freeipa cert过期或损坏问题说明

 getcert list | egrep 'Request ID|expires'
Request ID '20200528135640':
        expires: unknown
Request ID '20200528135701':
        expires: 2022-05-29 21:57:03 CST
Request ID '20200528135717':
        expires: 2021-08-30 19:23:25 CST
Request ID '20200528135723':
        expires: 2027-02-13 15:47:33 CST

# 拷贝到这里
/usr/lib/x86_64-linux-gnu/libnsspem.so
ldconfig

date -s  2024-xx-xx
#重启这个会自动续订
service certmonger restar

# 或者手动续订
getcert resubmit -i 20220xxx

for line in `getcert list | grep Request | cut -d "'" -f2`; do getcert resubmit -i $line; done

# 删除旧证书
certutil -D -d /etc/dirsrv/slapd-YYDEVOPS-COM  -n "Server-Cert" -f /root/nss-pin.txt

# 在 CA 服务器上执行： 
certutil -S -d /etc/dirsrv/slapd-YYDEVOPS-COM \
  -n "Server-Cert" \
  -s "CN=$(hostname -f),O=YYDEVOPS.COM" \
  -c "caSigningCert cert-pki-ca" \
  -t "u,u,u" -k rsa -g 2048 -Z SHA256 \
  -f /root/nss-pin.txt

#  -n "Server-Cert" → 正确的 nickname。
#  -s → 使用主机 FQDN 作为 CN。
#  -c → 用 CA 签名证书签发。
#  -t "u,u,u" → 设置信任属性。
#  -k rsa -g 2048 -Z SHA256 → 生成 RSA 2048 位，SHA256 签名。


# 如果不是CA机，需要把生成的证书copy到CA机器上进行签名
# 副本机器上  
certutil -R -d /etc/dirsrv/slapd-YYDEVOPS-COM   -s "CN=ipa-70-3.hiido.host.int.yy.com,O=YYDEVOPS.COM"   -n "Server-Cert" -g 2048 -f pwdfile.txt -o server-cert.csr


#说明：
# -n 设置证书昵称 (NSS 数据库中的名字)。
# -g 密钥长度。
# -f pwdfile.txt NSS 数据库密码文件。
# -o server-cert.csr 输出 CSR 文件。

# 在 CA 服务器上执行：
certutil -C -d /etc/pki/pki-tomcat/alias \
  -i /home/liangrui06/70_3_csr/server-cert.csr \
  -o /home/liangrui06/70_3_csr/server-cert.crt \
  -c "caSigningCert cert-pki-ca" \
  -f /root/ca_pwdfile.txt

# 这个密码来自 /root/ca_pwdfile.txt -> /etc/pki/pki-tomcat/password.conf

# 验证新证书
openssl x509 -in /home/liangrui06/70_3_csr/server-cert.crt -noout -text
openssl x509 -in /home/liangrui06/70_3_csr/server-cert.crt -inform DER -out server-cert.pem
openssl x509 -in server-cert.pem -noout -text

#导入副本
certutil -A -d /etc/dirsrv/slapd-YYDEVOPS-COM \
  -n "Server-Cert" \
  -t "u,u,u" \
  -i /home/liangrui06/server-cert.crt \
  -f /etc/dirsrv/slapd-YYDEVOPS-COM/pwdfile.txt

# 说明：-n "Server-Cert"：证书昵称，必须和配置里引用的一致。
# -t "u,u,u"：设置信任属性（SSL、S/MIME、对象签名）。
# -i：指定签名后的证书文件。
# -f：副本机 NSS 库的密码文件（通常是 /etc/dirsrv/slapd-YYDEVOPS-COM/pwdfile.txt）。

# 验证新证书
certutil -L -d /etc/dirsrv/slapd-YYDEVOPS-COM -n "Server-Cert"
certutil -K -d /etc/dirsrv/slapd-YYDEVOPS-COM -f /etc/dirsrv/slapd-YYDEVOPS-COM/pwdfile.txt
# 确认新证书存在且有私钥。

