Chapter 11. Renewing expired system certificates when IdM is offline
When a system certificate has expired, Identity Management (IdM) fails to start. IdM supports renewing system certificates when IdM is offline using the
- IdM is installed only on Red Hat Enterprise Linux 8.1 or later
11.1. Renewing expired system certificates on a CA renewal server
This section describes how to apply the
ipa-cert-fix tool on expired IdM certificates.
If you run the
ipa-cert-fix tool on a CA (Certificate Authority) host that is not the CA renewal server, and the utility renews shared certificates, that host automatically becomes the new CA renewal server in the domain. There must always be only one CA renewal server in the domain to avoid inconsistencies.
- Log in to the server with administration rights
ipa-cert-fixtool to analyze the system and list expired certificates that require renewal:
# ipa-cert-fix ... The following certificates will be renewed: Dogtag sslserver certificate: Subject: CN=ca1.example.com,O=EXAMPLE.COM 201905222205 Serial: 13 Expires: 2019-05-12 05:55:47 ... Enter "yes" to proceed:
yesto start the renewal process:
Enter "yes" to proceed: yes Proceeding. Renewed Dogtag sslserver certificate: Subject: CN=ca1.example.com,O=EXAMPLE.COM 201905222205 Serial: 268369925 Expires: 2021-08-14 02:19:33 ... Becoming renewal master. The ipa-cert-fix command was successful
It can take up to one minute before
ipa-cert-fixrenews all expired certificates.
Optionally, verify that all services are now running:
# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa: INFO: The ipactl command was successful
At this point, certificates have been renewed and services are running. The next step is to check other servers in the IdM domain.
11.2. Verifying other IdM servers in the IdM domain after renewal
After the renewing the CA renewal server’s certificates with the
ipa-cert-fix tool, you must:
- Restart all other Identity Management (IdM) servers in the domain.
- Check if certmonger renewed certificates.
If there are other Certificate Authority (CA) replicas with expired system certificates, renew those certificates with the
ipa-cert-fixtool as well.
- Log in to the server with administration rights.
Restart IdM with the
# ipactl restart --force
ipactlutility ignores individual service startup failures. For example, if the server is also a CA with expired certificates, the
pki-tomcatservice fails to start. This is expected and ignored because of using the
After the restart, verify that the
certmongerservice renewed the certificates (certificate status says MONITORING):
# getcert list | egrep '^Request|status:|subject:' Request ID '20190522120745': status: MONITORING subject: CN=IPA RA,O=EXAMPLE.COM 201905222205 Request ID '20190522120834': status: MONITORING subject: CN=Certificate Authority,O=EXAMPLE.COM 201905222205 ...
It can take some time before
certmongerrenews the shared certificates on the replica.
If the server is also a CA, the previous command reports
CA_UNREACHABLEfor the certificate the
Request ID '20190522120835': status: CA_UNREACHABLE subject: CN=ca2.example.com,O=EXAMPLE.COM 201905222205 ...
To renew this certificate, use the
# ipa-cert-fix Dogtag sslserver certificate: Subject: CN=ca2.example.com,O=EXAMPLE.COM Serial: 3 Expires: 2019-05-11 12:07:11 Enter "yes" to proceed: yes Proceeding. Renewed Dogtag sslserver certificate: Subject: CN=ca2.example.com,O=EXAMPLE.COM 201905222205 Serial: 15 Expires: 2019-08-14 04:25:05 The ipa-cert-fix command was successful
Now, all IdM certificates have been renewed and work correctly.