freeipa

#8908 reevaluate /etc/pki/default.cfg without uninstall/reinstall?
Closed: worksforme by dbazile. Opened by dbazile.

Closed: worksforme
Reopen Issue

Issue

Is it possible to get IPA's CA subsystem to reevaluate changes from /etc/pki/default.cfg referenced here without having to uninstall and reinstall completely?

Steps to Reproduce

  1. sed -i 's/pki_random_serial_numbers_enable=False/pki_random_serial_numbers_enable=True/' /etc/pki/default.cfg
  2. ipactl restart
  3. issue a new certificate

Actual behavior

New signed certificate will have a sequential serial number, not a random one.

Expected behavior

New signed certificate should have a random serial number.

Version/Release/Distribution

ipa-server-4.6.8-5.el7.centos.6.x86_64
ipa-client-4.6.8-5.el7.centos.6.x86_64
389-ds-base-1.3.10.2-12.el7_9.x86_64
pki-ca-10.5.18-14.el7_9.noarch
krb5-server-1.15.1-50.el7.x86_64

It is not possible to re-deploy the CA.

Some options can be set post-install. I don't know if this is one of them, particularly since any clones would already have a static range set.

Note that testing was not completed for random serial numbers and we really don't know if it works or not in IPA. I had some initial success years ago but work was re-prioritized and the machine that had the changes (minimal IIRC) was lost.

PKI is currently changing the way random serial numbers will work and that is eventually going to be integrated into IPA. As I had suspected, humongous integers are not expected to play nice with the original XMLRPC-based IPA API because they are larger than 32-bits, for example.

Got it. Well, that's my question answered. Thanks!

Metadata Update from @dbazile:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.