On Wed, Jun 3, 2020 at 6:49 PM Rob Crittenden via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>> wrote:
Florence Blanc-Renaud via FreeIPA-users wrote:
> On 6/3/20 6:07 PM, Rob Crittenden via FreeIPA-users wrote:
>> Natxo Asenjo via FreeIPA-users wrote:
>>> hi,
>>>
>>> in the rhel 8 documentation I came across this:
>>>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
>>>
>>>
>>> 1.
>>>
>>> In the command-line interface, run the *ipa-certupdate*
command to
>>> create a *certmonger* tracking request for the
*webserver-ca* and
>>> *webclient-ca* sub-CAs certificates:
>>>
>>> [root@ipaserver ~]# |ipa-certupdate|
>>>
>>> Important
>>>
>>> Forgetting to run the *ipa-certupdate* command after creating a
>>> sub-CA means that if the sub-CA certificate expires, end-entity
>>> certificates issued by the sub-CA are considered invalid
even if
>>> the
>>> end-entity certificate has not expired.
>>>
>>> Is this also valid for rhel 7? I do not see this in the
documentation
>>>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>>>
>>> and taking a peek at getcert list on the CA role servers I do
not see
>>> any certmonger tracking request for our sub cas.
>>
>> Looks like a doc bug to me. I don't see where ipa-certupdate creates
>> certmonger requests.
>>
> I believe the doc is accurate, you can have a look at
>
https://pagure.io/freeipa/blob/master/f/ipaclient/install/ipa_certupdate....
>
>
> The command ipa ca-add does not create the tracking request, but
> ipa-certupdate does.
You're right, not sure how I missed that :-(
This is not done in RHEL-7. The code was introduced in IPA 4.7.0.
so, summing up, in RHEL-7 I cannot run this, but how are the sub-cas
monitored by certmonger to prevent them from expiring silently?
The summation is that I messed up twice now in this thread.
The git tag said that the tracking was only added in 4.7.0+. I'm
guessing a manual backport was needed back to the ipa-4-6 branch. It is
indeed in the 4.6 branch from 4.6.2 onward.
So ipa-certupdate should add the tracking for subcas.
rob