Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 24. Decommissioning a server that performs the CA renewal server and CRL publisher roles

You might have one server performing both the Certificate Authority (CA) renewal server role and the Certificate Revocation List (CRL) publisher role. If you need to take this server offline or decommission it, select and configure another CA server to perform these roles.

In this example, the host server.idm.example.com, which fulfills the CA renewal server and CRL publisher roles, must be decommissioned. This procedure transfers the CA renewal server and CRL publisher roles to the host replica.idm.example.com and removes server.idm.example.com from the IdM environment.

Note

You do not need to configure the same server to perform both CA renewal server and CRL publisher roles.

Prerequisites

  • You have the IdM administrator credentials.
  • You have the root password for the server you are decommissioning.
  • You have at least two CA replicas in your IdM environment.

Procedure

  1. Obtain the IdM administrator credentials: 

    [user@server ~]$ kinit admin
Password for admin@IDM.EXAMPLE.COM:
    Copy to Clipboard Toggle word wrap

  2. Optional: If you are not sure which servers perform the CA renewal server and CRL publisher roles:

    1. Display the current CA renewal server. You can run the following command from any IdM server: 

      [user@server ~]$ ipa config-show | grep 'CA renewal'
  IPA CA renewal master: server.idm.example.com
      Copy to Clipboard Toggle word wrap

    2. Test if a host is the current CRL publisher. 

      [user@server ~]$ ipa-crlgen-manage status
CRL generation: enabled
Last CRL update: 2019-10-31 12:00:00
Last CRL Number: 6
The ipa-crlgen-manage command was successful
      Copy to Clipboard Toggle word wrap

      A CA server that does not generate the CRL displays CRL generation: disabled. 

      [user@replica ~]$ ipa-crlgen-manage status
CRL generation: disabled
The ipa-crlgen-manage command was successful
      Copy to Clipboard Toggle word wrap

      Continue entering this command on CA servers until you find the CRL publisher server.

    3. Display all other CA servers you can promote to fulfill these roles. This environment has two CA servers. 

      [user@server ~]$ ipa server-role-find --role 'CA server'
----------------------
2 server roles matched
----------------------
  Server name: server.idm.example.com
  Role name: CA server
  Role status: enabled
  Server name: replica.idm.example.com
  Role name: CA server
  Role status: enabled
----------------------------
Number of entries returned 2
----------------------------
      Copy to Clipboard Toggle word wrap

  3. Set replica.idm.example.com as the CA renewal server. 

    [user@server ~]$ ipa config-mod --ca-renewal-master-server replica.idm.example.com
    Copy to Clipboard Toggle word wrap

  4. On server.idm.example.com:

    1. Disable the certificate updater task: 

      [root@server ~]# pki-server ca-config-set ca.certStatusUpdateInterval 0
      Copy to Clipboard Toggle word wrap

    2. Restart IdM services: 

      [root@server ~]# ipactl restart
      Copy to Clipboard Toggle word wrap

  5. On replica.idm.example.com:

    1. Enable the certificate updater task: 

      [root@replica ~]# pki-server ca-config-unset ca.certStatusUpdateInterval
      Copy to Clipboard Toggle word wrap

    2. Restart IdM services: 

      [root@replica ~]# ipactl restart
      Copy to Clipboard Toggle word wrap

  6. On server.idm.example.com, stop generating the CRL. 

    [user@server ~]$ ipa-crlgen-manage disable
Stopping pki-tomcatd
Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
Starting pki-tomcatd
Editing /etc/httpd/conf.d/ipa-pki-proxy.conf
Restarting httpd
CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable.
The ipa-crlgen-manage command was successful
    Copy to Clipboard Toggle word wrap

  7. On replica.idm.example.com, start generating the CRL. 

    [user@replica ~]$ ipa-crlgen-manage enable
Stopping pki-tomcatd
Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
Starting pki-tomcatd
Editing /etc/httpd/conf.d/ipa-pki-proxy.conf
Restarting httpd
Forcing CRL update
CRL generation enabled on the local host. Please make sure to have only a single CRL generation master.
The ipa-crlgen-manage command was successful
    Copy to Clipboard Toggle word wrap

  8. Stop IdM services on server.idm.example.com: 

    [root@server ~]# ipactl stop
    Copy to Clipboard Toggle word wrap

  9. On replica.idm.example.com, delete server.idm.example.com from the IdM environment. 

    [user@replica ~]$ ipa server-del server.idm.example.com
    Copy to Clipboard Toggle word wrap

  10. On server.idm.example.com, use the ipa-server-install --uninstall command as the root account: 

    [root@server ~]# ipa-server-install --uninstall
...
Are you sure you want to continue with the uninstall procedure? [no]: yes
    Copy to Clipboard Toggle word wrap

Verification

  • Display the current CA renewal server. 

    [user@replica ~]$ ipa config-show | grep 'CA renewal'
  IPA CA renewal master: replica.idm.example.com
    Copy to Clipboard Toggle word wrap

  • Confirm that the replica.idm.example.com host is generating the CRL. 

    [user@replica ~]$ ipa-crlgen-manage status
CRL generation: enabled
Last CRL update: 2019-10-31 12:10:00
Last CRL Number: 7
The ipa-crlgen-manage command was successful
    Copy to Clipboard Toggle word wrap
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat