Configuring and managing Identity Management
Making open source more inclusive
Providing feedback on Red Hat documentation
1. Logging in to Identity Management from the command line
2. Viewing, starting and stopping the Identity Management services
3. Introduction to the IdM command-line utilities
4. Searching Identity Management entries from the command line
5. Accessing the IdM Web UI in a web browser
6. Logging in to IdM in the Web UI: Using a Kerberos ticket
7. Logging in to the Identity Management Web UI using one time passwords
8. Troubleshooting authentication with SSSD in IdM
9. Preparing your environment for managing IdM using Ansible playbooks
1. 9.1. Preparing a control node and managed nodes for managing IdM using Ansible playbooks
2. 9.2. Different methods to provide the credentials required for ansible-freeipa playbooks
10. Configuring global IdM settings using Ansible playbooks
11. Managing user accounts using the command line
12. Managing user accounts using the IdM Web UI
13. Managing user accounts using Ansible playbooks
14. Managing user groups in IdM CLI
15. Managing user groups in IdM Web UI
16. Managing user groups using Ansible playbooks
17. Automating group membership using IdM CLI
18. Automating group membership using IdM Web UI
19. Using Ansible to automate group membership in IdM
20. Access control in IdM
1. 20.1. Access control instructions in IdM
2. 20.2. Access control methods in IdM
21. Managing self-service rules in IdM using the CLI
22. Managing self-service rules using the IdM Web UI
23. Using Ansible playbooks to manage self-service rules in IdM
24. Delegating permissions to user groups to manage users using IdM CLI
25. Delegating permissions to user groups to manage users using IdM WebUI
26. Delegating permissions to user groups to manage users using Ansible playbooks
27. Managing role-based access controls in IdM using the CLI
28. Managing role-based access controls using the IdM Web UI
29. Using Ansible playbooks to manage role-based access control in IdM
30. Using Ansible playbooks to manage RBAC privileges
31. Using Ansible playbooks to manage RBAC permissions in IdM
32. Managing user passwords in IdM
33. Defining IdM password policies
34. Managing expiring password notifications
35. Using an ID view to override a user attribute value on an IdM client
36. Using ID views for Active Directory users
37. Adjusting ID ranges manually
38. Managing subID ranges manually
39. Using Ansible to manage the replication topology in IdM
40. Configuring IdM for external provisioning of users
41. Using ldapmodify to manage IdM users externally
42. Managing Hosts in IdM CLI
43. Adding host entries from IdM Web UI
44. Managing hosts using Ansible playbooks
45. Managing host groups using the IdM CLI
46. Managing host groups using the IdM Web UI
47. Managing host groups using Ansible playbooks
48. Strengthening Kerberos security with PAC information
1. 48.1. Privilege Attribute Certificate (PAC) use in IdM
2. 48.2. Enabling Security Identifiers (SIDs) in IdM
49. Managing Kerberos ticket policies
50. Maintaining IdM Kerberos keytab files
51. Using the KDC Proxy in IdM
52. Granting sudo access to an IdM user on an IdM client
53. Configuring host-based access control rules
54. Ensuring the presence of host-based access control rules in IdM using Ansible playbooks
1. 54.1. Host-based access control rules in IdM
2. 54.2. Ensuring the presence of an HBAC rule in IdM using an Ansible playbook
55. Managing replication topology
56. Public key certificates in Identity Management
57. Converting certificate formats to work with IdM
58. Managing certificates for users, hosts, and services using the integrated IdM CA
59. Managing IdM certificates using Ansible
60. Managing externally signed certificates for IdM users, hosts, and services
61. Creating and managing certificate profiles in Identity Management
62. Managing the validity of certificates in IdM
63. Configuring Identity Management for smart card authentication
64. Configuring certificates issued by ADCS for smart card authentication in IdM
65. Configuring certificate mapping rules in Identity Management
66. Configuring authentication with a certificate stored on the desktop of an IdM client
67. Using IdM CA renewal server
68. Renewing expired system certificates when IdM is offline
1. 68.1. Renewing expired system certificates on a CA renewal server
2. 68.2. Verifying other IdM servers in the IdM domain after renewal
69. Replacing the web server and LDAP server certificates if they have not yet expired on an IdM replica
70. Replacing the web server and LDAP server certificates if they have expired in the whole IdM deployment
71. Generating CRL on the IdM CA server
1. 71.1. Stopping CRL generation on an IdM server
2. 71.2. Starting CRL generation on an IdM replica server
72. Decommissioning a server that performs the CA renewal server and CRL publisher roles
73. Obtaining an IdM certificate for a service using certmonger
74. Requesting certificates using RHEL System Roles
75. Restricting an application to trust only a subset of certificates
76. Invalidating a specific group of related certificates quickly
1. 76.1. Disabling CA ACLs in IdM CLI
2. 76.2. Disabling an IdM sub-CA
77. Vaults in IdM
78. Using IdM user vaults: storing and retrieving secrets
79. Using Ansible to manage IdM user vaults: storing and retrieving secrets
80. Managing IdM service secrets: storing and retrieving secrets
81. Using Ansible to manage IdM service vaults: storing and retrieving secrets
82. Ensuring the presence and absence of services in IdM using Ansible
83. Enabling AD users to administer IdM
84. Configuring the domain resolution order to resolve short AD user names
85. Enabling authentication using AD User Principal Names in IdM
86. Using canonicalized DNS host names in IdM
87. Managing global DNS configuration in IdM using Ansible playbooks
88. Managing DNS zones in IdM
89. Using Ansible playbooks to manage IdM DNS zones
90. Managing DNS locations in IdM
91. Using Ansible to manage DNS locations in IdM
92. Managing DNS forwarding in IdM
93. Managing DNS records in IdM
94. Using Ansible to manage DNS records in IdM
95. Managing IdM servers by using Ansible
96. Collecting IdM Healthcheck information
97. Checking services using IdM Healthcheck
1. 97.1. Services Healthcheck test
2. 97.2. Screening services using Healthcheck
98. Verifying your IdM and AD trust configuration using IdM Healthcheck
1. 98.1. IdM and AD trust Healthcheck tests
2. 98.2. Screening the trust with the Healthcheck tool
99. Verifying certificates using IdM Healthcheck
1. 99.1. IdM certificates Healthcheck tests
2. 99.2. Screening certificates using the Healthcheck tool
100. Verifying system certificates using IdM Healthcheck
1. 100.1. System certificates Healthcheck tests
2. 100.2. Screening system certificates using Healthcheck
101. Checking disk space using IdM Healthcheck
1. 101.1. Disk space healthcheck test
2. 101.2. Screening disk space using the healthcheck tool
102. Verifying permissions of IdM configuration files using Healthcheck
1. 102.1. File permissions Healthcheck tests
2. 102.2. Screening configuration files using Healthcheck
103. Checking IdM replication using Healthcheck
1. 103.1. Replication healthcheck tests
2. 103.2. Screening replication using Healthcheck
104. Checking DNS records using IdM Healthcheck
1. 104.1. DNS records healthcheck test
2. 104.2. Screening DNS records using the healthcheck tool
105. Demoting or promoting hidden replicas
106. Identity Management security settings
107. Setting up Samba on an IdM domain member
108. Using external identity providers to authenticate to IdM
109. IdM integration with other Red Hat products
110. Using Ansible to integrate IdM with NIS domains and netgroups
111. Migrating from NIS to Identity Management
112. Using automount in IdM
113. Using Ansible to automount NFS shares for IdM users
114. IdM log files and directories
115. Configuring Single Sign-On for the RHEL 8 web console in the IdM domain
116. Using constrained delegation in IdM
Legal Notice

