On 7/23/19 12:01 PM, Harald Dunkel via FreeIPA-users wrote:
Hi Rob,
On 7/22/19 5:34 PM, Rob Crittenden via FreeIPA-users wrote:
> It is expected. dogtag uses cert auth to bind to LDAP. That fails with
> the expired certs. This is why the IPA tree is used to distribute the
> updated certificates.
>
> rob
Good news:
Apparently the new certificate did make it into the local cert database.
On the renewal master:
[root@ipa1 ~]# certutil -L -d /etc/pki/pki-tomcat/alias/ -n
'subsystemCert cert-pki-ca' | grep "Not After"
Not After : Wed Jun 23 09:56:18 2021
On the non-renewal masters, e.g. ipa0:
[root@ipa0 ~]# certutil -L -d /etc/pki/pki-tomcat/alias/ -n
'subsystemCert cert-pki-ca' | grep "Not After"
Not After : Wed Jun 23 09:56:18 2021
Bad news:
pki-tomcatd still doesn't start on the non-renewal masters. journal
is attached. Is there yet another copy of the certificate (or its ca
chain) that might be out-of-date?
Hi,
The subsystemCert cert-pki-ca is also stored in LDAP, in 2 places:
- in the entry uid=pkidbuser,ou=people,o=ipaca (in the userCertificate
attribute, which can be multivalued and contain the old certs along with
the most recent one). The description field must store the serial
corresponding to the most recent one with the format
2;<serial>;<issuer>;<subject>, for instance description:
2;15;CN=Certificate Authority,O=DOMAIN.COM;CN=CA
Subsystem,O=DOMAIN.COM
- in the entry cn=subsystemCert
cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,<basedn>, in the userCertificate
attribute. There should be only one value, for the most recent cert.
The uid=pkidbuser entry is present only on the replicas with the CA
role, while the cn=subsystemCert cert-pki-ca entry is present on all the
replicas.
If the cert was properly replicated to the other masters, we can assume
that the replication went well for the cn=subsystemCert
cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,<basedn> entry. I would then
check the content of uid=pkidbuser,ou=people,o=ipaca on all the replicas
(this part of the LDAP tree is managed by a different replication
agreement, o=ipaca vs <basedn>).
HTH,
flo
I haven't dared to restart ipa1 yet.
Regards
Harri
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...