Bug 782968

Summary:	[RFE] Email notify Admin prior to CA certificate expiration
Product:	Red Hat Enterprise Linux 7	Reporter:	Dmitri Pal <dpal>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED WONTFIX	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	atolani, b.prins, jgalipea, mkosek, pasik, rcritten
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-11-12 19:08:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dmitri Pal 2012-01-19 00:10:40 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/1985

If the CA certificate is signed by an external CA, certmonger might not be able to automatically update it.  In fact, this is likely to require a financial transaction.  The CA should send an email to a preconfigured account prior to expiration.  If the CA cert expires, it will be very painful for an IPA based system,  as all of the client machines certificates will be invalid.  hey need to be notified of the new CA cert  early enough to avoid triggering invalidation , and to keep their certifactes valid for the currently stated lifespan.

Comment 8 Rob Crittenden 2018-11-12 19:08:14 UTC

Thank you taking your time and submitting this request for Red Hat Enterprise Linux. Unfortunately, this bug was not given priority and was deferred both in the upstream project and in Red Hat Enterprise Linux.

Given that we are unable to fulfil this request in following Red Hat Enterprise Linux releases, I am closing the Bugzilla as WONTFIX. To request that Red Hat re-considers the decision, please re-open the Bugzilla via appropriate support channels and provide additional business and/or technical details about its importance to you.

Note that you can still track this request or even contribute patches in the referred upstream Pagure ticket.