# 导出并转 DER
certutil -L -d /etc/dirsrv/slapd-YYDEVOPS-COM  -n "Server-Cert" -a > /root/ds-server-cert.pem
openssl x509 -in /root/ds-server-cert.pem -out /root/ds-server-cert.der -outform DER

#提取公钥
openssl x509 -in /home/liangrui06/server-cert.crt -inform DER -pubkey -noout \
  | openssl rsa -pubin -outform DER 2>/dev/null \
  | base64 -w 64

certutil -L -d /etc/apache2/nssdb  -n ipaCert

# 获取序列号并转十进制
openssl x509 -in /root/ds-server-cert.pem -noout -serial
# 假设输出 serial=C9510BFB
printf "%d\n" 0xC9510BFB
# 输出 3377531899

# 更新 LDAP 条目
# 创建 /root/server-cert.ldif 内容如下

dn: cn=3377531899,ou=certificateRepository,ou=ca,o=ipaca
objectClass: top
objectClass: certificateRecord
cn: 3377531899
serialno: 053377531899
certStatus: VALID
subjectName: CN=fs-hiido-ipa-65-155.hiido.host.xx.com,O=YYDEVOPS.COM
publicKeyData:: MIIBIjANBgkqhkiG9...
notBefore: 20260211084404Z
notAfter: 20260511084404Z
metaInfo: profileId:caIPAserviceCert
userCertificate;binary:< file:/root/ds-server-cert.der 

#serialno 说明，前面会加01 02 03 04 05我们查询所有的ou=certificateRepository,ou=ca,o=ipaca,看当前最大值，就用这个值就可以了

# 导入389ds：
ldapadd -x -D "cn=Directory Manager" -w $pass -f /root/server-cert.ldif

# 如果是HTTP服务，会映射到某个用户上，映射规则是默认的，也可以手动改 例如下，他是用description来找到用户的，查看内容
ldapsearch -LLL -x -D "cn=Directory Manager" -w xx   -b "uid=ipara,ou=people,o=ipaca" "(objectClass=*)"
dn: uid=ipara,ou=people,o=ipaca
cn: ipara
description: 2;xx;CN=Certificate Authority,O=YYDEVOPS.COM;CN=IPA RA,O=YYDEVOPS
 .COM
objectClass: cmsuser
objectClass: top
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: person
sn: ipara
uid: ipara
userCertificate:: MIIDlD....
....


# 新增以下文件，替换过期的证书和description /tmp/add-ipara.ldif 
dn: uid=ipara,ou=people,o=ipaca
changetype: modify
add: userCertificate
description:  xxx
userCertificate:< file:///tmp/ipa-ra.pem

# 执行替换ipara用户下的证书内容
ldapmodify -x -D "cn=Directory Manager" -W -f /tmp/add-ipara.ldif



6. 重启服务
bash
systemctl restart dirsrv@xx-COM.service
systemctl restart pki-tomcatd.service
systemctl restart apache2.service
systemctl restart certmonger

#可能会执行
rm -rf /var/run/ipa/renewal.lock  # 删除续订锁
pki-server subsystem-enable -i pki-tomcat ca  # 重启启用subsystem

certificates[0].getSubjectDN().toString()
CN=IPA RA,O=YYDEVOPS.COM

certificates[0].getIssuerDN().toString()
CN=Certificate Authority,O=YYDEVOPS.COM

cert.getSerialNumber().toString()
39829
# 调试代码的值是
description=2;39829;CN=Certificate Authority,O=YYDEVOPS.COM;CN=IPA RA,O=YYDEVOPS.COM

    public String getCertificateString(X509Certificate cert) {
        if (cert == null) {
            return null;
        }

        // note that it did not represent a certificate fully
        return cert.getVersion() + ";" + cert.getSerialNumber().toString() +
                ";" + cert.getIssuerDN() + ";" + cert.getSubjectDN();
    }
        String filter = "description=" +
                mUG.getCertificateString(certificates[pos]);
        return mUG.findUsersByCert(filter);

