RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:

DESCRIPTION in ipa-server-certinstall(1) reads:

~~~~
Replace the current Directory server SSL certificate, Apache server SSL certificate and/or Kerberos KDC certificate with the certificate in the specified files.
~~~~

and

~~~~
The service(s) are not automatically restarted. In order to use the newly installed certificate(s) you will need to manually restart the Directory and/or Apache servers.
~~~~

It seems # systemctl restart krb5kdc.service is also needed after installing the KDC certificate, but the man page doesn't say that -- it only says to restart DS and Apache.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:

The man page should clearly list all services that need to be restarted if the certificate(s) changed.


Additional info:

This issue has already been fixed upstream (https://pagure.io/freeipa/issue/7016 ipa_server_certinstall - restart krb5kdc service after kdc cert is installed), in the master branch as well as ipa-4-5 and ipa-4-6 branches.

ipa-4-5 patch: https://pagure.io/freeipa/c/512bf317b191ffefcc9baca4f766c1fb010f344f

verified using :
ipa-server-4.6.4-3.el7.x86_64

man ipa-server-certinstall contains :

       The  service(s)  are  not automatically restarted. In order to use the newly installed certificate(s) you will need to manually restart
       the Directory, Apache and/or Krb5kdc servers.


Expected information is there in man page. 
Thus marking it verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187