| Renouvellement des certificats sur FreeIPA |
| Article original Publié le : 21 novembre 2020 Mise a jour le : – |
Par défaut les certificats sont en auto-renew via le service certmonger qui essayera de renouveler le certificat 28 jours avant son expiration
https://www.freeipa.org/page/Certmonger
Si le certificat venait a ne pas être renouvelé il est possible de le faire manuellement
- Avant la date d’échéance
- Après la date d’échéance, il faudra revenir a une date inférieur a une semaine avant expiration
Commencer par lister la validité des certificats, cette commande liste l’ensemble de tous les serveurs d’une ferme
|
1 |
# ipa cert-find |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
----------------------------- 56 certificats correspondants ----------------------------- AC émettrice: ipa Sujet: CN=Izero Izero Root,OU=0002 888888888,O=Izero,C=LAN Émetteur: CN=Izero Izero Root,OU=0002 888888888,O=Izero,C=LAN Pas avant: Tue Dec 18 13:49:37 2018 UTC Pas après: Sat Dec 18 13:49:37 2038 UTC Numéro de série: 1 Numéro de série (hex): 0x1 État: VALID Révoqué: False AC émettrice: ipa Sujet: CN=OCSP Subsystem,O=IZERO.LAN Émetteur: CN=Izero Izero Root,OU=0002 888888888,O=Izero,C=LAN Pas avant: Tue Dec 18 13:49:39 2018 UTC Pas après: Mon Dec 07 13:49:39 2020 UTC Numéro de série: 2 Numéro de série (hex): 0x2 État: VALID Révoqué: False |
Puis récupérer les id des certificats en vu de leur renouvellement, cette commande est a lancer sur chaque serveur si il y a une ferme
|
1 |
# getcert list |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
<span class="code-object">Number</span> of certificates and requests being tracked: 9. Request ID <span class="code-quote">'20191219160709'</span>: status: MONITORING stuck: no key pair storage: type=NSSDB,location=<span class="code-quote">'/etc/dirsrv/slapd-IZERO-LAN'</span>,nickname=<span class="code-quote">'Server-Cert'</span>,token=<span class="code-quote">'NSS Certificate DB'</span>,pinfile=<span class="code-quote">'/etc/dirsrv/slapd-IZERO-LAN/pwdfile.txt'</span> certificate: type=NSSDB,location=<span class="code-quote">'/etc/dirsrv/slapd-IZERO-LAN'</span>,nickname=<span class="code-quote">'Server-Cert'</span>,token=<span class="code-quote">'NSS Certificate DB'</span> CA: IPA issuer: CN=Izero Izero Root,OU=0002 888888888,O=Izero,C=LAN subject: CN=srv-freeipa.izero.lan,O=IZERO.LAN expires: 2021-12-19 16:07:10 UTC dns: srv-freeipa.izero.lan principal name: ldap/srv-freeipa.izero.lan@IZERO.LAN key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IZERO-LAN track: yes auto-renew: yes Request ID <span class="code-quote">'20191219160749'</span>: status: MONITORING stuck: no key pair storage: type=NSSDB,location=<span class="code-quote">'/etc/httpd/alias'</span>,nickname=<span class="code-quote">'Server-Cert'</span>,token=<span class="code-quote">'NSS Certificate DB'</span>,pinfile=<span class="code-quote">'/etc/httpd/alias/pwdfile.txt'</span> certificate: type=NSSDB,location=<span class="code-quote">'/etc/httpd/alias'</span>,nickname=<span class="code-quote">'Server-Cert'</span>,token=<span class="code-quote">'NSS Certificate DB'</span> CA: IPA issuer: CN=Izero Izero Root,OU=0002 888888888,O=Izero,C=LAN subject: CN=srv-freeipa.izero.lan,O=IZERO.LAN expires: 2021-12-19 16:07:50 UTC dns: srv-freeipa.izero.lan principal name: HTTP/srv-freeipa.izero.lan@IZERO.LAN key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes |
Renouvellement des certificats sur un serveur Freeipa en version égale ou inférieur a VERSION: 4.6.4
Pour régénérer un certificat en cours il faut récupérer l’ID du certificat et lancer la commande renouvellement ipa-getcert resubmit
/!\ Dans le cadre d’un certificat expiré, il faudra revenir a une semaine avant l’expiration avant de lancer la commande
|
1 |
