freeipa

#8736 ipa-crlgen-manage enable fails with error
Closed: insufficientinfo by pcech. Opened by rezz21.

Closed: insufficientinfo
Reopen Issue

Issue

ipa-crlgen-manage enable failing with error:

ra.updateCRL(): ERROR (Can not update the CR Now : thisUpdate Field of CRL set to future date.)
Certificate operation cannot be completed: ERROR (Can not update the CR Now : thisUpdate Field of CRL set to future date.)
The ipa-crlgen-manage command failed.

Steps to Reproduce

  1. ipa config-mod --ca-renewal-master-server ipa-01.example.com
  2. ipa-crlgen-manage enable

Actual behavior

ipa-crlgen-manage enable

Stopping pki-tomcatd
Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
Starting pki-tomcatd
Editing /etc/httpd/conf.d/ipa-pki-proxy.conf
Restarting httpd
Forcing CRL update
ra.updateCRL(): ERROR (Can not update the CR Now : thisUpdate Field of CRL set to future date.)
Certificate operation cannot be completed: ERROR (Can not update the CR Now : thisUpdate Field of CRL set to future date.)
The ipa-crlgen-manage command failed.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.8.7-14.module_el8.3.0+698+d6d67052.x86_64
ipa-client-4.8.7-14.module_el8.3.0+698+d6d67052.x86_64
389-ds-base-1.4.3.8-6.module_el8.3.0+604+ab7bf9cc.x86_64
pki-ca-10.9.4-1.module_el8.3.0+500+458aeb54.noarch
krb5-server-1.18.2-5.el8.x86_64

Hi,
the command is failing when it asks pki to generate a new CRL. Basically it's sending a POST to https://<server>:443/ca/agent/ca/updateCRL with crlIssuingPoint='MasterCRL'.

In order to diagnose,
- identify the time at which the command was run. In /var/log/pki/pki-tomcat/localhost_access_log.$DATE.txt, you will see a line containing POST /ca/agent/ca/updateCRL, note the date/time.
- Check the content of pki debug log in /var/log/pki/pki-tomcat/ca/debug.$DATE.log, around the same date/time. Are there specific errors?

Can you also provide the content of CS.cfg related to the CRL issuing point:
# grep "ca.crl.MasterCRL" /etc/pki/pki-tomcat/ca/CS.cfg

and the content of the ldap entry:
# ldapsearch -D "cn=directory manager" -W -b cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca

Hi @rezz21
could you provide more information (see my previous comment) in order to help us investigate this issue? Without further data we will close with insufficientinfo :(

As there is no answer from reporter for two months, I am closing this ticket.
FreeIPA Product Owner

Metadata Update from @pcech:
- Issue close_status updated to: insufficientinfo
- Issue status updated to: Closed (was: Open)

Hi there, I have the same issue and the information needed to diagnose the problem, should I continue using this thread or open a new issue?

Hi @learningsponge
you can post the information to freeipa-users@lists.fedorahosted.org

Hello @frenaud,

Thanks for the response, the issue is resolved when I tried again the next day. I can still post the issue at freeipa-users@lists.fedorahosted.org if this is something the devs would like to look into. Otherwise, I don't need further assistance.

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.