On 2/7/19 5:20 PM, Jernej Jakob via FreeIPA-users wrote:
Thanks Florence. That was the way I had intended to do it (I've
studied the process quite some time ago, enough that the guide I was studying got
deleted), only my mind slipped when writing up the mail.
Still, I can't run: "getcert list -d /var/lib/pki-ca/alias -n
"subsystemCert cert-pki-ca" | grep post-save"
or the "getcert stop-tracking ..." steps as there is no /var/lib/pki-ca on my
system. Only /var/lib/pki/pki-tomcat.
IIRC in RHEL6 PKI version 9 was used and the instance was installed in
/var/lib/pki-ca, while in RHEL7 PKI 10 is used and the instance is in
What's important in the steps is to make sure that the RHEL6 node does
not act as renewal master any more.
I have CS.cfg in:
/etc/pki/pki-tomcat contains both the ca and alias subdirs, if I substitute this and
continue, I get to a different obstacle:
"getcert list -d /var/lib/pki/pki-tomcat/alias -n "subsystemCert
returns "No request found that matched arguments."
Only if I run "getcert list" without arguments I get the long list and details
about each certificate:
/var/lib/pki/pki-tomcat/alias is a symlink to /etc/pki/pki-tomcat/alias.
getcert list | grep "subsystemCert cert-pki-ca"
key pair storage:
cert-pki-ca',token='NSS Certificate DB',pin='xxxxxxxxxxxx'
cert-pki-ca',token='NSS Certificate DB'
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "subsystemCert
This means this is the master?
Yes, the renewal master is using renew_ca_cert as
postsave command while
the clones are using restart_pkicad.
If there is such a difference in the behavior (output) of getcert on my system, how can I
assume the other getcert commands in the process will work? (iow, they likely won't?)
----- Izvirno sporočilo -----
Od: "Florence Blanc-Renaud" <flo(a)redhat.com>
Za: "FreeIPA users list" <freeipa-users(a)lists.fedorahosted.org>
Cc: "Jernej Jakob" <jernej.jakob(a)abak.si>
Poslano: Četrtek, 7. Februar 2019 16:50:03
Zadeva: Re: [Freeipa-users] Upgrading from V3 on Fedora to V4 on CentOS, CA promotion
please find more information here: Migrating IdM from RHEL6 to 7 .
The direct upgrade from IdM 3.x to 4.x is not supported, the recommended
path is to install a 4.x replica from the 3.x master (with all the
needed services, for instance CA, DNS, etc...) then decommission the 6.x
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines