22.3. Recovering from an expired IdM CA certificate

Procedure

1. On the renewal server, renew the CA certificate as self-signed. This command uses the existing private key to generate a new CA certificate with a renewed validity period:

   # ipa-cacert-manage renew --self-signed

   If your certificate is close to its expiry date and renewing it did not push the expiry date forward, see the When IPA’s CA certificate is close to expiry date, renewing it doesn’t push forward the expiry date solution.

2. Fix expired service certificates on the renewal server.

   1. Stop the IdM services:

      # ipactl stop

   2. Run the ipa-cert-fix command to reset the expiration date of expired service certificates in the IdM database:

      # ipa-cert-fix

   3. Issue new certificates and apply them to the IdM services:

      # ipa-certupdate

   4. Restart the IdM services to complete the renewal:

      # ipactl start

3. If your original setup used an externally-signed CA, you must now get the new CA certificate re-signed by your external authority. If you use a self-signed CA, skip this step.

   1. Generate a certificate-signing request (CSR) for the newly renewed CA:

      # ipa-cacert-manage renew --external-ca

      This creates a CSR file at /var/lib/ipa/ca.csr.

   2. Submit the CSR file to your external CA and receive the newly signed certificate and the external CA’s chain of trust.

   3. Install the newly signed certificate back into IdM:

      # ipa-cacert-manage renew --external-cert-file /path/to/new-ca.pem --external-cert-file /path/to/external-chain.pem

4. Propagate the new CA certificate to all IdM servers and clients. Run the ipa-certupdate on the renewal server first, then on all other replicas, and finally on all clients:

   # ipa-certupdate

   This step is critical to ensure all systems in the topology trust the new CA certificate.