Chapter 10. Verifying certificates using IdM Healthcheck Learn more about understanding and using the Healthcheck tool in Identity management (IdM) to identify issues with IPA certificates maintained by certmonger . For details, see Healthcheck in IdM . Prerequisites The Healthcheck tool is only available in RHEL 8.1 and newer. 10.1. IdM certificates Healthcheck tests The Healthcheck tool includes several tests for verifying the status of certificates maintained by certmonger in Identity Management (IdM). For details about certmonger, see Obtaining an IdM certificate for a service using certmonger . This suite of tests checks expiration, validation, trust and other issues. Multiple errors may be thrown for the same underlying issue. To see all certificate tests, run the ipa-healthcheck with the --list-sources option: You can find all tests under the ipahealthcheck.ipa.certs source: IPACertmongerExpirationCheck This test checks expirations in certmonger . If an error is reported, the certificate has expired. If a warning appears, the certificate will expire soon. By default, this test applies within 28 days or fewer days before certificate expiration. You can configure the number of days in the /etc/ipahealthcheck/ipahealthcheck.conf file. After opening the file, change the cert_expiration_days option located in the default section. Note Certmonger loads and maintains its own view of the certificate expiration. This check does not validate the on-disk certificate. IPACertfileExpirationCheck This test checks if the certificate file or NSS database cannot be opened. This test also checks expiration. Therefore, carefully read the msg attribute in the error or warning output. The message specifies the problem. Note This test checks the on-disk certificate. If a certificate is missing, unreadable, etc a separate error can also be raised. IPACertNSSTrust This test compares the trust for certificates stored in NSS databases. For the expected tracked certificates in NSS databases the trust is compared to an expected value and an error raised on a non-match. IPANSSChainValidation This test validates the certificate chain of the NSS certificates. The test executes: certutil -V -u V -e -d [dbdir] -n [nickname] IPAOpenSSLChainValidation This test validates the certificate chain of the OpenSSL certificates. To be comparable to the NSSChain validation here is the OpenSSL command we execute: IPARAAgent This test compares the certificate on disk with the equivalent record in LDAP in uid=ipara,ou=People,o=ipaca . IPACertRevocation This test uses certmonger to verify that certificates have not been revoked. Therefore, the test can find issues connected with certificates maintained by certmonger only. IPACertmongerCA This test verifies the certmonger Certificate Authority (CA) configuration. IdM cannot issue certificates without CA. Certmonger maintains a set of CA helpers. In IdM, there is a CA named IPA which issues certificates through IdM, authenticating as a host or user principal, for host or service certs. There are also dogtag-ipa-ca-renew-agent and dogtag-ipa-ca-renew-agent-reuse which renew the CA subsystem certificates. Note Run these tests on all IdM servers when trying to check for issues. 10.2. Screening certificates using the Healthcheck tool Follow this procedure to run a standalone manual test of an Identity Management (IdM) certificate health check using the Healthcheck tool. The Healthcheck tool includes many tests, therefore, you can shorten the results with: Excluding all successful test: --failures-only Including only certificate tests: --source=ipahealthcheck.ipa.certs Prerequisites You must perform Healthcheck tests as the root user. Procedure To run Healthcheck with warnings, errors and critical issues regarding certificates, enter: Successful test displays empty brackets: Failed test shows you the following output: This IPACertfileExpirationCheck test failed on opening the NSS database. Additional resources See man ipa-healthcheck .

Commands:
ipa-healthcheck --list-sources
openssl verify -verbose -show_chain -CAfile /etc/ipa/ca.crt [cert file]
ipa-healthcheck --source=ipahealthcheck.ipa.certs --failures-only
{ "source": "ipahealthcheck.ipa.certs", "check": "IPACertfileExpirationCheck", "result": "ERROR", "kw": { "key": 1234, "dbdir": "/path/to/nssdb", "error": [error], "msg": "Unable to open NSS database '/path/to/nssdb': [error]" } }