Rob,
I'll be honest. I think you are suggesting an ldapsearch with this
Check to see which masteris the renewal master. Look in
cn=CA,cn=$(hostname),cn=masters,cn=ipa,cn=etc,$SUFFIX for
ipaConfigString=caRenewalMaster
sorry I've not figured out how to successfully ldapsearch :-(
Instead I did this:
ipa config-show |grep 'CA renewal master'
It came up blank. I suspect I didn't have a renewal master somehow.
Then I did This:
ipa-csreplica-manage set-renewal-master ipa2 (hostname of working IPA
server)
Next is a "yum update" to be safe, and lastly "ipa-server-upgrade" on
ipa2. When that's all done I'll try "yum update" and
"ipa-server-upgrade" on my broken IPA system ipa1
I'll report back here when finished.
Thanks,
-Chris
Check to see which masteris the renewal master. Look in
cn=CA,cn=$(hostname),cn=masters,cn=ipa,cn=etc,$SUFFIX for
ipaConfigString=caRenewalMaster
You want to run the script on that master first to get the certs renewed.
I'd start by re-running ipa-server-upgrade. It is idempotent so there
should be no risk. It may repair the tracking for you.
rob
On 2/4/2019 3:30 PM, Rob Crittenden wrote:
Chris Mohler via FreeIPA-users wrote:
Thanks for looking at my issue!
There have been no recent updates on my system. Actually I was getting
ready to update when I noticed things weren't good.
Here is the output from the log of the most recent update. Looks like it
was completed successfully. The lines you asked about are in
Bold/underlined.
2018-07-18T16:55:21Z INFO [Update certmonger certificate renewal
configuration]
2018-07-18T16:55:21Z DEBUG Loading Index file from
'/var/lib/ipa/sysrestore/sysrestore.index'
2018-07-18T16:55:21Z DEBUG Starting external process
2018-07-18T16:55:21Z DEBUG args=/usr/bin/certutil -d
/etc/pki/pki-tomcat/alias -L -f /etc/pki/pki-tomcat/alias/pwdfile.txt
2018-07-18T16:55:21Z DEBUG Process finished, return code=0
2018-07-18T16:55:21Z DEBUG stdout=
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
caSigningCert cert-pki-ca CTu,Cu,Cu
subsystemCert cert-pki-ca u,u,u
ocspSigningCert cert-pki-ca u,u,u
auditSigningCert cert-pki-ca u,u,Pu
Server-Cert cert-pki-ca u,u,u
2018-07-18T16:55:21Z DEBUG stderr=
_*2018-07-18T16:55:21Z DEBUG Configuring certmonger to stop tracking
system certificates for CA*_
2018-07-18T16:55:21Z DEBUG Starting external process
2018-07-18T16:55:21Z DEBUG args=/bin/systemctl start messagebus.service
2018-07-18T16:55:21Z DEBUG Process finished, return code=0
2018-07-18T16:55:21Z DEBUG stdout=
2018-07-18T16:55:21Z DEBUG stderr=
2018-07-18T16:55:21Z DEBUG Starting external process
2018-07-18T16:55:21Z DEBUG args=/bin/systemctl is-active
messagebus.service
2018-07-18T16:55:21Z DEBUG Process finished, return code=0
2018-07-18T16:55:21Z DEBUG stdout=active
2018-07-18T16:55:21Z DEBUG stderr=
2018-07-18T16:55:21Z DEBUG Starting external process
2018-07-18T16:55:21Z DEBUG args=/bin/systemctl start certmonger.service
2018-07-18T16:55:21Z DEBUG Process finished, return code=0
2018-07-18T16:55:21Z DEBUG stdout=
2018-07-18T16:55:21Z DEBUG stderr=
2018-07-18T16:55:21Z DEBUG Starting external process
2018-07-18T16:55:21Z DEBUG args=/bin/systemctl is-active
certmonger.service
2018-07-18T16:55:21Z DEBUG Process finished, return code=0
2018-07-18T16:55:21Z DEBUG stdout=active
-snip- a few more lines like the section above.
2018-07-18T16:55:25Z DEBUG stderr=
2018-07-18T16:55:30Z DEBUG Loading Index file from
'/var/lib/ipa/sysrestore/sysrestore.index'
2018-07-18T16:55:30Z DEBUG Starting external process
2018-07-18T16:55:30Z DEBUG args=/usr/bin/certutil -d
/etc/dirsrv/DOMAINNAMEHERE -L -n Server-Cert -a -f
/etc/dirsrv/DOMAINNAMEHERE/pwdfile.txt
2018-07-18T16:55:30Z DEBUG Process finished, return code=0
2018-07-18T16:55:30Z DEBUG stdout=-----BEGIN CERTIFICATE-----
-Snip- Cert and Key stuff goes here-
2018-07-18T16:55:34Z DEBUG stderr=
_*2018-07-18T16:55:35Z INFO Certmonger certificate renewal
configuration updated*_
Check to see which masteris the renewal master. Look in
cn=CA,cn=$(hostname),cn=masters,cn=ipa,cn=etc,$SUFFIX for
ipaConfigString=caRenewalMaster
You want to run the script on that master first to get the certs renewed.
I'd start by re-running ipa-server-upgrade. It is idempotent so there
should be no risk. It may repair the tracking for you.
rob
On 2/4/2019 1:44 PM, Florence Blanc-Renaud wrote:
On 2/4/19 5:59 PM, Chris Mohler via FreeIPA-users wrote:
Hi Everyone,
I'm looking for some help. I'm having trouble with everything basically.
I think one of my CA's certs expired or something. I can't kinit
admin, I can't login via the WebGui. If I "getcert list" it returns
"Number of certificates and requests being tracked: 0."
This all started happening a few days ago and I am at a loss as to
what happened. On a whim I set the system date and time back a few
months to see if my certs were expired and like magic I can login to
the Webgui but I'm still not tracking anything with "getcert list" I
suspect the cert has expired but without tracking it I can't tell, or
renew it.
Hi,
can you check if an upgrade happened recently (have a look at
/var/log/ipaupgrade.log)? The upgrade stop tracking certs and
re-configures certmonger, so if it failed in the middle you may be
left without any tracking.
You should be able to find lines like the following if the
untracking/tracking went fine:
---
[Update certmonger certificate renewal configuration]
Configuring certmonger to stop tracking system certificates for CA
Certmonger certificate renewal configuration updated
---
HTH,
flo
Please help
I'm running Centos 7, FreeIPA 4.5.4
Thanks,
-Chris
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to
[email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
