IPA isn't setting ca.certStatusUpdateInterval during a replica install. This value is added by the PKi installer.

Which also means that when ipa-crlgen-manage disable is run we should set this value to 0 to prevent the former generator from calculating cert status.

PR https://github.com/freeipa/freeipa/pull/7317

Turns out I ran into this issue a long time ago and made some notes about it.

My first server was called ipa0. I later added ipa2 to the topology and ran 'ipa-crlgen-manage' on it.

According to my notes, after doing this there were still the following config differences between ipa0 and ipa2:

ca.certStatusUpdateInterval
ipa0: unset
ipa2: 0

ca.listenToCloneModifications
ipa0: true
ipa2: false

master.ca.agent.host
ipa0: unset
ipa2: ipa0.example.com

master.ca.agent.port
ipa0: unset
ipa2: 443

I wonder if ipa-crlgen-manage should also manage ca.listenToCloneModifications as well as ca.certStatusUpdateInterval? That way, setting a server as the CRL generator will line all the settings up with what would be set on the first server of a freshly installed domain:

https://github.com/freeipa/freeipa/blob/d16c34997f2223bd3f3d00a734c3372552bd8863/ipaserver/install/cainstance.py#L1020

Yes, ca.listenToCloneModifications should follow the enable/disable status of CRL generation on a server.

master:

• f78d25f ipa-crlgen-manage: manage the cert status task execution time

ipa-4-11:

• 6716687 ipa-crlgen-manage: manage the cert status task execution time

ipa-4-10:

• d50928f ipa-crlgen-manage: manage the cert status task execution time

ipa-4-9:

• 74791ea ipa-crlgen-manage: manage the cert status task execution time