1780317 – ipa-cert-fix: False Positive Status for cert renewal.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1780317 - ipa-cert-fix: False Positive Status for cert renewal.

Summary: ipa-cert-fix: False Positive Status for cert renewal.

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 8
Classification:	Red Hat
Component:	ipa
Sub Component:
Version:	8.1
Hardware:	x86_64
OS:	Linux
Priority:	medium
Severity:	high
Target Milestone:	rc
Target Release:	8.0
Assignee:	Florence Blanc-Renaud
QA Contact:	ipa-qe
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2019-12-05 16:52 UTC by Deepak Das
Modified:	2021-11-23 08:56 UTC (History)
CC List:	8 users (show)
Fixed In Version:	idm-client-8050020210701113027.de73ecb2
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2021-11-09 18:21:19 UTC
Type:	Bug
Target Upstream Version:
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Issue Tracker	FREEIPA-7167	0	None	None	None	2021-10-25 18:12:25 UTC
Red Hat Product Errata	RHBA-2021:4230	0	None	None	None	2021-11-09 18:21:38 UTC

Description Deepak Das 2019-12-05 16:52:26 UTC

Description of problem:

[root@master ~]# getcert list|grep -e expire -e certificate:
	certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
	expires: 2021-11-24 10:20:04 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2021-11-24 10:19:26 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2021-11-24 10:19:26 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2021-11-24 10:19:26 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2039-12-05 10:19:25 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
	expires: 2021-11-24 10:19:26 EST
	certificate: type=NSSDB,location='/etc/dirsrv/slapd-TESTREALM-TEST',nickname='Server-Cert',token='NSS Certificate DB'
	expires: 2021-12-05 10:20:58 EST
	certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt'
	expires: 2021-12-05 10:21:24 EST
	certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
	expires: 2021-12-05 10:21:38 EST


[root@master ~]# hwclock --set --date="2025-08-14 16:45:05"
[root@master ~]# hwclock --hctosys; date
Thu Aug 14 16:45:10 EDT 2025


[root@master ~]# ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting pki-tomcatd Service
zRestarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful


[root@master ~]# date
Thu Aug 14 16:47:48 EDT 2025


[root@master ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
pki-tomcatd Service: STOPPED
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful

[root@master ~]# ipa-cert-fix 

                          WARNING

ipa-cert-fix is intended for recovery when expired certificates
prevent the normal operation of FreeIPA.  It should ONLY be used
in such scenarios, and backup of the system, especially certificates
and keys, is STRONGLY RECOMMENDED.


The following certificates will be renewed: 

Dogtag sslserver certificate:
  Subject: CN=master.testrealm.test,O=TESTREALM.TEST
  Serial:  3
  Expires: 2021-11-24 15:19:26

Dogtag subsystem certificate:
  Subject: CN=CA Subsystem,O=TESTREALM.TEST
  Serial:  4
  Expires: 2021-11-24 15:19:26

Dogtag ca_ocsp_signing certificate:
  Subject: CN=OCSP Subsystem,O=TESTREALM.TEST
  Serial:  2
  Expires: 2021-11-24 15:19:26

Dogtag ca_audit_signing certificate:
  Subject: CN=CA Audit,O=TESTREALM.TEST
  Serial:  5
  Expires: 2021-11-24 15:19:26

IPA IPA RA certificate:
  Subject: CN=IPA RA,O=TESTREALM.TEST
  Serial:  7
  Expires: 2021-11-24 15:20:04

IPA Apache HTTPS certificate:
  Subject: CN=master.testrealm.test,O=TESTREALM.TEST
  Serial:  9
  Expires: 2021-12-05 15:21:24

IPA LDAP certificate:
  Subject: CN=master.testrealm.test,O=TESTREALM.TEST
  Serial:  8
  Expires: 2021-12-05 15:20:58

IPA KDC certificate:
  Subject: CN=master.testrealm.test,O=TESTREALM.TEST
  Serial:  10
  Expires: 2021-12-05 15:21:38

Enter "yes" to proceed: yes
Proceeding.
Renewed Dogtag sslserver certificate:
  Subject: CN=master.testrealm.test,O=TESTREALM.TEST
  Serial:  15
  Expires: 2027-08-04 20:49:57

Renewed Dogtag subsystem certificate:
  Subject: CN=CA Subsystem,O=TESTREALM.TEST
  Serial:  16
  Expires: 2027-08-04 20:49:58

Renewed Dogtag ca_ocsp_signing certificate:
  Subject: CN=OCSP Subsystem,O=TESTREALM.TEST
  Serial:  17
  Expires: 2027-08-04 20:49:59

Renewed Dogtag ca_audit_signing certificate:
  Subject: CN=CA Audit,O=TESTREALM.TEST
  Serial:  18
  Expires: 2027-08-04 20:49:59

Renewed IPA IPA RA certificate:
  Subject: CN=IPA RA,O=TESTREALM.TEST
  Serial:  19
  Expires: 2027-08-04 20:49:59

Renewed IPA Apache HTTPS certificate:
  Subject: CN=master.testrealm.test,O=TESTREALM.TEST
  Serial:  20
  Expires: 2027-08-15 20:50:00

