Request for enhancement

There have been numerous customer cases concerning failures of, or incorrect renewal of Dogtag system certificates or IPA RA certificate. These certificates use serial-based renewal requests. The request refers to the serial number of the certificate to be renewed. The certificate record is looked up, and from there, the original request record. The details of that request are re-used to create a new certificate.

This has led to problems including:

• Request failure because the original request record cannot be found. This may be due to data that was somehow deleted, or replication failures, or data corruption.
• Request succeed, but the certificate details (e.g. Subject DN) are wrong. The wrong request was looked up. This could be due to conflicting replica request and/or serial ranges

We investigated whether the renewal procedure for these certificate can be changed to use regular enrolment requests instead of serial-based renewal requests, and concluded:

• It is feasible.
• Certmonger tracking requests must record the profile to use.
• Exception: default profile (caServerCert) is used ('Server-Cert cert-pki-ca' and IPA RA)
• For existing installs, ipa-server-upgrade must add the profile template to relevant tracking requests.
• A small update to dogtag-ipa-ca-renew-agent Certmonger helper to instruct dogtag-ipa-renew-agent (part of Certmonger itself) to perform a new enrolment instead of renewal request.

The scenario was tested by upgrading the deployment to with the changes above, and add profile to relevant tracking requests. I deleted the old OCSP certificate record, then renewed it via getcert-resubmit. Renewal succeeded.

We have agreed to proceed with this effort. A bit more work and testing is needed, in particular:

• Extend ipa-server-upgrade to add profiles to KRA cert tracking requests (when KRA is installed)
• More testing.