\n\tRestore VM's from snapshot. Yes, this is a new attempt at restoring some FreeIPA hosts that have been, ahem, neglected slightly to the point where things expired and don't work. A few unexpected reboots and FS corruption didn't help the matter either. Regardless, the recovery will in many ways show off the restoration capabilities of.FreeIPA which have certinly grew with the product. Once again we see the following in the debug logs:\n<\/p>\n
\n\t# tail -f \/var\/log\/pki\/pki-tomcat\/ca\/debug -n 200<\/strong> \n\tUse idmipa01<\/strong> to fix certificates. Set idmipa01<\/strong> as renewal master, if not already:\n<\/p>\n \n\t# ipa config-mod \\ \n\tSet idmipa02 as following the renewal master (idmipa01 is designated \/ defacto master in the cluster)\n<\/p>\n \n\t[ idmipa01 ] \n\t[ idmipa02 ] \n\t[ idmipa02 ] \n\tOnce this is done, certs appear with expiration dates as below:\n<\/p>\n \n\t# getcert list|grep -Ei expire<\/strong> \n\tStart the IPA service ignoring failures:\n<\/p>\n \n\t# ipactl restart –ignore-service-failure<\/span><\/strong>\n<\/p>\n \n\tFollow steps on this RH blog:\n<\/p>\n \n\thttps:\/\/access.redhat.com\/solutions\/3357261<\/a>\n<\/p>\n \n\t# systemctl stop ntpd<\/span><\/strong>\n<\/p>\n \n\t# for nickname in "auditSigningCert cert-pki-ca" "ocspSigningCert cert-pki-ca" "subsystemCert cert-pki-ca" "Server-Cert cert-pki-ca" \n\t# systemctl restart certmonger<\/span>\n<\/p>\n \n\tWe are greeted with the following since the site certificate is valid only in the future:\n<\/p>\n \n\t# getcert list|grep -Ei expire<\/strong> \n\t# openssl s_client -showcerts -connect idmipa01.nix.mds.xyz:443<\/strong> \n\t[ …. ]<\/span>\n<\/p>\n \n\tWe notice that the date on the host was set to:\n<\/p>\n \n\tFri Oct 2 20:12:43 EDT 2020<\/span>\n<\/p>\n \n\twhich is pior to the earliest date in the certificates:\n<\/p>\n \n\t# getcert list|grep -Ei expire<\/strong> \n\tHowever, the Apache \/ HTTPD SSL Certificate is only valid after:\n<\/p>\n \n\tnotBefore=Oct 4 23:00:59 2020 GMT<\/span>\n<\/p>\n \n\tSo we either need to update the HTTPD certificate or move the date past Oct 4th 2020. Let's set the date to Oct 4th: \n<\/p>\n \n\t# for nickname in "auditSigningCert cert-pki-ca" "ocspSigningCert cert-pki-ca" "subsystemCert cert-pki-ca" "Server-Cert cert-pki-ca" \n\tRestart certmonger and check status:\n<\/p>\n \n\t# systemctl restart certmonger<\/span><\/strong>\n<\/p>\n \n\tcheck status:\n<\/p>\n \n\t# getcert list<\/span><\/strong>\n<\/p>\n \n\tStill expired. Did some reading:\n<\/p>\n \n\thttps:\/\/frasertweedale.github.io\/blog-redhat\/posts\/2019-05-24-ipa-cert-fix.html<\/a>\n<\/p>\n \n\tand decided to try:\n<\/p>\n \n\t# ipa-cert-fix<\/span><\/strong>\n<\/p>\n \n\t WARNING<\/span>\n<\/p>\n \n\tipa-cert-fix is intended for recovery when expired certificates \n\t \n\tDogtag ca_ocsp_signing certificate: \n\tDogtag ca_audit_signing certificate: \n\tEnter "yes" to proceed: yes \n\tRenewed Dogtag ca_audit_signing certificate: \n\tBecoming renewal master. \n\t \n\t# getcert list|grep -Ei expire<\/strong> \n\tRestart certmonger which now captures correct dates:\n<\/p>\n \n\t# systemctl restart