Request for enhancement

• As an IPA administrator, I want to recover a renewal master with expired Dogtag and IPA service certificates by running a single command so that I can restore IPA operations without manual certificate manipulation.
• As an IPA administrator, I want to fix expired certificates on a CA-full replica by fetching them from a healthy renewal master so that I don’t have to promote the replica or disrupt the topology.
• As an IPA administrator, I want to promote a CA-full replica to renewal master when the original master is permanently lost so that I can recover the deployment without rebuilding from scratch.
• As an IPA administrator, I want to fix expired HTTP, LDAP, and KDC certificates on a CA-less replica by renewing them through a remote CA server so that CA-less replicas are not a dead end when certs expire.
• As an IPA administrator, I want ipa-cert-fix to extract the CA signing certificate CSR and print renewal instructions when my externally-signed CA certificate expires so that I know exactly what to submit to the external CA and how to install the result.
• As an IPA administrator, I want to choose per-certificate whether to transition an externally-signed service certificate to the internal IPA CA or generate a CSR for manual renewal so that I retain control over my PKI trust model.
• As an IPA administrator, I want a dry-run mode that shows what ipa-cert-fix would do without making changes so that I can review the plan before committing to it.
• As an automation engineer, I want to run ipa-cert-fix in unattended mode with a specific server so that I can include certificate recovery in Ansible playbooks and CI pipelines without interactive prompts.
• As an IPA developer, I want a dedicated test suite for ipa-cert-fix that covers each deployment type and fix scenario so that regressions are caught in upstream CI before they reach production deployments.

Issue

The ipa-cert-fix tool was originally designed to handle only one scenario: recovering a CA renewal master when expired certificates prevent normal operation. It runs pki-server cert-fix to regenerate Dogtag subsystem certificates and installs renewed IPA service certificates.

This design is insufficient for real-world deployments where:

• Non-renewal-master CA replicas have expired certificates but the renewal master is healthy and reachable.
• CA-less replicas have only IPA service certificates (HTTP, LDAP, KDC, RA) and no local PKI.
• Some service certificates are signed by an external CA rather than the internal IPA CA.
• The renewal master is permanently unavailable and another CA replica must take over.

Running the original ipa-cert-fix on a non-renewal-master replica was potentially destructive: while it did not change the IPA renewal master configuration, it effectively acted as a renewal master by using pki-server cert-fix to regenerate all shared PKI certificates (subsystem, OCSP, audit signing, etc.) locally instead of fetching them from the actual renewal master. These locally-regenerated certs would then conflict with the ones managed by the real renewal master, potentially disrupting certificate replication across the topology.

Version/Release/Distribution

ipa-server-4.12.2-24.el10_1.2.x86_64

Additional info:

Implementation proposition to follow.