Christof Schulze via FreeIPA-users wrote:
Reading a lot I learned that certificates should be renewed
automatically 28 before expiring.
But some of Certificates are now on less than 10 days.
This is on the CA renewal master:
Request ID '20181008075404':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=EXAMPLE.COM,OU=Institute,C=DE,E=christof.schulze(a)fau.de,L=CITY
subject: CN=OCSP
Subsystem,O=EXAMPLE.COM,OU=Institute,C=DE,E=christof.schulze(a)fau.de,L=CITY
expires: 2019-11-30 11:12:26 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20181008075405':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=EXAMPLE.COM,OU=Institute,C=DE,E=christof.schulze(a)fau.de,L=CITY
subject: CN=CA
Subsystem,O=EXAMPLE.COM,OU=Institute,C=DE,E=christof.schulze(a)fau.de,L=CITY
expires: 2019-11-30 11:11:38 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20181008075407':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=EXAMPLE.COM,OU=Institute,C=DE,E=christof.schulze(a)fau.de,L=CITY
subject: CN=IPA
RA,O=EXAMPLE.COM,OU=Institute,C=DE,E=christof.schulze(a)fau.de,L=CITY
expires: 2019-11-30 11:10:54 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Is there a way to get them renewed manually?
I'd start by checking the journal for messages from certmonger. It
should have tried to renew them at least twice now. The other
certificates were able to renew successfullyu?
You can force certmonger to try renewal with:
# getcert resubmit -i <id>
Or you can just restart certmonger and it'll re-evaluate things.
rob