Louis Lagendijk via FreeIPA-users wrote:
On Thu, 2018-10-04 at 09:21 -0400, Rob Crittenden via FreeIPA-users
wrote:
> As part of a larger IPA "health" checker and driven largely by
> necessity
> I have the beginning of a certificate checking tool available at
>
https://github.com/rcritten/checkcerts
>
> It works for me in IPA 4.5.4, IPA 4.6.0 and IPA master (basically
> 4.7+
> patches). YMMV.
>
> There is not much of a user-friendly interface to it. There are only
> two
> options, debug and verbose, which increase the amount of debug output
> (and it is immense).
>
> The UI is limited because I expect it to be rolled up into some
> larger
> tool at some point and don't want to have to throw away a ton of
> framework code.
>
> It needs to be run on an IPA master and checks the things I thought
> of
> to check. I've only done limited testing on mostly brand new installs
> so
> I'd appreciate feedback. Don't freak out of it spits out errors as it
> could just be bugs on my part :-)
>
> It is read-only so it shouldn't blow up anything.
>
> So if you want to run it against your system and send me the any
> output
> I can try to figure out if it is my tool that is the issue or your
> system (it is supposed to help pro-actively diagnose issues after
> all).
>
> To use just clone it from git (or download ipa-checkcerts.py from the
> repo)
>
> Run it as root:
here is a tar file with the output with no options and with --verbose
from my system. Please let me know when you need more information.
The free-ipa was setup a number of years ago (on Centos 7.1?) and
upgraded since with every new release.
I already fixed some permission issues. The
Kind regards, Louis
Thanks! I'll take a look at this and get back to you next week, perhaps
privately, we'll see (mostly based on whether I think it is of general
interest to work through the issues).
rob