certmonger \n\tRestart IPA services ignoring failures in the process, while still maintaining the reset date of Oct 5th 2020 (Today is Sep 25 2022)\n<\/p>\n \n\t# ipactl restart –ignore-service-failure<\/strong> \n\tThis is the part where I realize the system was using the hwclcok date not the 'date' date (facepalm):\n<\/p>\n \n\t# date<\/strong> \n\tHence why cert dates came back with 2022. Whatever, let's set the date back. It may work but let's check the UI certs. Copy the openssl output certificate portions from above into a file and run the following:\n<\/p>\n \n\t# cat site-cert.pem<\/strong> \n\tCheck the site cert extracted from the above command:\n<\/p>\n \n\t# openssl x509 -enddate -startdate -noout -in site-cert.pem<\/strong> \n\tCert appears good until 2022 Oct 5th which we are not yet in. Let's set the date forwards a tad:\n<\/p>\n \n\t# hwclock –set –date "Fri Sep 25 21:49:00 EDT 2022"; date -s "Fri Sep 25 21:49:00 EDT 2022"<\/strong> \n\tNow try a status and a restart as well:\n<\/p>\n \n\t# ipactl status<\/strong> \n\tBut checking the certs again, seeing two more that are older then Sep 25 2022:\n<\/p>\n \n\t# getcert list|grep -Ei expire<\/strong> \n\tNeed to move the dates back again to a day prior and renew again:\n<\/p>\n \n\t# for nickname in "auditSigningCert cert-pki-ca" "ocspSigningCert cert-pki-ca" "subsystemCert cert-pki-ca" "Server-Cert cert-pki-ca" \n\tWell that above command failed:\n<\/p>\n \n\tSun Oct 4 20:04:58 EDT 2020<\/span>\n<\/p>\n \n\tThere is no certs with that date:\n<\/p>\n \n\t# getcert list|grep -Ei expire \n\tSo let's try a modified copy:\n<\/p>\n \n\t# for nickname in "auditSigningCert cert-pki-ca" "ocspSigningCert cert-pki-ca" "subsystemCert cert-pki-ca" "Server-Cert cert-pki-ca" \n\tSomehow this script is basing this off of the current date? I won't reverse engineer it and set the date manually instead:\n<\/p>\n \n\t# hwclock –set –date "Fri Sep 12 01:00:00 EDT 2022"; date -s "Fri Sep 12 01:00:00 EDT 2022"<\/strong><\/span>\n<\/p>\n \n\tYou should see certificates in submitting status now:\n<\/p>\n \n\t# getcert list<\/strong> \n\tWait a bit and check again if they were successfully processed. Or not:\n<\/p>\n \n\tca-error: Server at https:\/\/idmipa01.nix.mds.xyz\/ipa\/xml failed request, will retry: 907 (RPC failed at server. cannot connect to 'https:\/\/idmipa01.nix.mds.xyz:443\/ca\/rest\/account\/login': [SSL: SSL_HANDSHAKE_FAILURE] ssl handshake failure (_ssl.c:1826)).<\/span>\n<\/p>\n \n\tLet's try the following command again:\n<\/p>\n \n\t# ipa-cert-fix -v<\/span>\n<\/p>\n \n\tBut we get this instead:\n<\/p>\n \n\tINFO: Restoring previous LDAP configuration
\n\tCould not connect to LDAP server host idmipa01.nix.mds.xyz port 636 Error netscape.ldap.LDAPException: Authentication failed (48)
\n\tInternal Database Error encountered: Could not connect to LDAP server host idmipa01.nix.mds.xyz port 636 Error netscape.ldap.LDAPException: Authentication failed (48)
\n\t at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:689)<\/span>\n<\/p>\n
\n\t –ca-renewal-master-server idmipa01.nix.mds.xyz \\
\n\t | grep 'CA renewal master'<\/span><\/strong>\n<\/p>\n
