Russell Jones via FreeIPA-users wrote: > Hi all, > > I have a replica that, while offline due to maintenance, some > certificates appear to have been auto renewed. Upon bringing the node > back online the ipa-healthcheck script showed several errors that were > fixed by re-initializing the replica. > > However, the following errors were not fixed by reinitializing: > > > [root@freeipa4 ~]# ipa-healthcheck --output-type human --failures-only | > grep -v ipahealthcheck.ipa.idns > WARNING: > ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20200130170451: > Request id 20200130170451 expires in 26 days > WARNING: > ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20200130170452: > Request id 20200130170452 expires in 26 days > WARNING: > ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20200130170453: > Request id 20200130170453 expires in 26 days > WARNING: > ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20200130170451: > Request id 20200130170451 expires in 26 days > WARNING: > ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20200130170452: > Request id 20200130170452 expires in 26 days > WARNING: > ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20200130170453: > Request id 20200130170453 expires in 26 days > > > When I try to use getcert resubmit, it shows either: > > freeipa4 dogtag-ipa-ca-renew-agent-submit: Updated certificate not available > > or > > freeipa4 certmonger: 2021-09-02 15:43:15 [1264] Invalid cookie: u'' > > > Any ideas on how to get this guy healthy again? The CA's in IPA are in dogtag parlance "clones". They share most of the same configuration and certificates. One IPA server is selected, the first installed by default, as the renewal master. It is responsible for renewing the shared certificates and placing the updated contents into LDAP which will then be replicated to the other servers and picked up when renewal is needed. The first message means that an updated certificate is not available. The second message was fixed in IPA 4.9.0 in ticket https://pagure.io/freeipa/issue/8164 What this means is that the updated certificates are not available in LDAP for certmonger to retrieve. They can be found in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX under the nickname for each certificate. rob

Russell Jones wrote: > Okay, thanks! > > Pardon my ignorance, but I am not sure what to do still to resolve the > issue. I have 2 other replicas that picked up the renewed certificate > fine from the renewal master because they were online. > > What do I need to do to get this guy to pick up the renewed certificate? The fact that resubmit says there is no update certificate available suggests that there may still be a problem with replication. I'd look at the LDAP location I provided on a working and non-working server to see if they match. rob > > On Thu, Sep 2, 2021 at 4:03 PM Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Russell Jones via FreeIPA-users wrote: > > Hi all, > > > > I have a replica that, while offline due to maintenance, some > > certificates appear to have been auto renewed. Upon bringing the node > > back online the ipa-healthcheck script showed several errors that were > > fixed by re-initializing the replica. > > > > However, the following errors were not fixed by reinitializing: > > > > > > [root@freeipa4 ~]# ipa-healthcheck --output-type human > --failures-only | > > grep -v ipahealthcheck.ipa.idns > > WARNING: > > ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20200130170451: > > Request id 20200130170451 expires in 26 days > > WARNING: > > ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20200130170452: > > Request id 20200130170452 expires in 26 days > > WARNING: > > ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20200130170453: > > Request id 20200130170453 expires in 26 days > > WARNING: > > ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20200130170451: > > Request id 20200130170451 expires in 26 days > > WARNING: > > ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20200130170452: > > Request id 20200130170452 expires in 26 days > > WARNING: > > ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20200130170453: > > Request id 20200130170453 expires in 26 days > > > > > > When I try to use getcert resubmit, it shows either: > > > > freeipa4 dogtag-ipa-ca-renew-agent-submit: Updated certificate not > available > > > > or > > > > freeipa4 certmonger: 2021-09-02 15:43:15 [1264] Invalid cookie: u'' > > > > > > Any ideas on how to get this guy healthy again? > > The CA's in IPA are in dogtag parlance "clones". They share most of the > same configuration and certificates. > > One IPA server is selected, the first installed by default, as the > renewal master. It is responsible for renewing the shared certificates > and placing the updated contents into LDAP which will then be replicated > to the other servers and picked up when renewal is needed. > > The first message means that an updated certificate is not available. > The second message was fixed in IPA 4.9.0 in ticket > https://pagure.io/freeipa/issue/8164 > > What this means is that the updated certificates are not available in > LDAP for certmonger to retrieve. They can be found in > cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX under the nickname for each > certificate. > > rob >