17.2. Changing and resetting IdM CA renewal server

Procedure

1. Optional: To find out which IdM servers in the deployment have the CA role necessary to be eligible to become the new CA renewal server:

   ~]$ ipa server-role-find --role 'CA server'
   ----------------------
   2 server roles matched
   ----------------------
     Server name: server.idm.example.com
     Role name: CA server
     Role status: enabled
   
     Server name: replica.idm.example.com
     Role name: CA server
     Role status: enabled
   ----------------------------
   Number of entries returned 2
   ----------------------------

   There are two CA servers in the deployment.

2. Optional: To find out which CA server is the current CA renewal server, enter:

   ~]$ ipa config-show | grep 'CA renewal'
     IPA CA renewal master: server.idm.example.com

   The current renewal server is server.idm.example.com.

3. To change the renewal server configuration, use the ipa config-mod utility with the --ca-renewal-master-server option:

   ~]$ ipa config-mod --ca-renewal-master-server replica.idm.example.com | grep 'CA renewal'
     IPA CA renewal master: replica.idm.example.com

   重要

   You can also switch to a new CA renewal server using:

   • The ipa-cacert-manage --renew command. This command both renews the CA certificate and makes the CA server on which you execute the command the new CA renewal server.
   • The ipa-cert-fix command. This command recovers the deployment when expired certificates are causing failures. It also makes the CA server on which you execute the command the new CA renewal server.