Renewed IPA LDAP certificate:
  Subject: CN=master.testrealm.test,O=TESTREALM.TEST
  Serial:  21
  Expires: 2027-08-15 20:50:00

Renewed IPA KDC certificate:
  Subject: CN=master.testrealm.test,O=TESTREALM.TEST
  Serial:  22
  Expires: 2027-08-15 20:50:01

Becoming renewal master.
The ipa-cert-fix command was successful


[root@master ~]# getcert list|grep -e expire -e certificate:
	certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
	expires: 2021-11-24 10:20:04 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2021-11-24 10:19:26 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2021-11-24 10:19:26 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2021-11-24 10:19:26 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2039-12-05 10:19:25 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
	expires: 2021-11-24 10:19:26 EST
	ca-error: Server at https://master.testrealm.test/ipa/xml failed request, will retry: -504 (HTTP POST to URL 'https://master.testrealm.test/ipa/xml' failed.  libcurl failed even to execute the HTTP transaction, explaining:  SSL certificate problem: certificate has expired).
	certificate: type=NSSDB,location='/etc/dirsrv/slapd-TESTREALM-TEST',nickname='Server-Cert',token='NSS Certificate DB'
	expires: 2021-12-05 10:20:58 EST
	ca-error: Server at https://master.testrealm.test/ipa/xml failed request, will retry: -504 (HTTP POST to URL 'https://master.testrealm.test/ipa/xml' failed.  libcurl failed even to execute the HTTP transaction, explaining:  SSL certificate problem: certificate has expired).
	certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt'
	expires: 2021-12-05 10:21:24 EST
	ca-error: Server at https://master.testrealm.test/ipa/xml failed request, will retry: -504 (HTTP POST to URL 'https://master.testrealm.test/ipa/xml' failed.  libcurl failed even to execute the HTTP transaction, explaining:  SSL certificate problem: certificate has expired).
	certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
	expires: 2021-12-05 10:21:38 EST



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Deepak Das 2019-12-05 17:09:04 UTC

Based on further check it seems that even after ipa-cert-fix give success message,  it still takes another few minutes for the status of the certificate in the server in "getcert list" to be updated hence causing confusion. 

[root@master ~]# date
Thu Aug 14 17:01:22 EDT 2025

[root@master ~]# getcert list|grep -e expire -e certificate:
	certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
	expires: 2027-08-04 16:54:38 EDT
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2027-08-04 16:53:36 EDT
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2027-08-04 16:53:57 EDT
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2027-08-04 16:54:07 EDT
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
	expires: 2039-12-05 10:19:25 EST
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
	expires: 2027-08-04 16:54:00 EDT
	certificate: type=NSSDB,location='/etc/dirsrv/slapd-TESTREALM-TEST',nickname='Server-Cert',token='NSS Certificate DB'
	expires: 2027-08-15 16:53:41 EDT
	certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt'
	expires: 2027-08-15 16:53:51 EDT
	certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
	expires: 2027-08-15 16:53:32 EDT

Comment 2 Fraser Tweedale 2020-02-13 10:26:10 UTC

Indeed, Certmonger does not notice the updated certificates straight away.
So, rather than ipa-cert-fix output being a false positive, it is getcert
output that is a false negative.

I will leave this open.  We should probably at least make a note of this
in the man page or something so let's consider this a doc bug :)

Comment 4 Rob Crittenden 2021-02-09 19:05:28 UTC

Upstream ticket:
https://pagure.io/freeipa/issue/8702

Comment 7 Florence Blanc-Renaud 2021-06-10 19:01:18 UTC

Fixed upstream
master:

    5509e00 ipa-cert-fix man page: add note about certmonger renewal

Comment 8 Florence Blanc-Renaud 2021-06-12 10:35:29 UTC

ipa-4-9:

    06a445a ipa-cert-fix man page: add note about certmonger renewal

Comment 14 Mohammad Rizwan 2021-07-12 13:07:02 UTC

version:
ipa-server-4.9.5-1.module+el8.5.0+11410+91a33fe4.x86_64
ipa-server-dns-4.9.5-1.module+el8.5.0+11410+91a33fe4.noarch

[root@master cloud-user]# ipa-cert-fix -v
[..]
ipapython.ipautil: DEBUG: stdout=Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service

ipapython.ipautil: DEBUG: stderr=ipa: INFO: The ipactl command was successful


Note: Monitor the certmonger-initiated renewal of
certificates after ipa-cert-fix and wait for its completion before
any other administrative task.

ipapython.admintool: INFO: The ipa-cert-fix command was successful


[root@master cloud-user]# man ipa-cert-fix
[..]
Important note: the certmonger daemon does not immediately notice the updated certificates and may trigger a renewal
       after ipa-cert-fix completes. As a consequence, getcert list output may display that a renewal is in  progress  even
       if  ipa-cert-fix  just finished. It is recommended to monitor the certmonger-initiated renewal and wait for its com‐
       pletion before any other administrative task.
[..]


Note about waiting for certmonger is displayed in command output as well as man page. Hence marking the bug as verified.

Comment 16 errata-xmlrpc 2021-11-09 18:21:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (ipa bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4230

Note You need to log in before you can comment on or make changes to this bug.