freeipa

#9294 Enable the certificate pruning job in PKI
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Request for enhancement

As an administrator , I want to remove expired certificates so that I can maintain performance and the size of my certificate database.

With ACME generating short-lived certificates, expired certificates can quickly build up in the certificate database. https://pagure.io/dogtagpki/issue/1750 provides a job that can be scheduled or run manually to remove (prune) expired certificates.

Design PR https://github.com/freeipa/freeipa/pull/6600

master:

  • 5d9f59038db8c8b133f3d75ce7d98324daf5b403 doc: Design for certificate pruning

ipa-4-10:

  • 51b1c22d025bf40e9ef488bb0faf0c8dff303ccd doc: Design for certificate pruning

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2162677

master:

  • 78298fd4e18f45f77691914ef7b406aa08fc7776 ipa-acme-manage: add certificate/request pruning management
  • 7d1d91fc86c49fcaaec05c772add13af36fc0209 doc: add the --run command for manual job execution

ipa-4-10:

  • 9246a8a003b2b0062e07c289cd7cde8fe902b16f ipa-acme-manage: add certificate/request pruning management
  • f10d1a0f84ed0f16ab4a1469f16ffadb3e79e59e doc: add the --run command for manual job execution

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 828f6e7c927b6fc018161ff19851fb9c746be792 ipatests: tests for certificate pruning

ipa-4-10:

  • 0f77b359e241fc4055fb8d785e18f96338451ebf ipatests: tests for certificate pruning

master:

  • e76b219c21d53b6bccce4ea3d18e2b61ac835e1f ipatests: fix tests in TestACMEPrune

ipa-4-10:

  • e7c642bafcead5ce344f3b129d916045b00d0c1e ipatests: fix tests in TestACMEPrune

Metadata Update from @rcritten:
- Custom field changelog adjusted to Removing (pruning) expired certificates is supported when Random Serial Numbers are enabled. One cannot upgrade from sequential serial numbers to random. This feature is enabled using the ipa-acme-manage(1) command.
Metadata
None
None
None
Low
Removing (pruning) expired certificates is supported when Random Serial Numbers are enabled. One cannot upgrade from sequential serial numbers to random. This feature is enabled using the ipa-acme-manage(1) command.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.