On Wed, Jun 3, 2020 at 6:49 PM Rob Crittenden via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:
Florence Blanc-Renaud via FreeIPA-users wrote:
> On 6/3/20 6:07 PM, Rob Crittenden via FreeIPA-users wrote:
>> Natxo Asenjo via FreeIPA-users wrote:
>>> hi,
>>>
>>> in the rhel 8 documentation I came across this:
>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/configuring_and_managing_identity_management/index#creating-a-sub-CA-from-IdM-CLI_restricting-an-application-to-trust-a-subset-of-certs
>>>
>>>
>>>   1.
>>>
>>>      In the command-line interface, run the *ipa-certupdate* command to
>>>      create a *certmonger* tracking request for the *webserver-ca* and
>>>      *webclient-ca* sub-CAs certificates:
>>>
>>>      [root@ipaserver ~]# |ipa-certupdate|
>>>
>>>      Important
>>>
>>>      Forgetting to run the *ipa-certupdate* command after creating a
>>>      sub-CA means that if the sub-CA certificate expires, end-entity
>>>      certificates issued by the sub-CA are considered invalid even if
>>> the
>>>      end-entity certificate has not expired.
>>>
>>> Is this also valid for rhel 7? I do not see this in the documentation
>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/linux_domain_identity_authentication_and_policy_guide/index#lightweight-sub-cas
>>>
>>> and taking a peek at getcert list on the CA role servers I do not see
>>> any certmonger tracking request for our sub cas.
>>
>> Looks like a doc bug to me. I don't see where ipa-certupdate creates
>> certmonger requests.
>>
> I believe the doc is accurate, you can have a look at
> https://pagure.io/freeipa/blob/master/f/ipaclient/install/ipa_certupdate.py#_114
>
>
> The command ipa ca-add does not create the tracking request, but
> ipa-certupdate does.

You're right, not sure how I missed that :-(

This is not done in RHEL-7. The code was introduced in IPA 4.7.0.

so, summing up, in RHEL-7 I cannot run this, but how are the sub-cas monitored by certmonger to prevent them from expiring silently?

--
Regards,
natxo