Thanks Florence,
is it safe to run "ipa-server-upgrade" ?
Do i need to provide any option with "ipa-server-upgrade" command? i
believe few month back when i tried to do "ipa-server-upgrade" it
broke some stuff but anyway i will take snapshot of VM and try in
worst case scenario.
On Mon, Sep 23, 2019 at 2:25 AM Florence Blanc-Renaud <flo(a)redhat.com> wrote:
>
> On 9/21/19 7:41 PM, Satish Patel via FreeIPA-users wrote:
> > Any thought ?
> Hi,
> if you run ipa-server-upgrade on this node, the command will fix the
> tracking of certs. You should see in the output;
> [Update certmonger certificate renewal configuration]
>
> HTH,
> flo
>
> >
> > Sent from my iPhone
> >
> >> On Sep 20, 2019, at 11:35 AM, Satish Patel <satish.txt(a)gmail.com>
wrote:
> >>
> >> Rob sorry, i trim my output thought not necessary but anyway here is
> >> the full list (ignore CAPS letter in output)
> >>
> >> [root@ldap-ca-master ~]# getcert list
> >>
> >> Number of certificates and requests being tracked: 12.
> >>
> >> Request ID '20190915042927':
> >>
> >> status: NEED_CA
> >>
> >> stuck: yes
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> >> cert-pki-ca',token='NSS Certificate DB',pin set
> >>
> >> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> >> cert-pki-ca',token='NSS Certificate DB'
> >>
> >> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> subject: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> expires: 2037-01-05 14:47:24 UTC
> >>
> >> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915043150':
> >>
> >> status: NEED_CA
> >>
> >> stuck: yes
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> >> cert-pki-ca',token='NSS Certificate DB',pin set
> >>
> >> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> >> cert-pki-ca',token='NSS Certificate DB'
> >>
> >> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> subject:
CN=ldap-ca-master.foo.EXAMPLE.com,O=EXAMPLE.COM
> >>
> >> expires: 2020-11-17 18:30:29 UTC
> >>
> >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> >>
> >> eku: id-kp-serverAuth,id-kp-clientAuth
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915043212':
> >>
> >> status: NEED_CA
> >>
> >> stuck: yes
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> >> cert-pki-ca',token='NSS Certificate DB',pin set
> >>
> >> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> >> cert-pki-ca',token='NSS Certificate DB'
> >>
> >> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> subject: CN=OCSP
Subsystem,O=EXAMPLE.COM
> >>
> >> expires: 2020-11-17 18:31:26 UTC
> >>
> >> eku: id-kp-OCSPSigning
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915043224':
> >>
> >> status: NEED_CA
> >>
> >> stuck: yes
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> >> cert-pki-ca',token='NSS Certificate DB',pin set
> >>
> >> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> >> cert-pki-ca',token='NSS Certificate DB'
> >>
> >> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> subject: CN=CA
Audit,O=EXAMPLE.COM
> >>
> >> expires: 2020-11-17 18:32:07 UTC
> >>
> >> key usage: digitalSignature,nonRepudiation
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915043237':
> >>
> >> status: NEED_CA
> >>
> >> stuck: yes
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> >> cert-pki-ca',token='NSS Certificate DB',pin set
> >>
> >> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> >> cert-pki-ca',token='NSS Certificate DB'
> >>
> >> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> subject: CN=CA
Subsystem,O=EXAMPLE.COM
> >>
> >> expires: 2020-11-17 18:31:16 UTC
> >>
> >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> >>
> >> eku: id-kp-serverAuth,id-kp-clientAuth
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915043246':
> >>
> >> status: NEED_KEY_PAIR
> >>
> >> stuck: no
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',pin
> >> set
> >>
> >> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',token='NSS
> >> Certificate DB'
> >>
> >> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>
> >> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>
> >> expires: 2037-12-31 23:59:59 UTC
> >>
> >> key usage: keyCertSign,cRLSign
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915043304':
> >>
> >> status: NEED_KEY_PAIR
> >>
> >> stuck: no
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
> >> Intermediate',pin set
> >>
> >> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
> >> Intermediate',token='NSS Certificate DB'
