Chris Mohler via FreeIPA-users wrote: > Thanks for looking at my issue! > > There have been no recent updates on my system. Actually I was getting > ready to update when I noticed things weren't good. > > Here is the output from the log of the most recent update. Looks like it > was completed successfully. The lines you asked about are in > Bold/underlined. > >> 2018-07-18T16:55:21Z INFO [Update certmonger certificate renewal >> configuration] >> 2018-07-18T16:55:21Z DEBUG Loading Index file from >> '/var/lib/ipa/sysrestore/sysrestore.index' >> 2018-07-18T16:55:21Z DEBUG Starting external process >> 2018-07-18T16:55:21Z DEBUG args=/usr/bin/certutil -d >> /etc/pki/pki-tomcat/alias -L -f /etc/pki/pki-tomcat/alias/pwdfile.txt >> 2018-07-18T16:55:21Z DEBUG Process finished, return code=0 >> 2018-07-18T16:55:21Z DEBUG stdout= >> Certificate Nickname Trust >> Attributes >> >> SSL,S/MIME,JAR/XPI >> >> caSigningCert cert-pki-ca CTu,Cu,Cu >> subsystemCert cert-pki-ca u,u,u >> ocspSigningCert cert-pki-ca u,u,u >> auditSigningCert cert-pki-ca u,u,Pu >> Server-Cert cert-pki-ca u,u,u >> >> 2018-07-18T16:55:21Z DEBUG stderr= >> _*2018-07-18T16:55:21Z DEBUG Configuring certmonger to stop tracking >> system certificates for CA*_ >> 2018-07-18T16:55:21Z DEBUG Starting external process >> 2018-07-18T16:55:21Z DEBUG args=/bin/systemctl start messagebus.service >> 2018-07-18T16:55:21Z DEBUG Process finished, return code=0 >> 2018-07-18T16:55:21Z DEBUG stdout= >> 2018-07-18T16:55:21Z DEBUG stderr= >> 2018-07-18T16:55:21Z DEBUG Starting external process >> 2018-07-18T16:55:21Z DEBUG args=/bin/systemctl is-active >> messagebus.service >> 2018-07-18T16:55:21Z DEBUG Process finished, return code=0 >> 2018-07-18T16:55:21Z DEBUG stdout=active >> >> 2018-07-18T16:55:21Z DEBUG stderr= >> 2018-07-18T16:55:21Z DEBUG Starting external process >> 2018-07-18T16:55:21Z DEBUG args=/bin/systemctl start certmonger.service >> 2018-07-18T16:55:21Z DEBUG Process finished, return code=0 >> 2018-07-18T16:55:21Z DEBUG stdout= >> 2018-07-18T16:55:21Z DEBUG stderr= >> 2018-07-18T16:55:21Z DEBUG Starting external process >> 2018-07-18T16:55:21Z DEBUG args=/bin/systemctl is-active >> certmonger.service >> 2018-07-18T16:55:21Z DEBUG Process finished, return code=0 >> 2018-07-18T16:55:21Z DEBUG stdout=active >> > -snip- a few more lines like the section above. >> >> 2018-07-18T16:55:25Z DEBUG stderr= >> 2018-07-18T16:55:30Z DEBUG Loading Index file from >> '/var/lib/ipa/sysrestore/sysrestore.index' >> 2018-07-18T16:55:30Z DEBUG Starting external process >> 2018-07-18T16:55:30Z DEBUG args=/usr/bin/certutil -d >> /etc/dirsrv/DOMAINNAMEHERE -L -n Server-Cert -a -f >> /etc/dirsrv/DOMAINNAMEHERE/pwdfile.txt >> 2018-07-18T16:55:30Z DEBUG Process finished, return code=0 >> 2018-07-18T16:55:30Z DEBUG stdout=-----BEGIN CERTIFICATE----- > -Snip- Cert and Key stuff goes here- >> >> 2018-07-18T16:55:34Z DEBUG stderr= >> _*2018-07-18T16:55:35Z INFO Certmonger certificate renewal >> configuration updated*_
Check to see which masteris the renewal master. Look in cn=CA,cn=$(hostname),cn=masters,cn=ipa,cn=etc,$SUFFIX for ipaConfigString=caRenewalMaster You want to run the script on that master first to get the certs renewed. I'd start by re-running ipa-server-upgrade. It is idempotent so there should be no risk. It may repair the tracking for you. rob > > > > On 2/4/2019 1:44 PM, Florence Blanc-Renaud wrote: >> On 2/4/19 5:59 PM, Chris Mohler via FreeIPA-users wrote: >>> Hi Everyone, >>> >>> I'm looking for some help. I'm having trouble with everything basically. >>> >>> I think one of my CA's certs expired or something. I can't kinit >>> admin, I can't login via the WebGui. If I "getcert list" it returns >>> "Number of certificates and requests being tracked: 0." >>> >>> This all started happening a few days ago and I am at a loss as to >>> what happened. On a whim I set the system date and time back a few >>> months to see if my certs were expired and like magic I can login to >>> the Webgui but I'm still not tracking anything with "getcert list" I >>> suspect the cert has expired but without tracking it I can't tell, or >>> renew it. >>> >> Hi, >> >> can you check if an upgrade happened recently (have a look at >> /var/log/ipaupgrade.log)? The upgrade stop tracking certs and >> re-configures certmonger, so if it failed in the middle you may be >> left without any tracking. >> You should be able to find lines like the following if the >> untracking/tracking went fine: >> --- >> [Update certmonger certificate renewal configuration] >> Configuring certmonger to stop tracking system certificates for CA >> Certmonger certificate renewal configuration updated >> --- >> >> HTH, >> flo >> >>> Please help >>> >>> I'm running Centos 7, FreeIPA 4.5.4 >>> >>> Thanks, >>> >>> -Chris >>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- [email protected] >>> To unsubscribe send an email to >>> [email protected] >>> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedorahosted.org/archives/list/[email protected] >>> >> > > > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