# getcert list |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
Number of certificates and requests being tracked: 9. Request ID '<strong>20180913164631</strong>': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IZERO-LAN',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IZERO-LAN/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-IZERO-LAN',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=IZERO.LAN subject: CN=srv-freeipa.izero.lan,O=IZERO.LAN expires: <span style="color: #ff0000;">2022-08-17 22:12:46 UTC</span> dns: srv-freeipa.izero.lan principal name: ldap/srv-freeipa.izero.lan@IZERO.LAN key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IZERO-LAN track: yes auto-renew: yes |
|
1 |
# ipa-getcert resubmit -i <strong>20180913164631</strong> |
|
1 |
Resubmitting "<strong>20180913164631</strong>" to "IPA". |
|
1 |
# getcert list |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
Number of certificates and requests being tracked: 9. Request ID '<strong>20180913164631</strong>': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IZERO-LAN',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IZERO-LAN/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-IZERO-LAN',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=IZERO.LAN subject: CN=srv-freeipa.izero.lan,O=IZERO.LAN expires: <span style="color: #ff0000;">2022-11-21 10:00:09 UTC</span> dns: srv-freeipa.izero.lan principal name: ldap/srv-freeipa.izero.lan@IZERO.LAN key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IZERO-LAN track: yes auto-renew: yes |
Renouvellement des certificats sur un serveur Freeipa en version égale ou supérieur a VERSION: 4.6.5
Le renouvellement par ID comme vu ci dessus est toujours valide et la version 4.6.5 intègre une nouvelle commande ipa-cert-fix qui permet de régénérer l’ensemble des certificats présents sur le serveur
Efficace dans le cadre d’un serveur dont les certificats sont expirés et qui ne répond plus
|
1 |
# ipa-cert-fix |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 |
WARNING ipa-cert-fix is intended <span class="code-keyword">for</span> recovery when expired certificates prevent the normal operation of IPA. It should ONLY be used in such scenarios, and backup of the system, especially certificates and keys, is STRONGLY RECOMMENDED. The following certificates will be renewed: Dogtag sslserver certificate: Subject: CN=srv-freeipa.izero.lan,O=IZERO.LAN Serial: 25 Expires: <span style="color: #ff0000;">2020-05-07 12:33:16</span> Dogtag subsystem certificate: Subject: CN=CA Subsystem,O=IZERO.LAN Serial: 4 Expires: <span style="color: #ff0000;">2020-03-10 17:24:54</span> Dogtag ca_ocsp_signing certificate: Subject: CN=OCSP Subsystem,O=IZERO.LAN Serial: 2 Expires: <span style="color: #ff0000;">2020-03-10 17:24:54</span> Dogtag ca_audit_signing certificate: Subject: CN=CA Audit,O=IZERO.LAN Serial: 5 Expires: <span style="color: #ff0000;">2020-03-10 17:24:54</span> IPA IPA RA certificate: Subject: CN=IPA RA,O=IZERO.LAN Serial: 7 Expires: <span style="color: #ff0000;">2020-03-10 17:25:1</span>3 <strong>Enter <span class="code-quote">"yes"</span> to proceed:</strong> <span style="color: #ff0000;">yes</span> Proceeding. Renewed Dogtag sslserver certificate: Subject: CN=srv-freeipa.izero.lan,O=IZERO.LAN Serial: 268304394 Expires: <span style="color: #ff0000;">2022-11-09 21:07:37</span> Renewed Dogtag subsystem certificate: Subject: CN=CA Subsystem,O=IZERO.LAN Serial: 268304395 Expires: <span style="color: #ff0000;">2022-11-09 21:07:38</span> Renewed Dogtag ca_ocsp_signing certificate: Subject: CN=OCSP Subsystem,O=IZERO.LAN Serial: 268304396 Expires: <span style="color: #ff0000;">2022-11-09 21:07:38</span> Renewed Dogtag ca_audit_signing certificate: Subject: CN=CA Audit,O=IZERO.LAN Serial: 268304397 Expires: <span style="color: #ff0000;">2022-11-09 21:07:38</span> Renewed IPA IPA RA certificate: Subject: CN=IPA RA,O=IZERO.LAN Serial: 268304398 Expires: <span style="color: #ff0000;">2022-11-09 21:07:38</span> Becoming renewal master. The ipa-cert-fix command was successful |
Un peu de doc
https://access.redhat.com/solutions/1605213
https://www.freeipa.org/page/Troubleshooting/PKI → https://lanasertweedale.github.lan/blog-redhat/posts/2019-05-24-ipa-cert-fix.html