Chapter 19. Replacing the web server and LDAP server certificates if they have not yet expired on an IdM replica

Procedure

1. Install the certificates contained in ca_certificate_chain_file.crt as additional CA certificates to IdM:

   Copy to Clipboard Toggle word wrap

   # ipa-cacert-manage install

2. Update the local IdM certificate databases with certificates from ca_certicate_chain_file.crt:

   Copy to Clipboard Toggle word wrap

   # ipa-certupdate

3. Generate a private key and a certificate signing request (CSR) using the OpenSSL utility:

   Copy to Clipboard Toggle word wrap

   $ openssl req -new -newkey rsa:4096 -days 365 -nodes -keyout new.key -out new.csr -addext "subjectAltName = DNS:server.idm.example.com" -subj '/CN=server.idm.example.com,O=IDM.EXAMPLE.COM'

   Submit the CSR to the external CA. The process differs depending on the service to be used as the external CA. After the CA signs the certificate, import the certificate to the IdM server.

4. On the IdM server, replace the Apache web server’s old private key and certificate with the new key and the newly-signed certificate:

   Copy to Clipboard Toggle word wrap

   # ipa-server-certinstall -w --pin=password new.key new.crt

   In the command above:

   • The -w option specifies that you are installing a certificate into the web server.
   • The --pin option specifies the password protecting the private key.
5. When prompted, enter the Directory Manager password.

6. Replace the LDAP server’s old private key and certificate with the new key and the newly-signed certificate:

   Copy to Clipboard Toggle word wrap

   # ipa-server-certinstall -d --pin=password new.key new.cert

   In the command above:

   • The -d option specifies that you are installing a certificate into the LDAP server.
   • The --pin option specifies the password protecting the private key.
7. When prompted, enter the Directory Manager password.

8. Restart the httpd service:

   Copy to Clipboard Toggle word wrap

   # systemctl restart httpd.service

9. Restart the Directory service:

   Copy to Clipboard Toggle word wrap

   # systemctl restart dirsrv@IDM.EXAMPLE.COM.service

10. If a subCA has been removed or replaced on the servers, update the clients:

    Copy to Clipboard Toggle word wrap

    # ipa-certupdate