Update.
Thanks to the invaluable help of Florence. Truly terrific.
What we ended up doing.
Investigate why it happened. No idea.
Check that certificates on the other CA are still valid. Check
Move CRL to the working CA. Check
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
Figure out the parameters to pass to getcert to start-tracking the 8 certificates. Check
Execute the following commands to start tracking the certificates.
getcert start-tracking -d /etc/httpd/alias -n "Server-Cert" -c IPA -p
/etc/httpd/alias/pwdfile.txt -C '/usr/libexec/ipa/certmonger/restart_httpd'
getcert start-tracking -d /etc/dirsrv/slapd-UNI-LU -n "Server-Cert" -c IPA -p
/etc/dirsrv/slapd-UNI-LU/pwdfile.txt -C '/usr/libexec/ipa/certmonger/restart_dirsrv
UNI-LU’
Figure out Pin for hidden Pin entry
grep internal /etc/pki/pki-tomcat/password.conf
Run the commands by pvodiing pin on CLI
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca"
-c dogtag-ipa-renew-agent -P <pin code> -B
'/usr/libexec/ipa/certmonger/stop_pkicad' -C
'/usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca”'
Realize a helper command was missing. Add it.
getcert add-ca -c dogtag-ipa-ca-renew-agent -e
/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit
Add the remaining certificates
getcert start-tracking -d /etc/httpd/alias -n "ipaCert" -c
dogtag-ipa-ca-renew-agent -p /etc/httpd/alias/pwdfile.txt -B
'/usr/libexec/ipa/certmonger/renew_ra_cert_pre' -C
'/usr/libexec/ipa/certmonger/renew_ra_cert'
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "caSigningCert
cert-pki-ca" -c dogtag-ipa-ca-renew-agent -P <pin code> -B
'/usr/libexec/ipa/certmonger/stop_pkicad' -C
'/usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert
cert-pki-ca"'
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "subsystemCert
cert-pki-ca" -c dogtag-ipa-ca-renew-agent -P <pin code> -B
'/usr/libexec/ipa/certmonger/stop_pkicad' -C
'/usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert
cert-pki-ca"'
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "ocspSigningCert
cert-pki-ca" -c dogtag-ipa-ca-renew-agent -P <pin code> -B
'/usr/libexec/ipa/certmonger/stop_pkicad' -C
'/usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert
cert-pki-ca"'
getcert start-tracking -d /etc/pki/pki-tomcat/alias -n "auditSigningCert
cert-pki-ca" -c dogtag-ipa-ca-renew-agent -P <pin code> -B
'/usr/libexec/ipa/certmonger/stop_pkicad' -C
'/usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert
cert-pki-ca"'
Check that the certificates match the other CA.
getcert list
Check that all are Monitoring.
[root@toto2 ~]# getcert list | grep MONITORING | wc -l
8
Check that Serials match between the two CA servers.
certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "auditSigningCert cert-pki-ca" |
grep Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "caSigningCert cert-pki-ca" | grep
Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "subsystemCert cert-pki-ca" | grep
Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "ocspSigningCert cert-pki-ca" | grep
Serial
certutil -L -d /etc/pki/pki-tomcat/alias -n "auditSigningCert cert-pki-ca" |
grep Serial
The other 3 are supposed to be different.
After that, we move the CRL back to the original server, and assume everything is Ok.
If anybody has any comments on this process, please do let the community know as I hope im
not the only one with this problem.
Kind regards,
Christophe
--
Dr Christophe Trefois, Dipl.-Ing.
Technical Specialist / Post-Doc
UNIVERSITÉ DU LUXEMBOURG
LUXEMBOURG CENTRE FOR SYSTEMS BIOMEDICINE
Campus Belval | House of Biomedicine
6, avenue du Swing
L-4367 Belvaux
T: +352 46 66 44 6124
F: +352 46 66 44 6949
http://www.uni.lu/lcsb
[
Facebook]<https://www.facebook.com/trefex> [Twitter]
<
https://twitter.com/Trefex> [Google Plus]
<
https://plus.google.com/+ChristopheTrefois/> [Linkedin]
<
https://www.linkedin.com/in/trefoischristophe> [skype]
<
http://skype:Trefex?call>
----
This message is confidential and may contain privileged information.
It is intended for the named recipient only.
If you receive it in error please notify me and permanently delete the original message
and any copies.
----
On 18 May 2017, at 23:27, Christophe TREFOIS
<christophe.trefois@uni.lu<mailto:christophe.trefois@uni.lu>> wrote:
Hi,
I just saw that my CA CRL master is not tracking any certs.
However, my other CA master replica is tracking 8 certificates.
Is this normal and expected?
Thanks,
Christophe
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to
http://freeipa.org for more info on the project