> >>
> >> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>
> >> subject: CN=Go Daddy Secure Certificate Authority -
> >>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
> >> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>
> >> expires: 2031-05-03 07:00:00 UTC
> >>
> >> key usage: keyCertSign,cRLSign
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915045112':
> >>
> >> status: NEED_KEY_PAIR
> >>
> >> stuck: no
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM
IPA
> >> CA',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>
> >> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM
> >> IPA CA',token='NSS Certificate DB'
> >>
> >> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> subject: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> expires: 2037-01-05 14:47:24 UTC
> >>
> >> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915045148':
> >>
> >> status: NEED_KEY_PAIR
> >>
> >> stuck: no
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>
> >> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',token='NSS
> >> Certificate DB'
> >>
> >> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>
> >> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>
> >> expires: 2037-12-31 23:59:59 UTC
> >>
> >> key usage: keyCertSign,cRLSign
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915045156':
> >>
> >> status: NEED_CA
> >>
> >> stuck: yes
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
> >> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>
> >> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
> >> Certificate DB'
> >>
> >> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> subject: CN=Object Signing
Cert,O=EXAMPLE.COM
> >>
> >> expires: 2021-01-05 14:49:59 UTC
> >>
> >> key usage: digitalSignature,keyCertSign
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915045206':
> >>
> >> status: NEED_KEY_PAIR
> >>
> >> stuck: no
> >>
> >> key pair storage:
> >> type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
> >> Intermediate',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>
> >> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
> >> Intermediate',token='NSS Certificate DB'
> >>
> >> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>
> >> subject: CN=Go Daddy Secure Certificate Authority -
> >>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
> >> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>
> >> expires: 2031-05-03 07:00:00 UTC
> >>
> >> key usage: keyCertSign,cRLSign
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >> Request ID '20190915045216':
> >>
> >> status: NEED_CA
> >>
> >> stuck: yes
> >>
> >> key pair storage:
> >>
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
> >> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>
> >> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
> >> Certificate DB'
> >>
> >> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>
> >> subject: CN=IPA
RA,O=EXAMPLE.COM
> >>
> >> expires: 2020-11-17 18:31:36 UTC
> >>
> >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> >>
> >> eku: id-kp-serverAuth,id-kp-clientAuth
> >>
> >> pre-save command:
> >>
> >> post-save command:
> >>
> >> track: yes
> >>
> >> auto-renew: yes
> >>
> >>> On Fri, Sep 20, 2019 at 10:58 AM Rob Crittenden
<rcritten(a)redhat.com> wrote:
> >>>
> >>> Satish Patel via FreeIPA-users wrote:
> >>>> Few days ago my Master CA was messed up and getcert list was
showing
> >>>> empty list (no cert to track)
> >>>>
> >>>> So i run following command to add certs manually:
> >>>>
> >>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
> >>>> 'ocspSigningCert cert-pki-ca' -P XXXXXXX
> >>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
> >>>> 'auditSigningCert cert-pki-ca' -P XXXXXXX
> >>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
'subsystemCert
> >>>> cert-pki-ca' -P XXXXXXX
> >>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n
'Godaddy' -P XXXXXXX
> >>>> getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'Godaddy
> >>>> Intermediate' -P XXXXXXX
> >>>>
> >>>> And after that i am seeing this status (status: NEED_CA ) it
should
> >>>> be MONITORING right?
> >>>>
> >>>> # getcert list
> >>>> Number of certificates and requests being tracked: 12.
> >>>
> >>> You setup the tracking wrong. Your output only shows 3 certs and yet
> >>> certmonger thinks it has 12. Where are the other 9?
> >>>
> >>> rob
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> >
>