N N via FreeIPA-users wrote:
Hello! Thanks for your reply.
I am new to FreeIPA and I'm afraid that I will have certificate problems. This is why
I added simple monitoring like this:
GSS_USE_PROXY=yes /usr/bin/ipa cert-find --validnotafter-to=`date -d" +30 days
"+ \% F`
All certificates have been updated and I see new certificates in GSS_USE_PROXY = yes /
usr / bin / ipa cert-find
But the certificate with the Subject theme: CN = ipa-ca-agent, O = <realm> is not
renewed, and I found this link
https://www.redhat.com/archives/freeipa-users/2016-August/msg00332.html
If my opinion is correct, then this link describes the method of manually updating the
certificate
https://www.freeipa.org/page/CVE-2015-5284
This is unrelated.
I can’t understand how this certificate is used now, so it’s hard for
me to evaluate the consequences of a future problem.
As I said, this certificate is not used. It is automatically generated
by the CA during installation but not used by IPA.
rob