Language:
Format:

Language:
Format:

Red Hat Training

A Red Hat training course is available for RHEL 8

Chapter 76. Invalidating a specific group of related certificates quickly

As a system administrator, if you want to be able to invalidate a specific group of related certificates quickly:

Design your applications so that they only trust certificates that were issued by a specific lightweight Identity Management (IdM) sub-CA. Afterwards, you will be able to invalidate all these certificates by only revoking the certificate of the Identity Management (IdM) sub-CA that issued these certificates. For details on how to create and use a lightweight sub-CA in IdM, see Invalidating a specific group of related certificates quickly.
To ensure that all the certificates that have been issued by the to-be-revoked IdM sub-CA are immediately invalid, configure applications that rely on such certificates to use the IdM OCSP responders. For example, to configure the Firefox browser to use OCSP responders, make sure that the Query OCSP responder servers to confirm the current validity of certificates checkbox is checked in Firefox Preferences.
In IdM, the certificate revocation list (CRL) is updated every four hours. d To invalidate all the certificates issued by an IdM sub-CA, revoke the IdM sub-CA certificate. In addition, disable the relevant CA ACLs, and consider disabling the IdM sub-CA. Disabling the sub-CA prevents the sub-CA from issuing new certificates, but allows Online Certificate Status Protocol (OCSP) responses to be produced for previously issued certificates because the sub-CA’s signing keys are retained.

