Florence Blanc-Renaud via FreeIPA-users wrote:
> On 6/3/20 6:07 PM, Rob Crittenden via FreeIPA-users wrote:
>> Natxo Asenjo via FreeIPA-users wrote:
>>> hi,
>>>
>>> in the rhel 8 documentation I came across this:
>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/configuring_and_managing_identity_management/index#creating-a-sub-CA-from-IdM-CLI_restricting-an-application-to-trust-a-subset-of-certs
>>>
>>>
>>> 1.
>>>
>>> In the command-line interface, run the *ipa-certupdate* command to
>>> create a *certmonger* tracking request for the *webserver-ca* and
>>> *webclient-ca* sub-CAs certificates:
>>>
>>> [root@ipaserver ~]# |ipa-certupdate|
>>>
>>> Important
>>>
>>> Forgetting to run the *ipa-certupdate* command after creating a
>>> sub-CA means that if the sub-CA certificate expires, end-entity
>>> certificates issued by the sub-CA are considered invalid even if
>>> the
>>> end-entity certificate has not expired.
>>>
>>> Is this also valid for rhel 7? I do not see this in the documentation
>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/linux_domain_identity_authentication_and_policy_guide/index#lightweight-sub-cas
>>>
>>> and taking a peek at getcert list on the CA role servers I do not see
>>> any certmonger tracking request for our sub cas.
>>
>> Looks like a doc bug to me. I don't see where ipa-certupdate creates
>> certmonger requests.
>>
> I believe the doc is accurate, you can have a look at
> https://pagure.io/freeipa/blob/master/f/ipaclient/install/ipa_certupdate.py#_114
>
>
> The command ipa ca-add does not create the tracking request, but
> ipa-certupdate does.
You're right, not sure how I missed that :-(
This is not done in RHEL-7. The code was introduced in IPA 4.7.0.