Chapter 17. Generating CRL on the IdM CA server If your IdM deployment uses an embedded certificate authority (CA), you may need to move generating the Certificate Revocation List (CRL) from one Identity Management (IdM) server to another. It can be necessary, for example, when you want to migrate the server to another system. Only configure one server to generate the CRL. The IdM server that performs the CRL publisher role is usually the same server that performs the CA renewal server role, but this is not mandatory. Before you decommission the CRL publisher server, select and configure another server to perform the CRL publisher server role. 17.1. Stopping CRL generation on an IdM server To stop generating the Certificate Revocation List (CRL) on the IdM CRL publisher server, use the ipa-crlgen-manage command. Before you disable the generation, verify that the server really generates CRL. You can then disable it. Prerequisites You must be logged in as root. Procedure Check if your server is generating the CRL: Stop generating the CRL on the server: Check if the server stopped generating CRL: The server stopped generating the CRL. The step is to enable CRL generation on the IdM replica. 17.2. Starting CRL generation on an IdM replica server You can start generating the Certificate Revocation List (CRL) on an IdM CA server with the ipa-crlgen-manage command. Prerequisites The RHEL system must be an IdM Certificate Authority server. You must be logged in as root. Procedure Start generating the CRL: Check if the CRL is generated: 17.3. Changing the CRL update interval The Certificate Revocation List (CRL) file is automatically generated by the Identity Management Certificate Authority (Idm CA) every four hours by default. You can change this interval with the following procedure. Procedure Stop the CRL generation server: Open the /var/lib/pki/pki-tomcat/conf/ca/CS.cfg file, and change the ca.crl.MasterCRL.autoUpdateInterval value to the new interval setting. For example, to generate the CRL every 60 minutes: Note If you update the ca.crl.MasterCRL.autoUpdateInterval parameter, the change will become effective after the already scheduled CRL update. Start the CRL generation server: Additional resources For more information about the CRL generation on an IdM replica server, see Starting CRL generation on an IdM replica server .

Commands:
ipa-crlgen-manage status CRL generation: enabled Last CRL update: 2019-10-31 12:00:00 Last CRL Number: 6 The ipa-crlgen-manage command was successful
ipa-crlgen-manage disable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable. The ipa-crlgen-manage command was successful
ipa-crlgen-manage status
ipa-crlgen-manage enable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd Forcing CRL update CRL generation enabled on the local host. Please make sure to have only a single CRL generation master. The ipa-crlgen-manage command was successful
ipa-crlgen-manage status CRL generation: enabled Last CRL update: 2019-10-31 12:10:00 Last CRL Number: 7 The ipa-crlgen-manage command was successful
systemctl stop pki-tomcatd@pki-tomcat.service
ca.crl.MasterCRL.autoUpdateInterval= 60
systemctl start pki-tomcatd@pki-tomcat.service