freeipa

#7991 Use profile-based renewal for system certificates
Closed: fixed by ftweedal. Opened by ftweedal.

Closed: fixed
Reopen Issue

Request for enhancement

There have been numerous customer cases concerning failures of, or incorrect renewal of Dogtag system certificates or IPA RA certificate. These certificates use serial-based renewal requests. The request refers to the serial number of the certificate to be renewed. The certificate record is looked up, and from there, the original request record. The details of that request are re-used to create a new certificate.

This has led to problems including:

  • Request failure because the original request record cannot be found. This may be due to data that was somehow deleted, or replication failures, or data corruption.
  • Request succeed, but the certificate details (e.g. Subject DN) are wrong. The wrong request was looked up. This could be due to conflicting replica request and/or serial ranges

We investigated whether the renewal procedure for these certificate can be changed to use regular enrolment requests instead of serial-based renewal requests, and concluded:

  • It is feasible.
  • Certmonger tracking requests must record the profile to use.
  • Exception: default profile (caServerCert) is used ('Server-Cert cert-pki-ca' and IPA RA)
  • For existing installs, ipa-server-upgrade must add the profile template to relevant tracking requests.
  • A small update to dogtag-ipa-ca-renew-agent Certmonger helper to instruct dogtag-ipa-renew-agent (part of Certmonger itself) to perform a new enrolment instead of renewal request.

The scenario was tested by upgrading the deployment to with the changes above, and add profile to relevant tracking requests. I deleted the old OCSP certificate record, then renewed it via getcert-resubmit. Renewal succeeded.

We have agreed to proceed with this effort. A bit more work and testing is needed, in particular:

  • Extend ipa-server-upgrade to add profiles to KRA cert tracking requests (when KRA is installed)
  • More testing.

PR: https://github.com/freeipa/freeipa/pull/3316

master:

  • 3c388f5a228b767dfd92bd824dfced166acda143 dogtaginstance: add profile to tracking requests
  • f6f6f83dca22fb23ee2a7dd1b2925a74fe395afe upgrade: add profile to Dogtag tracking requests
  • 858ef59948f5c8edd511f4db0b5fd69a1169f19b certmonger: use long options when invoking dogtag-ipa-renew-agent
  • 1fb6fda01f2aca5fadc3707b7c7a3f3c9e647f85 dogtag-ipa-ca-renew-agent: always use profile-based renewal
  • 588f1ddce2f69fd5e80d3271c9c8d80d312d350f dogtaginstance: avoid special cases for Server-Cert
  • 4f4e2f96b022a056777fed59583f204edb797a2e upgrade: always add profile to tracking requests
  • 482866e47e20520fbe39ef05439badbb3069bef6 upgrade: update KRA tracking requests
  • 2d22f568a1043b0cb0b69314d3951d39721becc7 upgrade: log missing/misconfigured tracking requests
  • fa5675582caef6d0708c8ae392e170b44d9daf5b upgrade: fix spurious certmonger re-tracking
  • 1bf008a64f15e617b0dde93555f5dca1cbdf990a cainstance: add profile to IPA RA tracking request
  • bb779baadf0df3333bd853599a21e81907c8c116 Use RENEWAL_CA_NAME and RA_AGENT_PROFILE constants
  • 65d9a9be520ea9402143d9f06878eff53647925a ipatests: test ipa-server-upgrade in CA-less deployment
  • f5822e3a25c0b1b35678ba3d8bcca6cbc16bff5b httpinstance: add pinfile when tracking certificate
  • b7ad11572d3060e64252c4366d7c8afff1bc15e9 (HEAD) dsinstance: add proflie when tracking certificate

ipa-4-8:

  • 29064494ffc72d88c6b843ebc4c88ec92f75437f dogtaginstance: add profile to tracking requests
  • 6fc44bdc9f3b94832770390e4e7b4e82db67b409 upgrade: add profile to Dogtag tracking requests
  • 34c51eaa71586db1add527f43a3ffc7bdfb97198 certmonger: use long options when invoking dogtag-ipa-renew-agent
  • ec5eb844c9df24cc54bc9c532ad090683430b4ca dogtag-ipa-ca-renew-agent: always use profile-based renewal
  • 19f1f1022475946fcdc07d8155ea8e42d6d9e1bf dogtaginstance: avoid special cases for Server-Cert
  • 1f9d1ba28ed321e07d6c3893663b127ccc4dc36b upgrade: always add profile to tracking requests
  • 80895dd68c9884f4e33bfd22446785ffa74f8e81 upgrade: update KRA tracking requests
  • f64c36901cf008e1dc2c4f2f5c31dfb7e03f905e upgrade: log missing/misconfigured tracking requests
  • 5194bec9eff539a55209067739514582bdf159ac upgrade: fix spurious certmonger re-tracking
  • 4758a4a08c7e8067e78045645f81527bf2fc145c cainstance: add profile to IPA RA tracking request
  • 27ea7dbf2a2ae81d7ac03ce4f6e398d5b77f3de9 Use RENEWAL_CA_NAME and RA_AGENT_PROFILE constants
  • f8f8289c281883550d26193e28f74efbd0794847 ipatests: test ipa-server-upgrade in CA-less deployment
  • 46792fbc47d53353b269225a4a39917952c3b0d1 httpinstance: add pinfile when tracking certificate
  • 860b6f644a75fe6d1cf0f1811bdf4f344033d045 (HEAD) dsinstance: add proflie when tracking certificate

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

robustness

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.