Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1518157 - Clarify the need to restart services in ipa-server-certinstall(1)
Summary: Clarify the need to restart services in ipa-server-certinstall(1)
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On:
Blocks: 1565519
TreeView+ depends on / blocked
 
Reported: 2017-11-28 10:46 UTC by Aneta Šteflová Petrová
Modified: 2018-10-30 10:58 UTC (History)
7 users (show)

Fixed In Version: ipa-4.6.4-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1565519 (view as bug list)
Environment:
Last Closed: 2018-10-30 10:57:10 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3187 None None None 2018-10-30 10:58:17 UTC

Description Aneta Šteflová Petrová 2017-11-28 10:46:38 UTC
Description of problem:

DESCRIPTION in ipa-server-certinstall(1) reads:

~~~~
Replace the current Directory server SSL certificate, Apache server SSL certificate and/or Kerberos KDC certificate with the certificate in the specified files.
~~~~

and

~~~~
The service(s) are not automatically restarted. In order to use the newly installed certificate(s) you will need to manually restart the Directory and/or Apache servers.
~~~~

It seems # systemctl restart krb5kdc.service is also needed after installing the KDC certificate, but the man page doesn't say that -- it only says to restart DS and Apache.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:

The man page should clearly list all services that need to be restarted if the certificate(s) changed.


Additional info:

Comment 2 Florence Blanc-Renaud 2017-11-29 09:57:03 UTC
This issue has already been fixed upstream (https://pagure.io/freeipa/issue/7016 ipa_server_certinstall - restart krb5kdc service after kdc cert is installed), in the master branch as well as ipa-4-5 and ipa-4-6 branches.

Comment 4 Petr Vobornik 2018-04-09 15:34:04 UTC
ipa-4-5 patch: https://pagure.io/freeipa/c/512bf317b191ffefcc9baca4f766c1fb010f344f

Comment 9 anuja 2018-07-25 07:49:51 UTC
verified using :
ipa-server-4.6.4-3.el7.x86_64

man ipa-server-certinstall contains :

       The  service(s)  are  not automatically restarted. In order to use the newly installed certificate(s) you will need to manually restart
       the Directory, Apache and/or Krb5kdc servers.


Expected information is there in man page. 
Thus marking it verified.

Comment 11 errata-xmlrpc 2018-10-30 10:57:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187


Note You need to log in before you can comment on or make changes to this bug.