\n\t# ipa config-show | grep 'IPA CA renewal master'<\/strong>
\n\t IPA CA renewal master: idmipa02.nix.mds.xyz<\/span>\n<\/p>\n
\n\t# ipa config-show | grep 'IPA CA renewal master'<\/strong>
\n\t IPA CA renewal master: idmipa02.nix.mds.xyz<\/span>\n<\/p>\n
\n\t# ipa config-mod \\
\n\t –ca-renewal-master-server idmipa01.nix.mds.xyz \\
\n\t | grep 'CA renewal master'<\/strong><\/span>\n<\/p>\n
\n\t expires: 2022-09-12 03:14:57 UTC
\n\t expires: 2020-10-03 20:04:58 UTC
\n\t expires: 2022-09-12 03:13:58 UTC
\n\t expires: 2036-11-21 07:32:02 UTC
\n\t expires: 2022-09-12 03:13:48 UTC
\n\t expires: 2022-09-12 03:13:47 UTC
\n\t expires: 2022-10-05 23:00:29 UTC
\n\t expires: 2022-10-05 23:00:59 UTC
\n\t expires: 2023-09-26 00:54:45 UTC<\/span>\n<\/p>\n
\n\tdo
\n\t certdate=$(date -d "`certutil -L -d \/etc\/pki\/pki-tomcat\/alias -n "${nickname}" | grep -i after | cut -d: -f2-`" +%s )
\n\t echo "$nickname – $certdate"
\n\t [[ ${newdate:-99999999999} -gt “${certdate}” ]] && newdate=$certdate
\n\tdone
\n\tdate –set="`date –date=@$[newdate – 86400]`"<\/span>\n<\/p>\n
\n\t expires: 2020-10-03 20:05:47 UTC
\n\t expires: 2020-10-03 20:04:58 UTC
\n\t expires: 2022-09-12 03:13:58 UTC
\n\t expires: 2036-11-21 07:32:02 UTC
\n\t expires: 2022-09-12 03:13:48 UTC
\n\t expires: 2022-09-12 03:13:47 UTC
\n\t ca-error: Server at https:\/\/idmipa01.nix.mds.xyz\/ipa\/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Peer's Certificate has expired.).
\n\t expires: 2022-10-05 23:00:29 UTC
\n\t ca-error: Server at https:\/\/idmipa01.nix.mds.xyz\/ipa\/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Peer's Certificate has expired.).
\n\t expires: 2022-10-05 23:00:59 UTC
\n\t expires: 2023-09-26 00:54:45 UTC<\/span>\n<\/p>\n
\n\tCONNECTED(00000003)
\n\tdepth=1 O = NIX.MDS.XYZ, CN = Certificate Authority
\n\tverify return:1
\n\tdepth=0 O = NIX.MDS.XYZ, CN = idmipa01.nix.mds.xyz
\n\tverify error:num=9:certificate is not yet valid
\n\tnotBefore=Oct 4 23:00:59 2020 GMT
\n\tverify return:1
\n\tdepth=0 O = NIX.MDS.XYZ, CN = idmipa01.nix.mds.xyz
\n\tnotBefore=Oct 4 23:00:59 2020 GMT
\n\tverify return:1
\n\t—
\n\tCertificate chain
\n\t 0 s:\/O=NIX.MDS.XYZ\/CN=idmipa01.nix.mds.xyz
\n\t i:\/O=NIX.MDS.XYZ\/CN=Certificate Authority<\/span>\n<\/p>\n
\n\t expires: 2020-10-03 20:05:47 UTC
\n\t expires: 2020-10-03 20:04:58 UTC<\/span>\n<\/p>\n
\n\tdo
\n\t certdate=$(date -d "`certutil -L -d \/etc\/pki\/pki-tomcat\/alias -n "${nickname}" | grep -i after | cut -d: -f2-`" +%s )
\n\t echo "$nickname – $certdate"
\n\t [[ ${newdate:-99999999999} -gt “${certdate}” ]] && newdate=$certdate
\n\tdone
\n\tdate –set="`date –date=@$[newdate + 172800]`"<\/span>\n<\/p>\n
\n\tprevent the normal operation of IPA. It should ONLY be used
\n\tin such scenarios, and backup of the system, especially certificates
\n\tand keys, is STRONGLY RECOMMENDED.<\/span>\n<\/p>\n
\n\tThe following certificates will be renewed:<\/span>\n<\/p>\n
\n\t Subject: CN=OCSP Subsystem,O=NIX.MDS.XYZ
\n\t Serial: 17
\n\t Expires: 2020-10-03 20:04:58<\/span>\n<\/p>\n
\n\t Subject: CN=CA Audit,O=NIX.MDS.XYZ
\n\t Serial: 15
\n\t Expires: 2020-10-03 20:05:47<\/span>\n<\/p>\n
\n\tProceeding.
