On 6/3/20 6:07 PM, Rob Crittenden via FreeIPA-users wrote:
> Natxo Asenjo via FreeIPA-users wrote:
>> hi,
>>
>> in the rhel 8 documentation I came across this:
>>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
>>
>>
>> 1.
>>
>> In the command-line interface, run the *ipa-certupdate* command to
>> create a *certmonger* tracking request for the *webserver-ca* and
>> *webclient-ca* sub-CAs certificates:
>>
>> [root@ipaserver ~]# |ipa-certupdate|
>>
>> Important
>>
>> Forgetting to run the *ipa-certupdate* command after creating a
>> sub-CA means that if the sub-CA certificate expires, end-entity
>> certificates issued by the sub-CA are considered invalid even if
>> the
>> end-entity certificate has not expired.
>>
>> Is this also valid for rhel 7? I do not see this in the documentation
>>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>>
>> and taking a peek at getcert list on the CA role servers I do not see
>> any certmonger tracking request for our sub cas.
>
> Looks like a doc bug to me. I don't see where ipa-certupdate creates
> certmonger requests.
>
I believe the doc is accurate, you can have a look at
https://pagure.io/freeipa/blob/master/f/ipaclient/install/ipa_certupdate....
The command ipa ca-add does not create the tracking request, but
ipa-certupdate does.
You're right, not sure how I missed that :-(
This is not done in RHEL-7. The code was introduced in IPA 4.7.0.
rob