Chapter 15. Replacing the web server and LDAP server certificates if they have expired in the whole IdM deployment

Procedure

1. Optional: Perform a backup of /var/lib/ipa/private and /var/lib/ipa/passwds.

2. If you are not using the same CA to sign the new certificates or if the already installed CA certificate is no longer valid, update the information about the external CA in your local database with a file that contains a valid CA certificate chain of the external CA. The file is accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats.

   1. Install the certificates available in ca_certificate_chain_file.crt as additional CA certificates into IdM:

      # ipa-cacert-manage install ca_certificate_chain_file.crt

      Copy to Clipboard

   2. Update the local IdM certificate databases with certificates from ca_certicate_chain_file.crt:

      # ipa-certupdate

      Copy to Clipboard

3. Request the certificates for httpd and LDAP:

   1. Create a certificate signing request (CSR) for the Apache web server running on your IdM instances to your third party CA using the OpenSSL utility.

      • The creation of a new private key is optional. If you still have the original private key, you can use the -in option with the openssl req command to specify the input file name to read the request from:

        $ openssl req -new -nodes -in /var/lib/ipa/private/httpd.key -out /tmp/http.csr -addext 'subjectAltName = DNS:_server.idm.example.com_, otherName:1.3.6.1.4.1.311.20.2.3;UTF8:HTTP/server.idm.example.com@IDM.EXAMPLE.COM' -subj '/O=IDM.EXAMPLE.COM/CN=server.idm.example.com'

        Copy to Clipboard

      • If you want to create a new key:

        $ openssl req -new -newkey rsa:2048 -nodes -keyout /var/lib/ipa/private/httpd.key -out /tmp/http.csr -addext 'subjectAltName = DNS:server.idm.example.com, otherName:1.3.6.1.4.1.311.20.2.3;UTF8:HTTP/server.idm.example.com@IDM.EXAMPLE.COM' -subj '/O=IDM.EXAMPLE.COM/CN=server.idm.example.com'

        Copy to Clipboard

   2. Create a certificate signing request (CSR) for the LDAP server running on your IdM instances to your third party CA using the OpenSSL utility:

      $ openssl req -new -newkey rsa:2048 -nodes -keyout ~/ldap.key -out /tmp/ldap.csr -addext 'subjectAltName = DNS:server.idm.example.com, otherName:1.3.6.1.4.1.311.20.2.3;UTF8:ldap/server.idm.example.com@IDM.EXAMPLE.COM' -subj '/O=IDM.EXAMPLE.COM/CN=server.idm.example.com'

      Copy to Clipboard
   3. Submit the CSRs, /tmp/http.csr and tmp/ldap.csr, to the external CA, and obtain a certificate for httpd and a certificate for LDAP. The process differs depending on the service to be used as the external CA.

4. Install the certificate for httpd :

   # cp /path/to/httpd.crt /var/lib/ipa/certs/

   Copy to Clipboard

5. Install the LDAP certificate into an NSS database:

   1. Optional: List the available certificates:

      # certutil -d /etc/dirsrv/slapd-IDM-EXAMPLE-COM/ -L
      Certificate Nickname                                         Trust Attributes
                                                                   SSL,S/MIME,JAR/XPI
      
      Server-Cert                                                  u,u,u

      Copy to Clipboard

      The default certificate nickname is Server-Cert, but it is possible that a different name was applied.

   2. Remove the old invalid certificate from the NSS database (NSSDB) by using the certificate nickname from the previous step:

      # certutil -D -d /etc/dirsrv/slapd-IDM-EXAMPLE-COM/ -n 'Server-Cert' -f /etc/dirsrv/slapd-IDM-EXAMPLE-COM/pwdfile.txt

      Copy to Clipboard

   3. Create a PKCS12 file to ease the import process into NSSDB:

      # openssl pkcs12 -export -in ldap.crt -inkey ldap.key -out ldap.p12 -name Server-Cert

      Copy to Clipboard

   4. Install the created PKCS#12 file into the NSSDB:

      # pk12util -i ldap.p12 -d /etc/dirsrv/slapd-IDM-EXAMPLE-COM/ -k /etc/dirsrv/slapd-IDM-EXAMPLE-COM/pwdfile.txt

      Copy to Clipboard

   5. Check that the new certificate has been successfully imported:

      # certutil -L -d /etc/dirsrv/slapd-IDM-EXAMPLE-COM/

      Copy to Clipboard

6. Restart the httpd service:

   # systemctl restart httpd.service

   Copy to Clipboard

7. Restart the Directory service:

   # systemctl restart dirsrv@IDM-EXAMPLE-COM.service

   Copy to Clipboard
8. Perform all the previous steps on all your IdM replicas. This is a prerequisite for establishing TLS connections between the replicas.

9. Enroll the new certificates to LDAP storage:

   1. Replace the Apache web server’s old private key and certificate with the new key and the newly-signed certificate:

      # ipa-server-certinstall -w --pin=password /var/lib/ipa/private/httpd.key /var/lib/ipa/certs/httpd.crt

      Copy to Clipboard

      In the command above:

      • The -w option specifies that you are installing a certificate into the web server.
      • The --pin option specifies the password protecting the private key.
   2. When prompted, enter the Directory Manager password.

   3. Replace the LDAP server’s old private key and certificate with the new key and the newly-signed certificate:

      # ipa-server-certinstall -d --pin=password /etc/dirsrv/slapd-IDM-EXAMPLE-COM/ldap.key /path/to/ldap.crt

      Copy to Clipboard

      In the command above:

      • The -d option specifies that you are installing a certificate into the LDAP server.
      • The --pin option specifies the password protecting the private key.
   4. When prompted, enter the Directory Manager password.

   5. Restart the httpd service:

      # systemctl restart httpd.service

      Copy to Clipboard

   6. Restart the Directory service:

      # systemctl restart dirsrv@IDM-EXAMPLE-COM.service

      Copy to Clipboard
10. Execute the commands from the previous step on all the other affected replicas.