{"action":"created","comment":{"url":"https://api.github.com/repos/dogtagpki/pki/pulls/comments/244874203","pull_request_review_id":188833871,"id":244874203,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDI0NDg3NDIwMw==","diff_hunk":"@@ -0,0 +1,178 @@\n+Offline Cert Renewal\n+====================\n+\n+## Overview\n+\n+PKI server provides a mechanism to recover from expired system certificates. This mechanism can also be\n+used to renew the certificates before they expire. There are 2 ways to renew the certs\n+\n+1. [Automated Renewal Process](#Automated-Renewal-Process)\n+2. [Manual Renewal Process](#Manual-Renewal-Process) \n+\n+It is assumed that you have the following:\n+* Valid CA signing cert\n+* Valid admin cert\n+\n+To verify these assumptions are valid:\n+\n+1. List details of all system certificates. (Note down the `<cert ID>` of the certs that needs to be renewed)\n+\n+    ````\n+    # pki-server cert-find\n+    ````\n+\n+2. Check details of admin cert\n+\n+    ````\n+    # certutil -L \\\n+    -d <client NSS DB dir> \\\n+    -n <admin cert nickname>\n+    ````\n+\n+3. Check status of PKI server\n+\n+    ````\n+    # systemctl status pki-tomcatd@pki-tomcat\n+    ````\n+\n+## Automated Renewal Process\n+\n+One line tool that fixes all certificates:\n+\n+    # pki-server cert-fix \\\n+    -n <admin nickname> \\\n+    -d <NSS db path> \\\n+    -c <NSS client DB password>\n+\n+\n+One line tool to fix one particular certificate:\n+\n+    # pki-server cert-fix --cert <cert ID> \\\n+    -n <admin nickname> \\\n+    -d <NSS db path> \\\n+    -c <NSS client DB password>\n+\n+For all available options, you can type:\n+\n+    $ pki-server cert-fix --help\n+\n+## Manual Renewal Process\n+### Initialization\n+\n+It is recommended to run the following steps to ensure that `CS.cfg` and NSS db are synchronized and\n+that the server can operate without any issues.\n+\n+1. Disable self tests. Remove the following line from CS.cfg for the <subsystem> you are renewing.\n+The CS.cfg is located in `/etc/pki/<instance>/<subsystem>/CS.cfg`\n+\n+    ````\n+    selftests.container.order.startup=CAPresence:critical, SystemCertsVerification:critical\n+    ````\n+\n+    **OR**\n+\n+    Use the built-in tool:\n+\n+    ````\n+    # pki-server selftest-disable -i <instance_name>\n+    ````\n+2. Synchronize NSS DB and CS.cfg\n+\n+    ````\n+    # pki-server cert-update <cert ID> # for all system certificates that is to be renewed\n+    ````\n+\n+### Bringing up the PKI server\n+\n+1. Create temp SSL certificate\n+    ````\n+    # pki-server cert-create sslserver --temp\n+    ````\n+\n+2. Delete the existing System cert if exist\n+    ````\n+    # pki-server cert-del sslserver\n+    ````\n+\n+3. Import temp SSL certificate created in previous step\n+    ````\n+    # pki-server cert-import sslserver\n+    ````\n+\n+4. Start server\n+    ````\n+    # systemctl start pki-tomcatd@pki-tomcat\n+    ````\n+\n+### System Certificate Renewal\n+\n+1. Renew required system certs using PKI tool:\n+    ````\n+    # pki-server cert-create --renew \\\n+    -n <admin nickname> \\\n+    -d <NSS db path> \\\n+    -c <NSS client DB password>","path":"docs/admin/Offline_Cert_Renewal.md","position":114,"original_position":114,"commit_id":"9f5d4c21e80e52b6ef7fd23d5ff1a61e538089e9","original_commit_id":"9f5d4c21e80e52b6ef7fd23d5ff1a61e538089e9","user":{"login":"edewata","id":25089672,"node_id":"MDQ6VXNlcjI1MDg5Njcy","avatar_url":"https://avatars0.githubusercontent.com/u/25089672?v=4","gravatar_id":"","url":"https://api.github.com/users/edewata","html_url":"https://github.com/edewata","followers_url":"https://api.github.com/users/edewata/followers","following_url":"https://api.github.com/users/edewata/following{/other_user}","gists_url":"https://api.github.com/users/edewata/gists{/gist_id}","starred_url":"https://api.github.com/users/edewata/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edewata/subscriptions","organizations_url":"https://api.github.com/users/edewata/orgs","repos_url":"https://api.github.com/users/edewata/repos","events_url":"https://api.github.com/users/edewata/events{/privacy}","received_events_url":"https://api.github.com/users/edewata/received_events","type":"User","site_admin":false},"body":"Let's call this \"admin NSS database