freeipa

#8886 cert-monger did not renew a certificate until the list command was issued
Closed: worksforme by rcritten. Opened by gerases.

Closed: worksforme
Reopen Issue

Request for enhancement

As , I want so that .

Issue

I have a certificate tracked by certmonger. I configured it with auto-renew set to yes. At some point the certificate expired without being renewed on time. I issued ipa-getcert list to see the status of the cert and saw that the date/time of expiration was set about two hours in the past. However, when I issue the ipa-getcert list command again, the date changed to the correct future date and the file on disk got updated. It appears that the renewal didn't happen until I issued the list command.

Steps to Reproduce

1.
2.
3.

Actual behavior

The certificate didn't get updated.

Expected behavior

The certificate should have been renewed on disk.

Version/Release/Distribution

This system on which the issue occurred is not an IPA server. It's an ipa client only. The version of the client is ipa-client-4.6.8-5.el7.centos.x86_64.

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

Check your syslog/journal to see if certmonger attempted to renew prior to that.

certmonger is a socket-activated dbus service so any getcert command will start it.

My guess is that it hasn't been running and your running getcert list started it and kicked off the renewal.

Ah, you're probably right. I checked and first of all, certmonger is not enabled with systemd. I must have restarted the machine and the service didn't start at all. And since you said that any subcommand would have started it, the illusion was that it had been running.

I'll make sure the service starts upon restart. This is awesome info! Thanks so much!

Metadata Update from @rcritten:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.