Red Hat Summit Red Hat SummitSupportConsoleDéveloppeursCommencer un essaiContact

Ce contenu n'est pas disponible dans la langue sélectionnée.

Chapter 23. Generating CRL on the IdM CA server

If your IdM deployment uses an embedded certificate authority (CA), you may need to move the generating of the Certificate Revocation List (CRL) from one Identity Management (IdM) server to another. It can be necessary, for example, when you want to migrate the server to another system.

Only configure one server to generate the CRL. The IdM server that performs the CRL publisher role is usually the same server that performs the CA renewal server role, but this is not mandatory. Before you decommission the CRL publisher server, select and configure another server to perform the CRL publisher server role.

23.1. Stopping CRL generation on an IdM server
Copier lien

Use the ipa-crlgen-manage command to stop generating the Certificate Revocation List (CRL) on the IdM CRL publisher server. You must disable CRL generation on the current server before enabling it on a new server, because only one server should generate the CRL at a time.

Prerequisites

  • You must be logged in as root.

Procedure

  1. Check if your server is generating the CRL: 

    [root@server ~]# ipa-crlgen-manage status
     
    CRL generation: enabled
Last CRL update: 2019-10-31 12:00:00
Last CRL Number: 6
The ipa-crlgen-manage command was successful

  2. Stop generating the CRL on the server: 

    [root@server ~]# ipa-crlgen-manage disable
     
    Stopping pki-tomcatd
Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
Starting pki-tomcatd
Editing /etc/httpd/conf.d/ipa-pki-proxy.conf
Restarting httpd
CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable.
The ipa-crlgen-manage command was successful

  3. Check if the server stopped generating CRL: 

    [root@server ~]# ipa-crlgen-manage status

    The server stopped generating the CRL. The next step is to enable CRL generation on the IdM replica.

23.2. Starting CRL generation on an IdM replica server
Copier lien

You can start generating the Certificate Revocation List (CRL) on an IdM CA server with the ipa-crlgen-manage command.

Prerequisites

  • The RHEL system must be an IdM Certificate Authority server.
  • You must be logged in as root.

Procedure

  1. Start generating the CRL: 

    [root@replica1 ~]# ipa-crlgen-manage enable
     
    Stopping pki-tomcatd
Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
Starting pki-tomcatd
Editing /etc/httpd/conf.d/ipa-pki-proxy.conf
Restarting httpd
Forcing CRL update
CRL generation enabled on the local host. Please make sure to have only a single CRL generation master.
The ipa-crlgen-manage command was successful

  2. Check if the CRL is generated: 

    [root@replica1 ~]# ipa-crlgen-manage status
     
    CRL generation: enabled
Last CRL update: 2019-10-31 12:10:00
Last CRL Number: 7
The ipa-crlgen-manage command was successful

23.3. Changing the CRL update interval
Copier lien

The Certificate Revocation List (CRL) file is automatically generated by the Identity Management Certificate Authority (Idm CA) every four hours by default. You can change this interval with the following procedure.

Procedure

  1. Stop the CRL generation server: 

    # systemctl stop pki-tomcatd@pki-tomcat.service

  2. Open the /var/lib/pki/pki-tomcat/conf/ca/CS.cfg file, and change the ca.crl.MasterCRL.autoUpdateInterval value to the new interval setting. For example, to generate the CRL every 60 minutes: 

    ca.crl.MasterCRL.autoUpdateInterval=60
    Note

    If you update the ca.crl.MasterCRL.autoUpdateInterval parameter, the change will become effective after the next already scheduled CRL update.

  3. Start the CRL generation server: 

    # systemctl start pki-tomcatd@pki-tomcat.service
Red Hat logoGithubredditYoutubeTwitter

Apprendre

Essayez, achetez et vendez

Communautés

À propos de la documentation Red Hat

Nous aidons les utilisateurs de Red Hat à innover et à atteindre leurs objectifs grâce à nos produits et services avec un contenu auquel ils peuvent faire confiance. Découvrez nos récentes mises à jour.

Rendre l’open source plus inclusif

Red Hat s'engage à remplacer le langage problématique dans notre code, notre documentation et nos propriétés Web. Pour plus de détails, consultez le Blog Red Hat.

À propos de Red Hat

Nous proposons des solutions renforcées qui facilitent le travail des entreprises sur plusieurs plates-formes et environnements, du centre de données central à la périphérie du réseau.

Theme

© 2026 Red HatRetour au début