password\".","created_at":"2019-01-02T22:30:51Z","updated_at":"2019-01-02T22:53:07Z","html_url":"https://github.com/dogtagpki/pki/pull/132#discussion_r244874203","pull_request_url":"https://api.github.com/repos/dogtagpki/pki/pulls/132","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/dogtagpki/pki/pulls/comments/244874203"},"html":{"href":"https://github.com/dogtagpki/pki/pull/132#discussion_r244874203"},"pull_request":{"href":"https://api.github.com/repos/dogtagpki/pki/pulls/132"}}},"pull_request":{"url":"https://api.github.com/repos/dogtagpki/pki/pulls/132","id":240598599,"node_id":"MDExOlB1bGxSZXF1ZXN0MjQwNTk4NTk5","html_url":"https://github.com/dogtagpki/pki/pull/132","diff_url":"https://github.com/dogtagpki/pki/pull/132.diff","patch_url":"https://github.com/dogtagpki/pki/pull/132.patch","issue_url":"https://api.github.com/repos/dogtagpki/pki/issues/132","number":132,"state":"open","locked":false,"title":"Add doc for Offline Cert Renewal","user":{"login":"SilleBille","id":8215572,"node_id":"MDQ6VXNlcjgyMTU1NzI=","avatar_url":"https://avatars3.githubusercontent.com/u/8215572?v=4","gravatar_id":"","url":"https://api.github.com/users/SilleBille","html_url":"https://github.com/SilleBille","followers_url":"https://api.github.com/users/SilleBille/followers","following_url":"https://api.github.com/users/SilleBille/following{/other_user}","gists_url":"https://api.github.com/users/SilleBille/gists{/gist_id}","starred_url":"https://api.github.com/users/SilleBille/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SilleBille/subscriptions","organizations_url":"https://api.github.com/users/SilleBille/orgs","repos_url":"https://api.github.com/users/SilleBille/repos","events_url":"https://api.github.com/users/SilleBille/events{/privacy}","received_events_url":"https://api.github.com/users/SilleBille/received_events","type":"User","site_admin":false},"body":"Version specific document has been designed for Offline cert renewal.\r\n\r\nRef: [10.6 Offline Cert Renewal](https://www.dogtagpki.org/wiki/Offline_System_Certificate_Renewal)\r\n\r\n`Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>`","created_at":"2018-12-21T23:26:19Z","updated_at":"2019-01-02T22:53:07Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1432b3ad11df99921a6f2f8d9668bf854509a3ff","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/dogtagpki/pki/pulls/132/commits","review_comments_url":"https://api.github.com/repos/dogtagpki/pki/pulls/132/comments","review_comment_url":"https://api.github.com/repos/dogtagpki/pki/pulls/comments{/number}","comments_url":"https://api.github.com/repos/dogtagpki/pki/issues/132/comments","statuses_url":"https://api.github.com/repos/dogtagpki/pki/statuses/9f5d4c21e80e52b6ef7fd23d5ff1a61e538089e9","head":{"label":"SilleBille:offline-cert-document","ref":"offline-cert-document","sha":"9f5d4c21e80e52b6ef7fd23d5ff1a61e538089e9","user":{"login":"SilleBille","id":8215572,"node_id":"MDQ6VXNlcjgyMTU1NzI=","avatar_url":"https://avatars3.githubusercontent.com/u/8215572?v=4","gravatar_id":"","url":"https://api.github.com/users/SilleBille","html_url":"https://github.com/SilleBille","followers_url":"https://api.github.com/users/SilleBille/followers","following_url":"https://api.github.com/users/SilleBille/following{/other_user}","gists_url":"https://api.github.com/users/SilleBille/gists{/gist_id}","starred_url":"https://api.github.com/users/SilleBille/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SilleBille/subscriptions","organizations_url":"https://api.github.com/users/SilleBille/orgs","repos_url":"https://api.github.com/users/SilleBille/repos","events_url":"https://api.github.com/users/SilleBille/events{/privacy}","received_events_url":"https://api.github.com/users/SilleBille/received_events","type":"User","site_admin":false},"repo":{"id":146354302,"node_id":"MDEwOlJlcG9zaXRvcnkxNDYzNTQzMDI=","name":"pki","full_name":"SilleBille/pki","private":false,"owner":{"login":"SilleBille","id":8215572,"node_id":"MDQ6VXNlcjgyMTU1NzI=","avatar_url":"https://avatars3.githubusercontent.com/u/8215572?v=4","gravatar_id":"","url":"https://api.github.com/users/SilleBille","html_url":"https://github.com/SilleBille","followers_url":"https://api.github.com/users/SilleBille/followers","following_url":"https://api.github.com/users/SilleBille/following{/other_user}","gists_url":"https://api.github.com/users/SilleBille/gists{/gist_id}","starred_url":"https://api.github.com/users/SilleBille/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SilleBille/subscriptions","organizations_url":"https://api.github.com/users/SilleBille/orgs","repos_url":"https://api.github.com/users/SilleBille/repos","events_url":"https://api.github.com/users/SilleBille/events{/privacy}","received_events_url":"https://api.github.com/users/SilleBille/received_events","type":"User","site_admin":false},"html_url":"https://github.com/SilleBille/pki","description":"Dogtag