freeipa

#8411 ipa-getcert/certmonger sometimes unable renewe certificate
Closed: worksforme by rcritten. Opened by schlitzered.

Closed: worksforme
Reopen Issue

Request for enhancement

As a Linux System, i want certmonger to not fail renewing certificates, in case it fails, it should do an automatic retry. also in case it fails, it should tell what went wrong, and maybe allow to specify a script that is called in case of an issue (monitoring integration)

Issue

certmonger sometimes fails to renew issued certificates on a host, this is not happening always, but quite often.

Steps to Reproduce

  1. issue certificate via ipa-getcert start-tracking
  2. wait 2 years
  3. check if renewal was successful

Actual behavior

sometimes certs are not renewed, in this case "status" of the issues certificate is in "NEED_GUIDANCE"

Expected behavior

certificates renewal should not fail, in case it fails, renewal should be retried automatically.
in case it failed, it should also report what went wrong.
also it would be nice if it would be possible to specify a script for each certificate, that is called whenever a renewal failed (just like the pre/post-save command)

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
package ipa-server is not installed
ipa-client-4.6.5-11.el7.centos.4.x86_64
package 389-ds-base is not installed
package pki-ca is not installed
package krb5-server is not installed

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

certmonger already retries renewals per the enroll_ttls setting. The default, in seconds, is 2419200, 604800, 259200, 172800, 86400, 43200, 21600, 7200, 3600.

This is equivalent to 28, 7, 3, 2, 1 days then at 12, 6, 2 and 1 hour before expiration.

See the certmonger.conf man page for notification_method.

An error command could be useful, though. Or does certmonger emit a D-Bus signal on error that can be captured and handled by a system bus listener?

notification_method can be a command.

interesting that it then failed so often.

i currently fail to find cert-monger logs, anywhere in /var/log.

where should i find them, or do i need to enable them first?

interesting that it then failed so often.
i currently fail to find cert-monger logs, anywhere in /var/log.
where should i find them, or do i need to enable them first?

We increased debug level of certmonger in all supported Fedora versions and RHEL 8 a while ago, see https://pagure.io/freeipa/issue/7986

we currently run mostly CentOS6/7, as well as a bunch of RHEL6/7 systems.

any way to get (more) logging for these OS versions?

Create /etc/sysconfig/certmonger with the contents: OPTS=-d2

certmonger logs to syslog so the entries are in the journal on RHEL 7 and in /var/log/messages on RHEL 6.

I think we can close this ticket.

Metadata Update from @rcritten:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.