Hi folks,
On 7/15/19 2:41 PM, Harald Dunkel via FreeIPA-users wrote:
Good news (sort of): ipa does *not* appear to be out of sync. Some
new user accounts added recently can be found in ldap on all ipa
servers. It just failed to distribute the new certificate.
Every suggestion about how to add the lost certificate to ipa0 and
the others is highly welcome.
I found a similar incident on this mailing list.
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
The recommendation was to resubmit the request id via getcert. This is what I tried:
[root@ipa2 log]# getcert list -n "subsystemCert cert-pki-ca"
Number of certificates and requests being tracked: 9.
Request ID '20181031075940':
status: MONITORING
ca-error: Invalid cookie: u''
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=example AG,C=DE
subject: CN=CA Subsystem,O=example AG,C=DE
expires: 2019-08-01 08:06:59 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert
cert-pki-ca"
track: yes
auto-renew: yes
[root@ipa2 log]# getcert resubmit -i 20181031075940
Resubmitting "20181031075940" to "dogtag-ipa-ca-renew-agent".
[root@ipa2 log]# getcert list -n "subsystemCert cert-pki-ca"
Number of certificates and requests being tracked: 9.
Request ID '20181031075940':
status: POST_SAVED_CERT
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=example AG,C=DE
subject: CN=CA Subsystem,O=example AG,C=DE
expires: 2021-06-23 09:56:18 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert
cert-pki-ca"
track: yes
auto-renew: yes
AFAICT the new certificate is available on ipa2 now, but ldap was not
updated :-(.
Please note the "invalid cookie" and the new status
"POST_SAVED_CERT".
Is this as expected?
Every helpful comment is highly appreciated.
Harri