<html><head></head><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:24px"><div id="yui_3_16_0_ym19_1_1469042370452_51359">hi</div><div dir="ltr" id="yui_3_16_0_ym19_1_1469042370452_51363">it is result of command, seems issue is another thing</div><div id="yui_3_16_0_ym19_1_1469042370452_51377" dir="ltr"> </div><div id="yui_3_16_0_ym19_1_1469042370452_51378" dir="ltr"> </div><div id="yui_3_16_0_ym19_1_1469042370452_51360" dir="ltr"> ipa cert-show 1 ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found) </div><div id="yui_3_16_0_ym19_1_1469042370452_51379"></div><div id="yui_3_16_0_ym19_1_1469042370452_51380" class="qtdSeparateBR"> </div><div style="display: block;" id="yui_3_16_0_ym19_1_1469042370452_51384" class="yahoo_quoted"> <div id="yui_3_16_0_ym19_1_1469042370452_51383" style="font-family: verdana, helvetica, sans-serif; font-size: 24px;"> <div id="yui_3_16_0_ym19_1_1469042370452_51382" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_ym19_1_1469042370452_51381" dir="ltr"> <hr size="1"> From: Rob Crittenden <rcritten@redhat.com> To: mohammad sereshki <mohammadsereshki@yahoo.com>; Florence Blanc-Renaud <flo@redhat.com>; Freeipa-users <freeipa-users@redhat.com> Sent: Thursday, July 21, 2016 8:08 PM Subject: Re: [Freeipa-users] regenerate certificate </div> <div id="yui_3_16_0_ym19_1_1469042370452_51385" class="y_msg_container"> mohammad sereshki wrote: > dear > thanks, but would you please check below and let me know what is your > idea?I checked your command but it did not work. The Not Found suggests that the CA is not up. I'd try restarting the pki-cad process to see if that helps. A simple test that communication is working is: ipa cert-show 1 The output isn't important as long as it isn't an error. rob<div class="yqt1565623790" id="yqtfd89975"> > > > > Number of certificates and requests being tracked: 8. > Request ID '20140817123525': > status: MONITORING > ca-error: Unable to determine principal name for signing request. > stuck: no > key paCOM storage: > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=EXAMPLE.COM > subject: CN=IPA RA,O=EXAMPLE.COM > expCOMes: 2018-06-30 07:56:06 UTC > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert > track: yes > auto-renew: yes > Request ID '20140817123534': > status: CA_UNREACHABLE > ca-error: Server failed request, will retry: 4301 (RPC failed > at server. Certificate operation cannot be completed: Unable to > communicate with CMS (Not Found)). > stuck: yes > key paCOM storage: > type=NSSDB,location='/etc/dCOMsrv/slapd-EXAMPLE.-COM',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dCOMsrv/slapd-EXAMPLE.-COM/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/dCOMsrv/slapd-EXAMPLE.-COM',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=EXAMPLE.COM > subject: CN=ipatestsrv.EXAMPLE.COM,O=EXAMPLE.COM > expCOMes: 2016-08-17 12:35:34 UTC > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/lib64/ipa/certmonger/restart_dCOMsrv > EXAMPLE.-COM > track: yes > auto-renew: yes > Request ID '20140817123602': > status: CA_UNREACHABLE > ca-error: Server failed request, will retry: 4301 (RPC failed > at server. Certificate operation cannot be completed: Unable to > communicate with CMS (Not Found)). > stuck: yes > key paCOM storage: > type=NSSDB,location='/etc/dCOMsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dCOMsrv/slapd-PKI-IPA/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/dCOMsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=EXAMPLE.COM > subject: CN=ipatestsrv.EXAMPLE.COM,O=EXAMPLE.COM > expCOMes: 2016-08-17 12:36:02 UTC > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/lib64/ipa/certmonger/restart_dCOMsrv > PKI-IPA > track: yes > auto-renew: yes > Request ID '20140817123752': > status: CA_UNREACHABLE > ca-error: Server failed request, will retry: 4301 (RPC failed > at server. Certificate operation cannot be completed: Unable to > communicate with CMS (Not Found)). > stuck: yes > key paCOM storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=EXAMPLE.COM > subject: CN=ipatestsrv.EXAMPLE.COM,O=EXAMPLE.COM > expCOMes: 2016-08-17 12:37:51 UTC > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/lib64/ipa/certmonger/restart_httpd > track: yes > auto-renew: yes > You have new mail in /var/spool/mail/root > > > ------------------------------------------------------------------------ > *From:* Florence Blanc-Renaud <<a shape="rect" ymailto="mailto:flo@redhat.com" href="mailto:flo@redhat.com">flo@redhat.com</a>> > *To:* mohammad sereshki <<a shape="rect" ymailto="mailto:mohammadsereshki@yahoo.com" href="mailto:mohammadsereshki@yahoo.com">mohammadsereshki@yahoo.com</a>>; Freeipa-users > <<a shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>> > *Sent:* Thursday, July 21, 2016 11:30 AM > *Subject:* Re: [Freeipa-users] regenerate certificate > > On 07/20/2016 10:04 PM, mohammad sereshki wrote: > > hi > > I check my IPA server which is version ipa-server-3.0.0-25 , command > > "ipa-get-cert list" show, my certificate will be expired in next 20 days, > > I do not know how to regenerate them > > but command "getcert list" shows epirtion certificates are related just > > to "CA:IPA" and certificate " CA: dogtag-ipa-renew-agent" , has enough > > time . > > would you please help me to know how to regenerate CA:IPA certificates? > > > > Best Regards > > > > > > > > Hi Mohammad, > > the certificates issued by IPA CA are normally tracked by certmonger and > automatically renewed when they are near their expiration date. To make > sure that your certificates are tracked, you can issue > > $ ipa-getcert list > > and check the "status:" field for each certificate. It should display > "MONITORING". > > If you want to manually renew them, you must note their request ID and > use the command > $ ipa-getcert resubmit -i $REQUEST_ID > > Hope this helps, > Flo. > > > > > </div> </div> </div> </div> </div></div></body></html>