Current doc for this feature:

https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Setting_up_Specific_Jobs.html#Configuration_Parameters_of_certRenewalNotifier

This is great. I don't see anything about how often the notifications will repeat. Will they repeat every time the job runs (daily)? Or is it just a one time hit? What we are looking for is a repeat frequency. Something like:

• first notification goes out at 90 days
• then 60 days
• then 30 days
• then 15 days
• then 5 days and every day until the cert expires or is renewed

The settings also appear to be global. It would be useful to be able to override settings on a per-profile level.

Thanks!

From IRC conversation of 10/20/2015: 10.3 - minor

Replying to [comment:3 bja]:

This is great. I don't see anything about how often the notifications will repeat. Will they repeat every time the job runs (daily)? Or is it just a one time hit? What we are looking for is a repeat frequency. Something like:

• first notification goes out at 90 days
• then 60 days
• then 30 days
• then 15 days
• then 5 days and every day until the cert expires or is renewed

The settings also appear to be global. It would be useful to be able to override settings on a per-profile level.

Thanks!

Yes. The certRenewalNotifier example you see in the default CS.cfg is just one instance as your example. You can create multiple instances of the same RenewalNotificationJob plugin and give it/them different config's with different instance names like certRenewalNotifier15 for 15-day notice, etc.
This of course will take up more cycles than having just one job that does all the checks.

The existing job plugins are not currently tied into the profile framework.

Regarding email recipient, I think this particular default plugin only sends a summary report to the recipient list listed in the configuration instead of affected individual.
But I imagine you could use this default plugin as a template and massage it to extract email info from the request record.

This is what is planned to be done for this ticket:

• either a new job plugin will be written, or the existing RenewalNotificationJob will be expanded to support the new options
• New option is, when the job wakes up at set time,it looks for all certs that are about to expire in N days, and instead of sending one single summary email to the email list specified in CS.cfg, it will
  1. Use the the email resolver to resolve the email per cert in the following order:
  a. the "requestor email" of the original request
  b. the mail attribute of the Subject DN of the cert
  c. the mail attribute of the Subject Alternative name extension
  b. sort all certs' info so that all certs bearing the same resolved email will be grouped and send as one summary email

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1303173

Per CS Bug/Ticket Triage held 04/19/2016: 10.4

Per 10.5.x/10.6 Triage: FUTURE

RHBZ: CLOSED UPSTREAM

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2194

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.