<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">I have a Dogtag 10.0 CA system where the root self-signed certificate is set to expire next year. I plan to upgrade to Dogtag 10.7, but after that it is not clear to me what procedure I should follow to renew the root signing certificate.</div><div class=""><br class=""></div><div class="">I understand the general process for renewing system certificates as outlined here:</div><div class=""><br class=""></div><div class=""><a href="https://www.dogtagpki.org/wiki/System_Certificate_Renewal" class="">https://www.dogtagpki.org/wiki/System_Certificate_Renewal</a></div><div class=""><br class=""></div><div class="">However the examples there are all for system certificates other than the root certificate, so I wanted to be clear on the steps needed.</div><div class=""><br class=""></div><div class="">In my testing, I found that I can renew & approve the root signing certificate as documented:</div><div class=""><br class=""></div><div class="">$ pki ca-cert-request-submit --profile caManualRenewal --serial 0x1 —renewal</div><div class=""><br class=""></div><div class="">If I use the web GUI’s “Bypass CA notAfter constraint” option to approve the request I can get the expiration date of the approved certificate set to the distant future. Is there a way to do this with the pki command line tool? When I tried, the expiration date gets capped to the current CA root certificate’s expiration date.</div><div class=""><br class=""></div><div class="">Then, assuming that approved root certificate is what I need, do I just run</div><div class=""><br class=""></div><div class="">$ systemctl stop <a href="mailto:pki-tomcatd@pki-tomcat.service" class="">pki-tomcatd@pki-tomcat.service</a></div><div class="">$ pki-server subsystem-cert-update ca <nickname> —cert <renewed-cert-file></div><div class="">$ systemctl start <a href="mailto:pki-tomcatd@pki-tomcat.service" class="">pki-tomcatd@pki-tomcat.service</a></div><div class=""><br class=""></div><div class="">And then will I be able to renew the other system certificates normally later (before they expire)?</div><div class=""><br class=""></div><div class="">Thanks for any advice,</div><div class="">Matt</div><div class=""><br class=""></div></body></html>