Important

Do not delete the sub-CA if you use OCSP in your environment. Deleting the sub-CA deletes the signing keys of the sub-CA, preventing production of OCSP responses for certificates issued by that sub-CA.

The only scenario when deleting a sub-CA is preferable to disabling it is when you want to create a new sub-CA with the same Subject distinguished name (DN) but a new signing key.

76.1. Disabling CA ACLs in IdM CLI

When you want to retire an IdM service or a group of IdM services, consider disabling any existing corresponding CA ACLs.

Follow this procedure to disable the TLS_web_server_authentication CA ACL that restricts the web server running on your IdM client to request a certificate to be issued by the webserver-ca IdM sub-CA, and to disable the TLS_web_client_authentication CA ACL that restricts IdM users to request a user certificate to be issued by the webclient-ca IdM sub-CA.

Procedure

Optionally, to view all the CA ACLs in your IdM environment, enter the ipa caacl-find command:

$ ipa caacl-find
-----------------
3 CA ACLs matched
-----------------
  ACL name: hosts_services_caIPAserviceCert
  Enabled: TRUE

  ACL name: TLS_web_server_authentication
  Enabled: TRUE

  ACL name: TLS_web_client_authentication
  Enabled: TRUE

Optionally, to view the details of a CA ACL, enter the ipa caacl-show command, and specify the CA ACL name:

$ ipa caacl-show TLS_web_server_authentication
  ACL name: TLS_web_server_authentication
  Description: CAACL for web servers authenticating to web clients using certificates issued by webserver-ca
  Enabled: TRUE
  CAs: webserver-ca
  Profiles: caIPAserviceCert
  Services: HTTP/rhel8server.idm.example.com@IDM.EXAMPLE.COM

To disable a CA ACL, enter the ipa caacl-disable command, and specify the CA ACL name.
- To disable the TLS_web_server_authentication CA ACL, enter:
```
$ ipa caacl-disable TLS_web_server_authentication
-------------------------------------------------
Disabled CA ACL "TLS_web_server_authentication"
-------------------------------------------------
```
- To disable the TLS_web_client_authentication CA ACL, enter:
```
$ ipa caacl-disable TLS_web_client_authentication
-------------------------------------------------
Disabled CA ACL "TLS_web_client_authentication"
-------------------------------------------------
```
The only enabled CA ACL now is the hosts_services_caIPAserviceCert CA ACL.
Important
Be extremely careful about disabling the hosts_services_caIPAserviceCert CA ACL. Disabling hosts_services_caIPAserviceCert, without another CA ACL granting IdM servers use of the ipa CA with the caIPAserviceCert profile means that certificate renewal of the IdM HTTP and LDAP certificates will fail. The expired IdM HTTP and LDAP certificates will eventually cause IdM system failure.

76.2. Disabling an IdM sub-CA

After revoking the CA certificate of an IdM sub-CA to invalidate all the certificates issued by that sub-CA, consider disabling the IdM sub-CA if you no longer need it. You can re-enable the sub-CA at a later time.

Disabling the sub-CA prevents the sub-CA from issuing new certificates, but allows Online Certificate Status Protocol (OCSP) responses to be produced for previously issued certificates because the sub-CA’s signing keys are retained.

Prerequisites

You are logged in as IdM administrator.

Procedure

Enter the ipa ca-disable command and specify the name of the sub-CA:

$ ipa ca-disable webserver-CA
--------------------
Disabled CA "webserver-CA"
--------------------

Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation

Red Hat Training

Chapter 76. Invalidating a specific group of related certificates quickly

Language and Page Formatting Options

Red Hat Training

Chapter 76. Invalidating a specific group of related certificates quickly

76.1. Disabling CA ACLs in IdM CLI

76.2. Disabling an IdM sub-CA