\n\tRenewed Dogtag ca_ocsp_signing certificate:
\n\t Subject: CN=OCSP Subsystem,O=NIX.MDS.XYZ
\n\t Serial: 31
\n\t Expires: 2022-09-26 00:11:14<\/span>\n<\/p>\n
\n\t Subject: CN=CA Audit,O=NIX.MDS.XYZ
\n\t Serial: 32
\n\t Expires: 2022-09-26 00:12:16<\/span>\n<\/p>\n
\n\tThe ipa-cert-fix command was successful<\/span>\n<\/p>\n
\n\tWhich was apparently successful though failed to renew things:\n<\/p>\n
\n\t expires: 2020-10-03 20:05:47 UTC *
\n\t expires: 2020-10-03 20:04:58 UTC *
\n\t expires: 2022-09-12 03:13:58 UTC
\n\t expires: 2036-11-21 07:32:02 UTC
\n\t expires: 2022-09-12 03:13:48 UTC
\n\t expires: 2022-09-12 03:13:47 UTC
\n\t expires: 2022-10-05 23:00:29 UTC
\n\t expires: 2022-10-05 23:00:59 UTC
\n\t expires: 2023-09-26 00:54:45 UTC<\/span>\n<\/p>\n
\n\t# getcert list|grep -Ei expire<\/strong>
\n\t expires: 2022-09-26 00:12:16 UTC *
\n\t expires: 2022-09-26 00:11:14 UTC *
\n\t expires: 2022-09-12 03:13:58 UTC
\n\t expires: 2036-11-21 07:32:02 UTC
\n\t expires: 2022-09-12 03:13:48 UTC
\n\t expires: 2022-09-12 03:13:47 UTC
\n\t expires: 2022-10-05 23:00:29 UTC
\n\t expires: 2022-10-05 23:00:59 UTC
\n\t expires: 2023-09-26 00:54:45 UTC<\/span>\n<\/p>\n
\n\tRestarting Directory Service
\n\tRestarting krb5kdc Service
\n\tRestarting kadmin Service
\n\tRestarting named Service
\n\tRestarting httpd Service
\n\tRestarting ipa-custodia Service
\n\tRestarting ntpd Service
\n\tRestarting pki-tomcatd Service
\n\tRestarting smb Service
\n\tRestarting winbind Service
\n\tRestarting ipa-otpd Service
\n\tRestarting ipa-dnskeysyncd Service
\n\tipa: INFO: The ipactl command was successful<\/span>\n<\/p>\n
\n\tMon Oct 5 20:18:46 EDT 2020
\n\t# hwclock<\/strong>
\n\tSun 25 Sep 2022 09:35:45 PM EDT -0.321095 seconds<\/span>\n<\/p>\n
\n\t—–BEGIN CERTIFICATE—–
\n\tMIIEmzCCA4OgAwI…………………………………………………HIFvjW5pjp58mflhQ==
\n\t—–END CERTIFICATE—–
\n\t 1 s:\/O=NIX.MDS.XYZ\/CN=Certificate Authority
\n\t i:\/O=NIX.MDS.XYZ\/CN=Certificate Authority
\n\t—–BEGIN CERTIFICATE—–
