ipa-cert-fix(1)

💖 ipa-cert-fix — the IPA manual page, but make it make sense 💖

okay bestie, so this is the page for ipa-cert-fix from the IPA Manual Pages, and it is lowkey a rescue-mission situation, so pay attention 🫶

---

✨ NAME ✨

ipa-cert-fix — renew expired certificates 🔥

---

✨ SYNOPSIS ✨

ipa-cert-fix [options]

---

🌸 DESCRIPTION 🌸

So. ipa-cert-fix is the tool you reach for when expired certificates have fully broken normal operation of IPA. That's it. That's the whole job. It is not a casual lil maintenance command, bestie. It should ONLY be used in those scenarios, and a backup of the system — especially certificates and keys — is STRONGLY RECOMMENDED. Like, back it up. Do it. 💅

Do not use this program unless expired certificates are inhibiting normal operation and renewal procedures. I'm serious, this is not a "just vibes" command.

Now, if what you actually need is to renew the IPA CA certificate? That's a different girl. Use ipa-cacert-manage(1). 💖

Also important: this tool cannot renew certificates signed by external CAs. If you need to install new, externally-signed HTTP, LDAP or KDC certificates, that's ipa-server-certinstall(1)'s moment to shine ✨

Okay so what does it actually do? ipa-cert-fix examines IPA and Certificate System certificates and renews the ones that are expired, or close to expiry (less than two weeks). Two weeks is the cutoff, no cap. 👑

And here's the iconic part: if any "shared" certificates get renewed, ipa-cert-fix sets the current server to be the CA renewal master, and adds the new shared certificate(s) to LDAP so they replicate out to the other CA servers. 🌈 So what counts as "shared"? All Dogtag system certificates except the HTTPS certificate, plus the IPA RA certificate. That's the list, periodt.

---

🦋 fixing certificates across multiple CA servers 🦋

Bestie this is a whole choreography, so follow the steps in order:

1. First, make sure LDAP replication is working across the topology. No replication, no party. 🚫
2. Then run ipa-cert-fix on one CA server.
3. Before you run ipa-cert-fix on another CA server, trigger Certmonger renewals for shared certificates via getcert-resubmit(1) — on the other CA server. This is to avoid unnecessary renewal of shared certificates. 🙈

---

⚠️ important note, do not skip this ⚠️

The certmonger daemon does not immediately notice the updated certificates, and it may trigger a renewal after ipa-cert-fix completes. As a consequence, getcert list output may display that a renewal is in progress even if ipa-cert-fix just finished. 😭 So the move is: monitor the certmonger-initiated renewal and wait for its completion before any other administrative task. Wait for it. Let it cook. 🍓

---

💅 OPTIONS 💅

• --version — shows the program's version and then dips out. ✌️
• -h, --help — shows the help for this program. your little safety net 🫶
• -v, --verbose — prints debugging information. the tea, all of it. 🍵
• -q, --quiet — output only errors (tho heads up, output from child processes may still show up anyway 💀).
• --log-file=FILE — logs to the given file. keep the receipts bestie 📝

---

⭐ EXIT STATUS ⭐

• 0 — the command was successful. slay. 🎀
• 1 — an error occurred. 💀

---

🌈 SEE ALSO 🌈

ipa-cacert-manage(1) ipa-server-certinstall(1) getcert-resubmit(1)

---

okay that's the whole page, you're fully caught up ✨ this was the IPA manual page, dated Mar 25 2019, straight from the IPA Manual Pages collection 💜 go fix those certs bestie, ily, bye 🦋