When internal certificates maintained by FreeIPA expire even with FreeIPA's built-in
auto rotate mechanism for certificates about to expire, manual intervention is
needed.
FreeIPA certificate issues can impact the normal operation of FreeIPA services,
including tomcat, kadmind,
named-pkcs11, krb5kdc,
ipa-dnskeysyncd, and ipa-custodia.
You must have root user rights.
-
Check FreeIPA status with the
ipactl status (or)
cdp-doctor service status command.
If any of the services are not running, check the appropriate logs.
If pki-tomcat is in a stopped state, check the individual service status
with the systemctl status pki-tomcatd@pki-tomcat.service
command. This will display additional information on why the service is not
starting up.
-
Check the validity of the FreeIPA internal certificate with the
getcert
list command.
-
If the certificates have expired, run the
ipa-cert-fix -v
command to renew the certificates.
-
Check the status of the
certmonger service with the
systemctl status certmonger command.
If it is not running, then restart it with the systemctl restart
certmonger command.
-
Check whether all FreeIPA services are running without issues.
