How to determine if an IPA certificate is in use or not?

[Kathy Zhu]

Hi Team,

We have an IPA certificate expiring very soon. I do not believe that is in
use, but I need to verify that. I checked in following two ways:

1, Via GUI, Identity, Services, searched for the host (which is our very
first IPA server), compared each cert against the serial number of the
expiring one.

2, Checked nssdb:

# certutil -L -d /etc/pki/nssdb

Certificate Nickname                                         Trust
Attributes

SSL,S/MIME,JAR/XPI

#

Are there other ways to verify this?

Thank you.

Kathy.

[Rob Crittenden]

Kathy Zhu via FreeIPA-users wrote:
> Hi Team,
>
> We have an IPA certificate expiring very soon. I do not believe that is
> in use, but I need to verify that. I checked in following two ways:

How do you know you have a certificate expiring soon? Where is it
located? Are you trying to see if it is on disk somewhere? You could use
ipa service-find to look for all the services on the host to get the
serial number and a blob of the certificate. That may provide a clue to
its purpose too based on the service principal.
> 1, Via GUI, Identity, Services, searched for the host (which is our very
> first IPA server), compared each cert against the serial number of the
> expiring one.

With the blob you can convert it into PEM format (BEGIN/END header, 64
characters per line). The cert may have a Kerberos principal in it. I
think we encoded it as a SAN in the RHEL-7 days.

It would be tedious though because I don't believe openssl 1.x displays
a SAN UPN, it shows as "other". You can load it into a temporary NSS
database and it would show something like:

Other Name: "HTTP/[e-mail]"
                OID: Microsoft NT Principal Name
> 2, Checked nssdb:
>
> # certutil -L -d /etc/pki/nssdb
>
> Certificate Nickname                                         Trust
> Attributes
>
> SSL,S/MIME,JAR/XPI
>
> #

The only thing we ever put there was the host certificate when we
requested one for all hosts, except servers. So since this is a server I
wouldn't expect one.
> Are there other ways to verify this?

Is certmonger tracking it? If so that gives you the file location(s)
and/or NSS database it is in and you could use that as a starting point.

As I mentioned, if you can find the associated IPA service for the cert
that is a good clue for where to start looking. For example, if it's
something like smtp/hostname then it's probably a mail daemon. If it's
host it could be nfs, etc.

Other I can't think of a clever way to determine if a host is using a
cert other than brute force through a lot of recursive grep, find, etc.

Worst case you wait until after it expires and then it will,
unfortunately, be extremely clear what it is.

rob

[Kathy Zhu]

Thank you, Rob!

I have a cron job which runs "ipa cert-find --validnotafter-from=$from_date
--validnotafter-to=$to_date" weekly to alert me about the expiring
certificate.

The command you gave me works nicely:

ipa service-find | grep "Serial Number:" | grep $my_sn

The expiring serial number is not in the output!

Thank you for the explanation. This server is an IPA server and that's all
it does. Therefore, the above command showed all. I will save the rest of
your tips for other situations.

Many thanks! Have a good night's rest.

Kathy.

On Tue, May 3, 2022 at 3:39 PM Rob Crittenden  wrote:
> Kathy Zhu via FreeIPA-users wrote:
> > Hi Team,
> >
> > We have an IPA certificate expiring very soon. I do not believe that is
> > in use, but I need to verify that. I checked in following two ways:
>
> How do you know you have a certificate expiring soon? Where is it
> located? Are you trying to see if it is on disk somewhere? You could use
> ipa service-find to look for all the services on the host to get the
> serial number and a blob of the certificate. That may provide a clue to
> its purpose too based on the service principal.
> > 1, Via GUI, Identity, Services, searched for the host (which is our very
> > first IPA server), compared each cert against the serial number of the
> > expiring one.
>
> With the blob you can convert it into PEM format (BEGIN/END header, 64
> characters per line). The cert may have a Kerberos principal in it. I
> think we encoded it as a SAN in the RHEL-7 days.
>
> It would be tedious though because I don't believe openssl 1.x displays
> a SAN UPN, it shows as "other". You can load it into a temporary NSS
> database and it would show something like:
>         Other Name: "HTTP/[e-mail]"
>             OID: Microsoft NT Principal Name
>
> > 2, Checked nssdb:
> >
> > # certutil -L -d /etc/pki/nssdb
> >
> > Certificate Nickname                                         Trust
> > Attributes
> >
> > SSL,S/MIME,JAR/XPI
> >
> > #
>
> The only thing we ever put there was the host certificate when we
> requested one for all hosts, except servers. So since this is a server I
> wouldn't expect one.
> > Are there other ways to verify this?
>
> Is certmonger tracking it? If so that gives you the file location(s)
> and/or NSS database it is in and you could use that as a starting point.
>
> As I mentioned, if you can find the associated IPA service for the cert
> that is a good clue for where to start looking. For example, if it's
> something like smtp/hostname then it's probably a mail daemon. If it's
> host it could be nfs, etc.
>
> Other I can't think of a clever way to determine if a host is using a
> cert other than brute force through a lot of recursive grep, find, etc.
>
> Worst case you wait until after it expires and then it will,
> unfortunately, be extremely clear what it is.
>
> rob