\n\tMIIDkDCC……………………………………………………………..w0T37yu7pbxM
\n\tLGclqw==
\n\t—–END CERTIFICATE—–<\/span>\n<\/p>\n
\n\tnotAfter=Oct 5 23:00:59 2022 GMT
\n\tnotBefore=Oct 4 23:00:59 2020 GMT<\/span>\n<\/p>\n
\n\t# systemctl restart ntpd<\/strong>
\n\t# ntpdate -s 192.168.0.12<\/strong> # My NTP host.<\/span>\n<\/p>\n
\n\tDirectory Service: RUNNING
\n\tkrb5kdc Service: RUNNING
\n\tkadmin Service: RUNNING
\n\tnamed Service: RUNNING
\n\thttpd Service: RUNNING
\n\tipa-custodia Service: RUNNING
\n\tntpd Service: RUNNING
\n\tpki-tomcatd Service: RUNNING
\n\tsmb Service: RUNNING
\n\twinbind Service: RUNNING
\n\tipa-otpd Service: RUNNING
\n\tipa-dnskeysyncd Service: RUNNING
\n\tipa: INFO: The ipactl command was successful<\/span>\n<\/p>\n
\n\t expires: 2022-09-26 00:12:16 UTC
\n\t expires: 2022-09-26 00:11:14 UTC
\n\t expires: 2022-09-12 03:13:58 UTC *
\n\t expires: 2036-11-21 07:32:02 UTC
\n\t expires: 2022-09-12 03:13:48 UTC *
\n\t expires: 2022-09-12 03:13:47 UTC *
\n\t expires: 2022-10-05 23:00:29 UTC
\n\t expires: 2022-10-05 23:00:59 UTC
\n\t expires: 2023-09-26 00:54:45 UTC<\/span>\n<\/p>\n
\n\tdo
\n\t certdate=$(date -d "`certutil -L -d \/etc\/pki\/pki-tomcat\/alias -n "${nickname}" | grep -i after | cut -d: -f2-`" +%s )
\n\t echo "$nickname – $certdate"
\n\t [[ ${newdate:-99999999999} -gt “${certdate}” ]] && newdate=$certdate
\n\tdone
\n\tdate –set="`date –date=@$[newdate + 86400]`"<\/span>\n<\/p>\n
\n\t expires: 2022-09-26 00:12:16 UTC
\n\t expires: 2022-09-26 00:11:14 UTC
\n\t expires: 2022-09-12 03:13:58 UTC
\n\t expires: 2036-11-21 07:32:02 UTC
\n\t expires: 2022-09-12 03:13:48 UTC
\n\t expires: 2022-09-12 03:13:47 UTC
\n\t expires: 2022-10-05 23:00:29 UTC
\n\t expires: 2022-10-05 23:00:59 UTC
\n\t expires: 2023-09-26 00:54:45 UTC<\/span>\n<\/p>\n
\n\tdo
\n\t certdate=$(certutil -L -d \/etc\/pki\/pki-tomcat\/alias -n "${nickname}" | grep -i after)
\n\t echo $certdate;
\n\tdone<\/span>\n<\/p>\n
\n\tNumber of certificates and requests being tracked: 9.
