Chapter 18. Decommissioning a server that performs the CA renewal server and CRL publisher roles
Chapter 18. Decommissioning a server that performs the CA renewal server and CRL publisher roles You might have one server performing both the Certificate Authority (CA) renewal server role and the Certificate Revocation List (CRL) publisher role. If you need to take this server offline or decommission it, select and configure another CA server to perform these roles. In this example, the host server.idm.example.com , which fulfills the CA renewal server and CRL publisher roles, must be decommissioned. This procedure transfers the CA renewal server and CRL publisher roles to the host replica.idm.example.com and removes server.idm.example.com from the IdM environment. Note You do not need to configure the same server to perform both CA renewal server and CRL publisher roles. Prerequisites You have the IdM administrator credentials. You have the root password for the server you are decommissioning. You have at least two CA replicas in your IdM environment. Procedure Obtain the IdM administrator credentials: Optional: If you are not sure which servers perform the CA renewal server and CRL publisher roles: Display the current CA renewal server. You can run the following command from any IdM server: Test if a host is the current CRL publisher. A CA server that does not generate the CRL displays CRL generation: disabled . Continue entering this command on CA servers until you find the CRL publisher server. Display all other CA servers you can promote to fulfill these roles. This environment has two CA servers. Set replica.idm.example.com as the CA renewal server. On server.idm.example.com : Disable the certificate updater task: Restart IdM services: On replica.idm.example.com : Enable the certificate updater task: Restart IdM services: On server.idm.example.com , stop generating the CRL. On replica.idm.example.com , start generating the CRL. Stop IdM services on server.idm.example.com : On replica.idm.example.com , delete server.idm.example.com from the IdM environment. On server.idm.example.com , use the ipa-server-install --uninstall command as the root account: Verification Display the current CA renewal server. Confirm that the replica.idm.example.com host is generating the CRL. Additional resources Changing and resetting IdM CA renewal server Generating CRL on the IdM CA server Uninstalling an IdM replica
[user@server ~]USD kinit admin Password for admin@IDM.EXAMPLE.COM: [user@server ~]USD ipa config-show | grep 'CA renewal' IPA CA renewal master: server.idm.example.com [user@server ~]USD ipa-crlgen-manage status CRL generation: enabled Last CRL update: 2019-10-31 12:00:00 Last CRL Number: 6 The ipa-crlgen-manage command was successful [user@replica ~]USD ipa-crlgen-manage status CRL generation: disabled The ipa-crlgen-manage command was successful [user@server ~]USD ipa server-role-find --role 'CA server' ---------------------- 2 server roles matched ---------------------- Server name: server.idm.example.com Role name: CA server Role status: enabled Server name: replica.idm.example.com Role name: CA server Role status: enabled ---------------------------- Number of entries returned 2 ---------------------------- [user@server ~]USD ipa config-mod --ca-renewal-master-server replica.idm.example.com pki-server ca-config-set ca.certStatusUpdateInterval 0 ipactl restart pki-server ca-config-unset ca.certStatusUpdateInterval ipactl restart [user@server ~]USD ipa-crlgen-manage disable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable. The ipa-crlgen-manage command was successful [user@replica ~]USD ipa-crlgen-manage enable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd Forcing CRL update CRL generation enabled on the local host. Please make sure to have only a single CRL generation master. The ipa-crlgen-manage command was successful ipactl stop [user@replica ~]USD ipa server-del server.idm.example.com ipa-server-install --uninstall Are you sure you want to continue with the uninstall procedure? [no]: yes [user@replica ~]USD ipa config-show | grep 'CA renewal' IPA CA renewal master: replica.idm.example.com [user@replica ~]USD ipa-crlgen-manage status CRL generation: enabled Last CRL update: 2019-10-31 12:10:00 Last CRL Number: 7 The ipa-crlgen-manage command was successful