Chapter 14. Renewing expired system certificates when IdM is offline If a system certificate has expired, Identity Management (IdM) fails to start. IdM supports renewing system certificates even in this situation by using the ipa-cert-fix tool. Ensure that the LDAP service is running by entering the ipactl start --ignore-service-failures command on the host. 14.1. Renewing expired system certificates on a CA renewal server Follow this procedure to apply the ipa-cert-fix tool on expired IdM certificates. Important If you run the ipa-cert-fix tool on a CA (Certificate Authority) host that is not the CA renewal server, and the utility renews shared certificates, that host automatically becomes the new CA renewal server in the domain. There must always be only one CA renewal server in the domain to avoid inconsistencies. Prerequisites Log in to the server with administration rights Procedure Optional: Backup the system. This is heavily recommended, as ipa-cert-fix makes irreversible changes to nssdbs . Because ipa-cert-fix also makes changes to the LDAP, it is recommended to backup the entire cluster as well. Start the ipa-cert-fix tool to analyze the system and list expired certificates that require renewal: Enter yes to start the renewal process: It can take up to one minute before ipa-cert-fix renews all expired certificates. Verification Verify that all services are now running: At this point, certificates have been renewed and services are running. The step is to check other servers in the IdM domain. Note If you need to repair certificates across multiple CA servers: After ensuring that LDAP replication is working across the topology, first run ipa-cert-fix on one CA server, according to the above procedure. Before you run ipa-cert-fix on another CA server, trigger Certmonger renewals for shared certificates via getcert-resubmit (on the other CA server), to avoid unnecessary renewal of shared certificates. 14.2. Verifying other IdM servers in the IdM domain after renewal After the renewing the CA renewal server's certificates with the ipa-cert-fix tool, you must: Restart all other Identity Management (IdM) servers in the domain. Check if certmonger renewed certificates. If there are other Certificate Authority (CA) replicas with expired system certificates, renew those certificates with the ipa-cert-fix tool as well. Prerequisites Log in to the server with administration rights. Procedure Restart IdM with the --force parameter: With the --force parameter, the ipactl utility ignores individual service startup failures. For example, if the server is also a CA with expired certificates, the pki-tomcat service fails to start. This is expected and ignored because of using the --force parameter. After the restart, verify that the certmonger service renewed the certificates (certificate status says MONITORING): It can take some time before certmonger renews the shared certificates on the replica. If the server is also a CA, the command reports CA_UNREACHABLE for the certificate the pki-tomcat service uses: To renew this certificate, use the ipa-cert-fix utility: Now, all IdM certificates have been renewed and work correctly.

Commands:
ipa-cert-fix The following certificates will be renewed: Dogtag sslserver certificate: Subject: CN=ca1.example.com,O=EXAMPLE.COM 201905222205 Serial: 13 Expires: 2019-05-12 05:55:47 Enter "yes" to proceed:
Enter "yes" to proceed: true Proceeding. Renewed Dogtag sslserver certificate: Subject: CN=ca1.example.com,O=EXAMPLE.COM 201905222205 Serial: 268369925 Expires: 2021-08-14 02:19:33 Becoming renewal master. The ipa-cert-fix command was successful
ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa: INFO: The ipactl command was successful
ipactl restart --force
getcert list | egrep '^Request|status:|subject:' Request ID '20190522120745': status: MONITORING subject: CN=IPA RA,O=EXAMPLE.COM 201905222205 Request ID '20190522120834': status: MONITORING subject: CN=Certificate Authority,O=EXAMPLE.COM 201905222205
Request ID '20190522120835': status: CA_UNREACHABLE subject: CN=ca2.example.com,O=EXAMPLE.COM 201905222205
ipa-cert-fix Dogtag sslserver certificate: Subject: CN=ca2.example.com,O=EXAMPLE.COM Serial: 3 Expires: 2019-05-11 12:07:11 Enter "yes" to proceed: true Proceeding. Renewed Dogtag sslserver certificate: Subject: CN=ca2.example.com,O=EXAMPLE.COM 201905222205 Serial: 15 Expires: 2019-08-14 04:25:05 The ipa-cert-fix command was successful