ipa-acme-manage(1)

💅 ipa-acme-manage — the IPA Manual Pages glow-up

okay bestie, so ipa-acme-manage is literally the girlboss in charge of the IPA ACME service, and this whole page is her user manual. no cap.

---

✨ NAME ✨

ipa-acme-manage — manage the IPA ACME service 🎀

---

✨ SYNOPSIS ✨

ipa-acme-manage enable|disable|status

---

✨ DESCRIPTION ✨

bestie. listen. ipa-acme-manage is the command you use to enable, disable, or peek at the status of the ACME service on a IPA CA server. that's the whole vibe. three moves. iconic.

so here's the tea about IPA topology: every CA server that's capable of ACME will have the ACME service deployed on it. periodt. but — and this is the important part — the service is not enabled by default. it just sits there, chilling, unbothered, waiting for you to make a decision.

the expectation is that the ACME service is either enabled on all CA servers or disabled on all CA servers. keep it consistent, bestie, we don't do chaos here. 🌈 but heads up: even though the goal is all-or-nothing, you still have to actually run the enable or disable on each individual server. no shortcuts, no group chat vote, one server at a time. 💅

---

✨ COMMANDS ✨

• enable — turn the ACME service on for this host. slay.
• disable — turn the ACME service off for this host. not slay but sometimes necessary.
• status — show you the status of the ACME service. the vibe check, if you will. 👀
• pruning — configure certificate and request pruning. this one gets its own whole section, she's the main character.

---

✨ PRUNING ✨

okay so pruning is a job that runs in the CA and its whole thing is removing expired certificates and certificate requests that were never issued. and honestly? this is especially important when you're out here using short-lived certificates, like the ones issued with the ACME protocol. those babies expire fast and the clutter adds up. 🌸

⚠️ pruning requires that the IPA server be installed with random serial numbers enabled. no random serial numbers, no pruning. that's the rule.

⚠️ also — the CA needs to be restarted after you modify the pruning configuration. don't forget. i'm begging you. 😭

so the job itself is a cron-like task within the CA, and it's controlled by a bunch of options that dictate how long after the certificate or request is considered no longer valid before it gets removed from the LDAP database.

the cron time and date fields are:

• minute — allowed values: 0-59
• hour — allowed values: 0-23
• day of month — allowed values: 1-31
• month — allowed values: 1-12
• day of week — allowed values: 0-6 (0 is Sunday)

and here's the limitation bestie, don't shoot the messenger: the cron syntax is limited to * or specific numbers. ranges are not supported. so no 1-5 situations. i know. i know. 💀

---

🎀 the pruning options 🎀

• --enable — enable certificate pruning. turn it on, let her cook. 🔥
• --disable — disable certificate pruning. turn it off.
• --cron=CRON — configure the pruning cron job. the syntax is similar to crontab(5) syntax. for example, "0 0 1 * *" schedules the job to run at 12:00am on the first day of each month. cute, right? ⭐
• --certretention=CERTRETENTION — certificate retention time. the default is 30. and a value of 0 will remove expired certificates with no delay. instant. zero chill. 💀
• --certretentionunit=CERTRETENTIONUNIT — certificate retention units. valid units are: minute, hour, day, year. the default is days.
• --certsearchsizelimit=CERTSEARCHSIZELIMIT — LDAP search size limit when searching for expired certificates. the default is 1000. this is a client-side limit, so heads up: there may be additional server-side limitations. 🙈
• --certsearchtimelimit=CERTSEARCHTIMELIMIT — LDAP search time limit (in seconds) when searching for expired certificates. the default is 0, which means no limit. again, this is a client-side limit and there may be additional server-side limitations.
• --requestretention=REQUESTRETENTION — request retention time. the default is 30. a value of 0 will remove expired requests with no delay.
• --requestretentionunit=REQUESTRETENTIONUNIT — request retention units. valid units are: minute, hour, day, year. the default is days.
• --requestsearchsizelimit=REQUESTSEARCHSIZELIMIT — LDAP search size limit when searching for unfulfilled requests. the default is 1000. there may be additional server-side limitations.
• --requestsearchtimelimit=REQUESTSEARCHTIMELIMIT — LDAP search time limit (in seconds) when searching for unfulfilled requests. the default is 0, no limit. and yes, there may be additional server-side limitations. 🫶
• --config-show — show the current pruning configuration. the mirror selfie. ✨
• --run — run the pruning job right now. the IPA RA certificate is used to authenticate to the PKI REST backend. go girl, go. 👑

---

✨ EXIT STATUS ✨

the receipts, in order:

1. 0 — if the command was successful 🎉
2. 1 — if an error occurred 😭
3. 2 — if the host is not a IPA server
4. 3 — if the host is not a CA server

---

and that's the whole page, bestie. this beauty shipped as part of the IPA manual pages, dated Jun 2 2020. go forth and prune responsibly. mwah. 💖✨🎀