Chapter 24. Decommissioning a server that performs the CA renewal server and CRL publisher roles

Procedure

1. Obtain the IdM administrator credentials:

   [user@server ~]$ kinit admin
   Password for admin@IDM.EXAMPLE.COM:

   Copy to Clipboard Toggle word wrap

2. Optional: If you are not sure which servers perform the CA renewal server and CRL publisher roles:

   1. Display the current CA renewal server. You can run the following command from any IdM server:

      [user@server ~]$ ipa config-show | grep 'CA renewal'
        IPA CA renewal master: server.idm.example.com

      Copy to Clipboard Toggle word wrap

   2. Test if a host is the current CRL publisher.

      [user@server ~]$ ipa-crlgen-manage status
      CRL generation: enabled
      Last CRL update: 2019-10-31 12:00:00
      Last CRL Number: 6
      The ipa-crlgen-manage command was successful

      Copy to Clipboard Toggle word wrap

      A CA server that does not generate the CRL displays CRL generation: disabled.

      [user@replica ~]$ ipa-crlgen-manage status
      CRL generation: disabled
      The ipa-crlgen-manage command was successful

      Copy to Clipboard Toggle word wrap

      Continue entering this command on CA servers until you find the CRL publisher server.

   3. Display all other CA servers you can promote to fulfill these roles. This environment has two CA servers.

      [user@server ~]$ ipa server-role-find --role 'CA server'
      ----------------------
      2 server roles matched
      ----------------------
        Server name: server.idm.example.com
        Role name: CA server
        Role status: enabled
        Server name: replica.idm.example.com
        Role name: CA server
        Role status: enabled
      ----------------------------
      Number of entries returned 2
      ----------------------------

      Copy to Clipboard Toggle word wrap

3. Set replica.idm.example.com as the CA renewal server.

   [user@server ~]$ ipa config-mod --ca-renewal-master-server replica.idm.example.com

   Copy to Clipboard Toggle word wrap

4. On server.idm.example.com:

   1. Disable the certificate updater task:

      [root@server ~]# pki-server ca-config-set ca.certStatusUpdateInterval 0

      Copy to Clipboard Toggle word wrap

   2. Restart IdM services:

      [root@server ~]# ipactl restart

      Copy to Clipboard Toggle word wrap

5. On replica.idm.example.com:

   1. Enable the certificate updater task:

      [root@replica ~]# pki-server ca-config-unset ca.certStatusUpdateInterval

      Copy to Clipboard Toggle word wrap

   2. Restart IdM services:

      [root@replica ~]# ipactl restart

      Copy to Clipboard Toggle word wrap

6. On server.idm.example.com, stop generating the CRL.

   [user@server ~]$ ipa-crlgen-manage disable
   Stopping pki-tomcatd
   Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
   Starting pki-tomcatd
   Editing /etc/httpd/conf.d/ipa-pki-proxy.conf
   Restarting httpd
   CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable.
   The ipa-crlgen-manage command was successful

   Copy to Clipboard Toggle word wrap

7. On replica.idm.example.com, start generating the CRL.

   [user@replica ~]$ ipa-crlgen-manage enable
   Stopping pki-tomcatd
   Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
   Starting pki-tomcatd
   Editing /etc/httpd/conf.d/ipa-pki-proxy.conf
   Restarting httpd
   Forcing CRL update
   CRL generation enabled on the local host. Please make sure to have only a single CRL generation master.
   The ipa-crlgen-manage command was successful

   Copy to Clipboard Toggle word wrap

8. Stop IdM services on server.idm.example.com:

   [root@server ~]# ipactl stop

   Copy to Clipboard Toggle word wrap

9. On replica.idm.example.com, delete server.idm.example.com from the IdM environment.

   [user@replica ~]$ ipa server-del server.idm.example.com

   Copy to Clipboard Toggle word wrap

10. On server.idm.example.com, use the ipa-server-install --uninstall command as the root account:

    [root@server ~]# ipa-server-install --uninstall
    ...
    Are you sure you want to continue with the uninstall procedure? [no]: yes

    Copy to Clipboard Toggle word wrap