On 03/30/2018 01:19 PM, Günther J. Niederwimmer via FreeIPA-users wrote:
Hello,
can any help me to find out the correct way to renew the certificates
After a Problem I found out my certificates are not renewed on my two ipa
servers ?
My ipa servers Version is 4.5.0-22-22
Centos 7.4
All i found on the list or goo.... is not working for me :-(.
have any a a link to the correct way to renew the certificates.
Thanks for a answer,
Hi,
first of all, which certificates are expired? Are there multiple masters
in your topology where the CA component is installed?
Check if the CA is installed on multiple nodes:
# ipa server-role-find --role='CA server'
If the CA is installed on multiple nodes, find the CA renewal master:
# ipa config-show | grep 'CA renewal master'
If the certs did not renew properly, the CA renewal master needs to be
fixed first. Once all the certs on this machine are updated, you can
start fixing the other ones.
Check which certificates are expired:
# getcert list | grep -E "Request ID|status|certificate|expires"
Once the expired certificates are identified, please provide any
specific error messages obtained in the output of 'getcert list -i
<request ID>', this may help diagnose the issue.
Flo