Christof Schulze via FreeIPA-users wrote: > Reading a lot I learned that certificates should be renewed > automatically 28 before expiring. > > But some of Certificates are now on less than 10 days. > This is on the CA renewal master: > > > Request ID '20181008075404': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > cert-pki-ca',token='NSS > Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > cert-pki-ca',token='NSS > Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate > Authority,O=EXAMPLE.COM,OU=Institute,C=DE,[email protected],L=CITY > subject: CN=OCSP > Subsystem,O=EXAMPLE.COM,OU=Institute,C=DE,[email protected],L=CITY > expires: 2019-11-30 11:12:26 UTC > eku: id-kp-OCSPSigning > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "ocspSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181008075405': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate > Authority,O=EXAMPLE.COM,OU=Institute,C=DE,[email protected],L=CITY > subject: CN=CA > Subsystem,O=EXAMPLE.COM,OU=Institute,C=DE,[email protected],L=CITY > expires: 2019-11-30 11:11:38 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "subsystemCert cert-pki-ca" > track: yes > auto-renew: yes > > Request ID '20181008075407': > status: MONITORING > stuck: no > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate > Authority,O=EXAMPLE.COM,OU=Institute,C=DE,[email protected],L=CITY > subject: CN=IPA > RA,O=EXAMPLE.COM,OU=Institute,C=DE,[email protected],L=CITY > expires: 2019-11-30 11:10:54 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > track: yes > auto-renew: yes > > Is there a way to get them renewed manually?
I'd start by checking the journal for messages from certmonger. It should have tried to renew them at least twice now. The other certificates were able to renew successfullyu? You can force certmonger to try renewal with: # getcert resubmit -i <id> Or you can just restart certmonger and it'll re-evaluate things. rob _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