\n\tRequest ID '20180122053031':
\n\t status: SUBMITTING
\n\t stuck: no
\n\t key pair storage: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
\n\t certificate: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
\n\t CA: dogtag-ipa-ca-renew-agent
\n\t issuer: CN=Certificate Authority,O=NIX.MDS.XYZ
\n\t subject: CN=CA Audit,O=NIX.MDS.XYZ
\n\t expires: 2022-09-26 00:12:16 UTC
\n\t key usage: digitalSignature,nonRepudiation
\n\t pre-save command: \/usr\/libexec\/ipa\/certmonger\/stop_pkicad
\n\t post-save command: \/usr\/libexec\/ipa\/certmonger\/renew_ca_cert "auditSigningCert cert-pki-ca"
\n\t track: yes
\n\t auto-renew: yes
\n\tRequest ID '20180122053032':
\n\t status: MONITORING
\n\t stuck: no
\n\t key pair storage: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
\n\t certificate: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
\n\t CA: dogtag-ipa-ca-renew-agent
\n\t issuer: CN=Certificate Authority,O=NIX.MDS.XYZ
\n\t subject: CN=OCSP Subsystem,O=NIX.MDS.XYZ
\n\t expires: 2022-09-26 00:11:14 UTC
\n\t eku: id-kp-OCSPSigning
\n\t pre-save command: \/usr\/libexec\/ipa\/certmonger\/stop_pkicad
\n\t post-save command: \/usr\/libexec\/ipa\/certmonger\/renew_ca_cert "ocspSigningCert cert-pki-ca"
\n\t track: yes
\n\t auto-renew: yes
\n\tRequest ID '20180122053033':
\n\t status: MONITORING
\n\t stuck: no
\n\t key pair storage: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
\n\t certificate: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
\n\t CA: dogtag-ipa-ca-renew-agent
\n\t issuer: CN=Certificate Authority,O=NIX.MDS.XYZ
\n\t subject: CN=CA Subsystem,O=NIX.MDS.XYZ
\n\t expires: 2022-09-12 03:13:58 UTC
\n\t key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
\n\t eku: id-kp-serverAuth,id-kp-clientAuth
\n\t pre-save command: \/usr\/libexec\/ipa\/certmonger\/stop_pkicad
\n\t post-save command: \/usr\/libexec\/ipa\/certmonger\/renew_ca_cert "subsystemCert cert-pki-ca"
\n\t track: yes
\n\t auto-renew: yes
\n\tRequest ID '20180122053034':
\n\t status: MONITORING
\n\t stuck: no
\n\t key pair storage: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
\n\t certificate: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
\n\t CA: dogtag-ipa-ca-renew-agent
\n\t issuer: CN=Certificate Authority,O=NIX.MDS.XYZ
\n\t subject: CN=Certificate Authority,O=NIX.MDS.XYZ
\n\t expires: 2036-11-21 07:32:02 UTC
\n\t key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
\n\t pre-save command: \/usr\/libexec\/ipa\/certmonger\/stop_pkicad
\n\t post-save command: \/usr\/libexec\/ipa\/certmonger\/renew_ca_cert "caSigningCert cert-pki-ca"
\n\t track: yes
\n\t auto-renew: yes
\n\tRequest ID '20180122053035':
\n\t status: SUBMITTING
\n\t stuck: no
\n\t key pair storage: type=FILE,location='\/var\/lib\/ipa\/ra-agent.key'
\n\t certificate: type=FILE,location='\/var\/lib\/ipa\/ra-agent.pem'
\n\t CA: dogtag-ipa-ca-renew-agent
\n\t issuer: CN=Certificate Authority,O=NIX.MDS.XYZ
\n\t subject: CN=IPA RA,O=NIX.MDS.XYZ
\n\t expires: 2022-09-12 03:13:48 UTC
\n\t key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
\n\t eku: id-kp-serverAuth,id-kp-clientAuth
\n\t pre-save command: \/usr\/libexec\/ipa\/certmonger\/renew_ra_cert_pre
