• regenerating a certificate-signing request (CSR) using the options provided in the original request.
• submitting the CSR to the IdM CA using the IdM API cert-request command.
• receiving the certificate from the IdM CA.
• executing a pre-save command if specified by the original request.
• installing the new certificate in the location specified in the renewal request: either in an NSS database or in a file.
• executing a post-save command if specified by the original request. For example, the post-save command can instruct certmonger to restart a relevant service, so that the service picks up the new certificate.

• IdM CA certificate
• OCSP signing certificate
• IdM CA subsystem certificates
• IdM CA audit signing certificate
• IdM renewal agent (RA) certificate
• KRA transport and storage certificates

• The certmonger daemon, which is the engine tracking the list of certificates and launching renewal commands
• The getcert utility for the command-line interface (CLI), which allows the system administrator to actively send commands to the certmonger daemon.

• Request a new certificate
• View the list of certificates that certmonger tracks
• Start or stop tracking a certificate
• Renew a certificate

Prerequisites

• The web server is enrolled as an IdM client.
• You have root access to the IdM client on which you are running the procedure.
• The service for which you are requesting a certificate does not have to pre-exist in IdM.

• Figure 36.1, “Unencrypted communication”
• Figure 36.2, “Certmonger requesting a service certificate”
• Figure 36.3, “IdM CA issuing the service certificate”
• Figure 36.4, “Certmonger applying the service certificate”
• Figure 36.5, “Certmonger requesting a new certificate when the old one is nearing expiration”

Procedure

• If you know how to specify the certificate request, list the details of only that particular certificate request. You can, for example, specify:

  • The request ID
  • The location of the certificate

  • The certificate nickname

    For example, to view the details of the certificate whose request ID is 20190408143846, using the -v option to view all the details of errors in case your request for a certificate was unsuccessful:

    # getcert list -i 20190408143846 -v
    Number of certificates and requests being tracked: 16.
    Request ID '20190408143846':
    	status: MONITORING
    	stuck: no
    	key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IDM-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IDM-EXAMPLE-COM/pwdfile.txt'
    	certificate: type=NSSDB,location='/etc/dirsrv/slapd-IDM-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB'
    	CA: IPA
    	issuer: CN=Certificate Authority,O=IDM.EXAMPLE.COM
    	subject: CN=r8server.idm.example.com,O=IDM.EXAMPLE.COM
    	expires: 2021-04-08 16:38:47 CEST
    	dns: r8server.idm.example.com
    	principal name: ldap/server.idm.example.com@IDM.EXAMPLE.COM
    	key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
    	eku: id-kp-serverAuth,id-kp-clientAuth
    	pre-save command:
    	post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IDM-EXAMPLE-COM
    	track: yes
    	auto-renew: yes

  The output displays several pieces of information about the certificate, for example:

  • the certificate location; in the example above, it is the NSS database in the /etc/dirsrv/slapd-IDM-EXAMPLE-COM directory
  • the certificate nickname; in the example above, it is Server-Cert
  • the file storing the pin; in the example above, it is /etc/dirsrv/slapd-IDM-EXAMPLE-COM/pwdfile.txt
  • the Certificate Authority (CA) that will be used to renew the certificate; in the example above, it is the IPA CA
  • the expiration date; in the example above, it is 2021-04-08 16:38:47 CEST
  • the status of the certificate; in the example above, the MONITORING status means that the certificate is valid and it is being tracked
  • the post-save command; in the example above, it is the restart of the LDAP service

• If you do not know how to specify the certificate request, list the details of all the certificates that certmonger is monitoring or attempting to obtain:

  # getcert list

Additional information

• To view the different options how to specify the certificate request displayed, see the getcert list man page.

Procedure

• To disable the monitoring of a certificate with the Request ID of 20190408143846:

  # getcert stop-tracking -i 20190408143846

  For more options, see the getcert stop-tracking man page.

• To enable the monitoring of a certificate stored in the /tmp/some_cert.crt file, whose private key is stored in the /tmp/some_key.key file:

  # getcert start-tracking -c IPA -f /tmp/some_cert.crt -k /tmp/some_key.key

  Certmonger cannot automatically identify the CA type that issued the certificate. For this reason, add the -c option with the IPA value to the getcert start-tracking command if the certificate was issued by the IdM CA. Omitting to add the -c option results in certmonger entering the NEED_CA state.

  For more options, see the getcert start-tracking man page.

Procedure

• To renew a certificate with the Request ID of 20190408143846:

  # getcert resubmit -i 20190408143846

  To obtain the Request ID for a specific certificate, use the getcert list command. For details, see the getcert list man page.

Prerequisites

• The host on which you want to resume tracking system certificates is an IdM server that is also an IdM certificate authority (CA) but not the IdM CA renewal master.

Additional resources

• If your IdM system certificates have all expired, follow the procedure described in this Knowledge Centered Support (KCS) solution to manually renew IdM system certificates on the IdM CA master that is also the CA renewal master and the CRL generation master. Then follow the procedure described in this KCS solution to manually renew IdM system certificates on all the other CA servers in the topology.