >>>>>>> rob
> > >>>>> _______________________________________________
> > >>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
> > >>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> > >>>>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > >>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > >>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > >>>>>
> > >>>>
> > >>> _______________________________________________
> > >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > >>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> > >>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > >>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > >>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > >>>
> > >>
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > >
> >