On Wed, Jun 3, 2020 at 6:49 PM Rob Crittenden via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
Florence Blanc-Renaud via FreeIPA-users wrote:
> On 6/3/20 6:07 PM, Rob Crittenden via FreeIPA-users wrote:
>> Natxo Asenjo via FreeIPA-users wrote:
>>> hi,
>>>
>>> in the rhel 8 documentation I came across this:
>>>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
>>>
>>>
>>> 1.
>>>
>>> In the command-line interface, run the *ipa-certupdate* command to
>>> create a *certmonger* tracking request for the *webserver-ca* and
>>> *webclient-ca* sub-CAs certificates:
>>>
>>> [root@ipaserver ~]# |ipa-certupdate|
>>>
>>> Important
>>>
>>> Forgetting to run the *ipa-certupdate* command after creating a
>>> sub-CA means that if the sub-CA certificate expires, end-entity
>>> certificates issued by the sub-CA are considered invalid even if
>>> the
>>> end-entity certificate has not expired.
>>>
>>> Is this also valid for rhel 7? I do not see this in the documentation
>>>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>>>
>>> and taking a peek at getcert list on the CA role servers I do not see
>>> any certmonger tracking request for our sub cas.
>>
>> Looks like a doc bug to me. I don't see where ipa-certupdate creates
>> certmonger requests.
>>
> I believe the doc is accurate, you can have a look at
>
https://pagure.io/freeipa/blob/master/f/ipaclient/install/ipa_certupdate....
>
>
> The command ipa ca-add does not create the tracking request, but
> ipa-certupdate does.
You're right, not sure how I missed that :-(
This is not done in RHEL-7. The code was introduced in IPA 4.7.0.
so, summing up, in RHEL-7 I cannot run this, but how are the sub-cas
monitored by certmonger to prevent them from expiring silently?
--
Regards,
natxo