[Freeipa-users] Re: Really old (expired) certificates showing up in ipa service-find and in the web ui

[Florence Blanc-Renaud]

Hi,

On Thu, Jul 4, 2024 at 10:18 AM Thomas Boroske via FreeIPA-users <
[e-mail]> wrote:
> Dear Mailing List,
>
> we are running a freeipa installation using two ipa master servers.
> Neither the dns feature nor the CA feature are being used.
> VERSION: 4.6.8, API_VERSION: 2.237
>
> Both ipa servers have ssl/tls certs associated with them that are signed
> by an external CA.
>
> Since these certs expire after 12 month, I had to install new certificates
> multiple times, and I have been doing that using
> ipa-server-certinstall -w -d ipa1.p12
>
> This usually works. as in, the new cert shows up in the IPA web ui and the
> ipa tools (at least some of which work via the https interface) also
> continue to work.
>
> However, I just noticed that the certificates being displayed for the ipa
> servers both in ipa service-find and in the IPA web UI are old certs that
> are long expired (in 2021).
>
> So my question is
>
> a) Why is this the case, isn't ipa-serrver-certinstall supposed to take
> care of it?

This is a known issue, reported at #9417
https://pagure.io/freeipa/issue/9417 ipa-server-certinstall does not
update service entries in LDAP
Work started at https://github.com/freeipa/freeipa/pull/6920 but other
tasks with higher priority came in and delayed the fix.

flo

b) Why is it still working like that?
> c) Why are the certs that are actually used for the web interface not
> visible anywhere, or where are they?
>
> Do I maybe need to use the option -k (for kdc) too when doing
> ipa-server-certinstall?
> If so, can I fix it now by just re-running with that option?
> Are there risks in doing so?
>
> My understanding if FreeIPA is spotty I have to say as there are multiple
> complex technologies put together (kerberos, ldap, ...).
>
> Many thanks for any help,
> Thomas
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue