19.2. 在 CA 续订服务器上续订过期的系统证书

先决条件

• 您必须以管理员身份登录到服务器。.Procedure

  1. 可选：备份系统。这强烈推荐，因为 ipa-cert-fix 对 nssdb 进行了不可逆更改。因为 ipa-cert-fix 也对 LDAP 进行了更改，因此也建议备份整个集群。

  2. 启动 ipa-cert-fix 工具，以分析系统并列出需要续订的过期证书：

     # ipa-cert-fix

     ...
     The following certificates will be renewed:
     
     Dogtag sslserver certificate:
       Subject: CN=ca1.example.com,O=EXAMPLE.COM 201905222205
       Serial:  13
       Expires: 2019-05-12 05:55:47
     ...
     Enter "yes" to proceed:

  3. 输入 yes 以开始续订过程：

     Enter "yes" to proceed: true

     Proceeding.
     Renewed Dogtag sslserver certificate:
       Subject: CN=ca1.example.com,O=EXAMPLE.COM 201905222205
       Serial:  268369925
       Expires: 2021-08-14 02:19:33
     ...
     
     Becoming renewal master.
     The ipa-cert-fix command was successful

     ipa-cert-fix 更新所有过期证书前最多可能需要一分钟的时间。

验证

• 验证所有服务现在是否都在运行：

  # ipactl status

  Directory Service: RUNNING
  krb5kdc Service: RUNNING
  kadmin Service: RUNNING
  httpd Service: RUNNING
  ipa-custodia Service: RUNNING
  pki-tomcatd Service: RUNNING
  ipa-otpd Service: RUNNING
  ipa: INFO: The ipactl command was successful