# ldap验证
ldapsearch -LLL -x   -D "cn=Directory Manager" -w xx   -b "ou=People,o=ipaca"   "(description=2;39829;CN=Certificate Authority,O=YYDEVOPS.COM;CN=IPA RA,O=YYDEVOPS.COM)"

新增文件 /root/maxsasliosize.ldif
dn: cn=config
changetype: modify
replace: nsslapd-maxsasliosize
nsslapd-maxsasliosize: 33554432
-
replace: nsslapd-sasl-max-buffer-size
nsslapd-sasl-max-buffer-size: 20971520

# 安装时指定配置
ipa-replica-install  --dirsrv-config-file=/root/maxsasliosize.ldif --skip-conncheck 

#新增文件 modify_http_08.ldif
dn: krbprincipalname=HTTP/fs-hiido-kerveros-test08.hiido.host.xx.com@YYDEVOPS.COM,cn=services,cn=accounts,dc=yydevops,dc=com
changetype: modify
replace: userCertificate
userCertificate:: MIIFKzCC...

ldapmodify -x -D "cn=Directory Manager" -w ipaadmin4yycluster -f modify_http_08.ldif

#日志异常输出
[13/Feb/2026:10:49:36 +0800] - database index operation failed BAD 1040, err=12 Cannot allocate memory
[13/Feb/2026:10:49:36 +0800] - index_add_mods failed, err=12 Cannot allocate memory

stop-dirsrv

修改/etc/dirsrv/slapd-YYDEVOPS-COM/dse.ldif 里的 nsslapd-db-locks配置，默认10000
grep nsslapd-db-locks /etc/dirsrv/slapd-YYDEVOPS-COM/dse.ldif
nsslapd-db-locks: 200000

start-dirsrv 

# 再次执行成功
ldapmodify -x -D "cn=Directory Manager" -w ipaadmin4yycluster -f modify_http_08.ldif

# 然后发现有很多ou=requests,o=ipaca数据，也是超级大，这些是审计日志，可以清理掉
ldapsearch -x -D "cn=Directory Manager" -W -b "ou=requests,o=ipaca" "(requestState=complete)" dn | grep "^dn:" > completed_requests.ldif
ldapmodify -x -D "cn=Directory Manager" -w ipaadmin4yycluster -f  completed_requests.ldif

ipa-client-install --domain=hiido.host.xx.com --realm=xx.COM --server=fs-hiido-ipa-65-155.hiido.host.xx.com  --force-join
ipa-replica-install  --skip-conncheck 
ipa-replica-install --setup-ca  --skip-conncheck

root@ipa-70-7:/home/liangrui06# getcert list | egrep "Request ID|status|expires|key pair storage" 
Request ID '20260213072418':
        status: MONITORING
        key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-YYDEVOPS-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-YYDEVOPS-COM//pwdfile.txt'
        expires: 2028-02-14 07:24:20 UTC
Request ID '20260213072451':
        status: MONITORING
        key pair storage: type=NSSDB,location='/etc/apache2/nssdb',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/apache2/nssdb/pwdfile.txt'
        expires: 2028-02-14 07:24:51 UTC
Request ID '20260213072458':
        status: MONITORING
        key pair storage: type=NSSDB,location='/etc/apache2/nssdb',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/apache2/nssdb/pwdfile.txt'
        expires: 2027-05-25 07:43:19 UTC
Request ID '20260213073208':
        status: MONITORING
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
        expires: 2026-05-06 13:43:44 UTC
Request ID '20260213073209':
        status: MONITORING
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
        expires: 2027-05-25 07:44:01 UTC
Request ID '20260213073210':
        status: MONITORING
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
        expires: 2026-05-10 03:29:18 UTC
Request ID '20260213073211':
        status: MONITORING
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
        expires: 2039-09-10 11:23:06 UTC
Request ID '20260213073212':
        status: MONITORING
        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
        expires: 2028-02-03 07:31:51 UTC