Chapter 20. Replacing the web server and LDAP server certificates if they have not yet expired on an IdM replica

As an Identity Management (IdM) system administrator, you can manually replace the certificates for the web (or httpd) and LDAP (or Directory) services running on an IdM server. For example, this might be necessary if the certificates are nearing expiration and if the certmonger utility is either not configured to renew the certificates automatically or if the certificates are signed by an external certificate authority (CA).

The example installs the certificates for the services running on the server.idm.example.com IdM server. You obtain the certificates from an external CA.

Note

The HTTP and LDAP service certificates have different keypairs and subject names on different IdM servers and so you must renew the certificates on each IdM server individually.

Prerequisites

On at least one other IdM replica in the topology with which the IdM server has a replication agreement, the web and LDAP certificates are still valid. This is a prerequisite for the ipa-server-certinstall command. The command requires a TLS connection to communicate with other IdM replicas. However, with invalid certificates, such a connection could not be established, and the ipa-server-certinstall command would fail. In that case, see Replacing the web server and LDAP server certificates if they have expired in the whole IdM deployment.
You have root access to the IdM server.
You know the Directory Manager password.
You have access to a file storing the CA certificate chain of the external CA, ca_certificate_chain_file.crt.

Procedure

Install the certificates contained in ca_certificate_chain_file.crt as additional CA certificates to IdM:
```
ipa-cacert-manage install
```
```
# ipa-cacert-manage install
```
Copy to Clipboard Toggle word wrap
Update the local IdM certificate databases with certificates from ca_certicate_chain_file.crt:
```
ipa-certupdate
```
```
# ipa-certupdate
```
Copy to Clipboard Toggle word wrap

Generate a private key and a certificate signing request (CSR) using the OpenSSL utility:

openssl req -new -newkey rsa:4096 -days 365 -nodes -keyout new.key -out new.csr -addext "subjectAltName = DNS:server.idm.example.com" -subj '/CN=server.idm.example.com,O=IDM.EXAMPLE.COM'

$ openssl req -new -newkey rsa:4096 -days 365 -nodes -keyout new.key -out new.csr -addext "subjectAltName = DNS:server.idm.example.com" -subj '/CN=server.idm.example.com,O=IDM.EXAMPLE.COM'

Copy to Clipboard

Toggle word wrap

Submit the CSR to the external CA. The process differs depending on the service to be used as the external CA. After the CA signs the certificate, import the certificate to the IdM server.

On the IdM server, replace the Apache web server’s old private key and certificate with the new key and the newly-signed certificate:
```
ipa-server-certinstall -w --pin=password new.key new.crt
```
```
# ipa-server-certinstall -w --pin=password new.key new.crt
```
Copy to Clipboard Toggle word wrap
In the command above:
- The -w option specifies that you are installing a certificate into the web server.
- The --pin option specifies the password protecting the private key.
When prompted, enter the Directory Manager password.
Replace the LDAP server’s old private key and certificate with the new key and the newly-signed certificate:
```
ipa-server-certinstall -d --pin=password new.key new.cert
```
```
# ipa-server-certinstall -d --pin=password new.key new.cert
```
Copy to Clipboard Toggle word wrap
In the command above:
- The -d option specifies that you are installing a certificate into the LDAP server.
- The --pin option specifies the password protecting the private key.
When prompted, enter the Directory Manager password.
Restart the httpd service:
```
systemctl restart httpd.service
```
```
# systemctl restart httpd.service
```
Copy to Clipboard Toggle word wrap

Restart the Directory service:

systemctl restart dirsrv@IDM.EXAMPLE.COM.service

# systemctl restart dirsrv@IDM.EXAMPLE.COM.service

Copy to Clipboard

Toggle word wrap

If a subCA has been removed or replaced on the servers, update the clients:
```
ipa-certupdate
```
```
# ipa-certupdate
```
Copy to Clipboard Toggle word wrap

Voltar ao topo

Este conteúdo não está disponível no idioma selecionado.

Chapter 20. Replacing the web server and LDAP server certificates if they have not yet expired on an IdM replica

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Tornando o open source mais inclusivo

Sobre a Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links