Bug 624142

Verified

RHEL version:

[root@localhost ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 6.1 Beta (Santiago)

Certmonger version:

[root@localhost ~]# rpm -qi certmonger | head
Name        : certmonger                   Relocations: (not relocatable)
Version     : 0.34                              Vendor: Red Hat, Inc.
Release     : 1.el6                         Build Date: Fri 14 Jan 2011 08:30:16 PM IST
Install Date: Wed 09 Mar 2011 05:25:48 PM IST      Build Host: x86-004.build.bos.redhat.com
Group       : System Environment/Daemons    Source RPM: certmonger-0.34-1.el6.src.rpm
Size        : 683642                           License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://certmonger.fedorahosted.org
Summary     : Certificate status monitor and PKI enrollment client


Steps used to verify:
(1)install and configure ipa-server with default values(it will also install certmonger since it is a dependency) 
  #yum install ipa-server ipa-client ipa-admintools bind caching-nameserver expect krb5-workstation bind-dyndb-ldap ntpdate krb5-pkinit-openssl
  #ipa-server-install -N --setup-dns (accept all default values and proceed)

(2)started certmonger service
   #service certmonger start

(3)issuing a certificate

[root@jupiter kaleem]# ipa-getcert request -d /tmp/kaleem/ -n test 
New signing request "20110310140151" added.

(4)looking at the certificate status

[root@jupiter kaleem]# ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20110310140151':
	status: MONITORING
	stuck: no
	key pair storage: type=NSSDB,location='/tmp/kaleem',nickname=test
	certificate: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	CA: IPA
	issuer: CN=Certificate Authority,O=LAB.ENG.PNQ.REDHAT.COM
	subject: CN=jupiter.lab.eng.pnq.redhat.com,O=LAB.ENG.PNQ.REDHAT.COM
	expires: 20110906140153
	eku: id-kp-serverAuth
	track: yes
	auto-renew: yes

(5)chaning the date so certificate expires

[root@jupiter kaleem]# date -s "11 MAR 2012 19:21:00"
Sun Mar 11 19:21:00 IST 2012

(6)looking at the status after date change

[root@jupiter kaleem]# ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20110310140151':
	status: CA_UNREACHABLE
	ca-error: Server failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates).
	stuck: yes
	key pair storage: type=NSSDB,location='/tmp/kaleem',nickname=test
	certificate: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	CA: IPA
	issuer: CN=Certificate Authority,O=LAB.ENG.PNQ.REDHAT.COM
	subject: CN=jupiter.lab.eng.pnq.redhat.com,O=LAB.ENG.PNQ.REDHAT.COM
	expires: 20110906140153
	eku: id-kp-serverAuth
	track: yes
	auto-renew: yes
  
   It shows status as CA_UNREACHABLE.

(5)resetting the date now

[root@jupiter kaleem]# date -s "10 MAR 2011 19:48:00"
Thu Mar 10 19:48:00 IST 2011

(6)certificate status after re-setting the date

[root@jupiter kaleem]# ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20110310140151':
	status: CA_UNREACHABLE
	ca-error: Server failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates).
	stuck: yes
	key pair storage: type=NSSDB,location='/tmp/kaleem',nickname=test
	certificate: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	CA: IPA
	issuer: CN=Certificate Authority,O=LAB.ENG.PNQ.REDHAT.COM
	subject: CN=jupiter.lab.eng.pnq.redhat.com,O=LAB.ENG.PNQ.REDHAT.COM
	expires: 20110906140153
	eku: id-kp-serverAuth
	track: yes
	auto-renew: yes

 Its still CA_UNREACHABLE

(7)now resubmitting the request(twice as mentioned in #comment 1 of bug)

[root@jupiter kaleem]# ipa-getcert resubmit -i 20110310140151
Resubmitting "20110310140151" to "IPA".
[root@jupiter kaleem]# ipa-getcert resubmit -i 20110310140151
Resubmitting "20110310140151" to "IPA".

(8)checking the status of certificate

 [root@jupiter kaleem]# ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20110310140151':
	status: MONITORING
	stuck: no
	key pair storage: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	certificate: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	CA: IPA
	issuer: CN=Certificate Authority,O=LAB.ENG.PNQ.REDHAT.COM
	subject: CN=jupiter.lab.eng.pnq.redhat.com,O=LAB.ENG.PNQ.REDHAT.COM
	expires: 20110906142059
	eku: id-kp-serverAuth
	track: yes
	auto-renew: yes

    Now certmonger starts monitoring the certificate

(9)ran command ps -ef and did not find any defunct process of ipa-resubmit 

[root@jupiter kaleem]# ps -ef|grep -i ipa-submit
root     29763 26016  0 20:22 pts/2    00:00:00 grep -i ipa-submit

Result:
Now there is no defunct process left in current processes list.

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
If the certmonger service failed to contact a CA, the subprocess that submitted the request became defunct. This occurred because the parent process did not read the subprocess status. With this update, the parent process reads the subprocess status and there is no defunct process after a CA contact failure.

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0570.html