\n\t post-save command: \/usr\/libexec\/ipa\/certmonger\/renew_ra_cert
\n\t track: yes
\n\t auto-renew: yes
\n\tRequest ID '20180122053036':
\n\t status: MONITORING
\n\t stuck: no
\n\t key pair storage: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
\n\t certificate: type=NSSDB,location='\/etc\/pki\/pki-tomcat\/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
\n\t CA: dogtag-ipa-ca-renew-agent
\n\t issuer: CN=Certificate Authority,O=NIX.MDS.XYZ
\n\t subject: CN=idmipa01.nix.mds.xyz,O=NIX.MDS.XYZ
\n\t expires: 2022-09-12 03:13:47 UTC
\n\t key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
\n\t eku: id-kp-serverAuth,id-kp-clientAuth
\n\t pre-save command: \/usr\/libexec\/ipa\/certmonger\/stop_pkicad
\n\t post-save command: \/usr\/libexec\/ipa\/certmonger\/renew_ca_cert "Server-Cert cert-pki-ca"
\n\t track: yes
\n\t auto-renew: yes
\n\tRequest ID '20180122053037':
\n\t status: SUBMITTING
\n\t stuck: no
\n\t key pair storage: type=NSSDB,location='\/etc\/dirsrv\/slapd-NIX-MDS-XYZ',nickname='Server-Cert',token='NSS Certificate DB',pinfile='\/etc\/dirsrv\/slapd-NIX-MDS-XYZ\/pwdfile.txt'
\n\t certificate: type=NSSDB,location='\/etc\/dirsrv\/slapd-NIX-MDS-XYZ',nickname='Server-Cert',token='NSS Certificate DB'
\n\t CA: IPA
\n\t issuer: CN=Certificate Authority,O=NIX.MDS.XYZ
\n\t subject: CN=idmipa01.nix.mds.xyz,O=NIX.MDS.XYZ
\n\t expires: 2022-10-05 23:00:29 UTC
\n\t principal name: ldap\/idmipa01.nix.mds.xyz@NIX.MDS.XYZ
\n\t key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
\n\t eku: id-kp-serverAuth,id-kp-clientAuth
\n\t pre-save command:
\n\t post-save command: \/usr\/libexec\/ipa\/certmonger\/restart_dirsrv NIX-MDS-XYZ
\n\t track: yes
\n\t auto-renew: yes
\n\tRequest ID '20180122053042':
\n\t status: SUBMITTING
\n\t stuck: no
\n\t key pair storage: type=NSSDB,location='\/etc\/httpd\/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='\/etc\/httpd\/alias\/pwdfile.txt'
\n\t certificate: type=NSSDB,location='\/etc\/httpd\/alias',nickname='Server-Cert',token='NSS Certificate DB'
\n\t CA: IPA
\n\t issuer: CN=Certificate Authority,O=NIX.MDS.XYZ
\n\t subject: CN=idmipa01.nix.mds.xyz,O=NIX.MDS.XYZ
\n\t expires: 2022-10-05 23:00:59 UTC
\n\t principal name: HTTP\/idmipa01.nix.mds.xyz@NIX.MDS.XYZ
\n\t key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
\n\t eku: id-kp-serverAuth,id-kp-clientAuth
\n\t pre-save command:
\n\t post-save command: \/usr\/libexec\/ipa\/certmonger\/restart_httpd
\n\t track: yes
\n\t auto-renew: yes
\n\tRequest ID '20180122053135':
\n\t status: MONITORING
\n\t stuck: no
\n\t key pair storage: type=FILE,location='\/var\/kerberos\/krb5kdc\/kdc.key'
\n\t certificate: type=FILE,location='\/var\/kerberos\/krb5kdc\/kdc.crt'
\n\t CA: SelfSign
\n\t issuer: CN=idmipa01.nix.mds.xyz,O=NIX.MDS.XYZ
\n\t subject: CN=idmipa01.nix.mds.xyz,O=NIX.MDS.XYZ
\n\t expires: 2023-09-26 00:54:45 UTC
\n\t principal name: krbtgt\/NIX.MDS.XYZ@NIX.MDS.XYZ
\n\t certificate template\/profile: KDCs_PKINIT_Certs
\n\t pre-save command:
\n\t post-save command: \/usr\/libexec\/ipa\/certmonger\/renew_kdc_cert
\n\t track: yes
\n\t auto-renew: yes<\/span>\n<\/p>\n
\n\tERROR: Unable to find CSR for sslserver cert<\/span>\n<\/p>\n