PKI Issues should be reported to the Dogtag PKI Pagure Issues site","fork":true,"url":"https://api.github.com/repos/SilleBille/pki","forks_url":"https://api.github.com/repos/SilleBille/pki/forks","keys_url":"https://api.github.com/repos/SilleBille/pki/keys{/key_id}","collaborators_url":"https://api.github.com/repos/SilleBille/pki/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/SilleBille/pki/teams","hooks_url":"https://api.github.com/repos/SilleBille/pki/hooks","issue_events_url":"https://api.github.com/repos/SilleBille/pki/issues/events{/number}","events_url":"https://api.github.com/repos/SilleBille/pki/events","assignees_url":"https://api.github.com/repos/SilleBille/pki/assignees{/user}","branches_url":"https://api.github.com/repos/SilleBille/pki/branches{/branch}","tags_url":"https://api.github.com/repos/SilleBille/pki/tags","blobs_url":"https://api.github.com/repos/SilleBille/pki/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/SilleBille/pki/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/SilleBille/pki/git/refs{/sha}","trees_url":"https://api.github.com/repos/SilleBille/pki/git/trees{/sha}","statuses_url":"https://api.github.com/repos/SilleBille/pki/statuses/{sha}","languages_url":"https://api.github.com/repos/SilleBille/pki/languages","stargazers_url":"https://api.github.com/repos/SilleBille/pki/stargazers","contributors_url":"https://api.github.com/repos/SilleBille/pki/contributors","subscribers_url":"https://api.github.com/repos/SilleBille/pki/subscribers","subscription_url":"https://api.github.com/repos/SilleBille/pki/subscription","commits_url":"https://api.github.com/repos/SilleBille/pki/commits{/sha}","git_commits_url":"https://api.github.com/repos/SilleBille/pki/git/commits{/sha}","comments_url":"https://api.github.com/repos/SilleBille/pki/comments{/number}","issue_comment_url":"https://api.github.com/repos/SilleBille/pki/issues/comments{/number}","contents_url":"https://api.github.com/repos/SilleBille/pki/contents/{+path}","compare_url":"https://api.github.com/repos/SilleBille/pki/compare/{base}...{head}","merges_url":"https://api.github.com/repos/SilleBille/pki/merges","archive_url":"https://api.github.com/repos/SilleBille/pki/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/SilleBille/pki/downloads","issues_url":"https://api.github.com/repos/SilleBille/pki/issues{/number}","pulls_url":"https://api.github.com/repos/SilleBille/pki/pulls{/number}","milestones_url":"https://api.github.com/repos/SilleBille/pki/milestones{/number}","notifications_url":"https://api.github.com/repos/SilleBille/pki/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/SilleBille/pki/labels{/name}","releases_url":"https://api.github.com/repos/SilleBille/pki/releases{/id}","deployments_url":"https://api.github.com/repos/SilleBille/pki/deployments","created_at":"2018-08-27T21:04:55Z","updated_at":"2018-12-03T19:44:09Z","pushed_at":"2018-12-21T23:28:31Z","git_url":"git://github.com/SilleBille/pki.git","ssh_url":"git@github.com:SilleBille/pki.git","clone_url":"https://github.com/SilleBille/pki.git","svn_url":"https://github.com/SilleBille/pki","homepage":"https://pagure.io/dogtagpki/issues","size":25190,"stargazers_count":1,"watchers_count":1,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":12,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":12,"watchers":1,"default_branch":"master"}},"base":{"label":"dogtagpki:master","ref":"master","sha":"63620a8b43452e29233b38c5c4b5987294c8cb1e","user":{"login":"dogtagpki","id":25308299,"node_id":"MDEyOk9yZ2FuaXphdGlvbjI1MzA4Mjk5","avatar_url":"https://avatars3.githubusercontent.com/u/25308299?v=4","gravatar_id":"","url":"https://api.github.com/users/dogtagpki","html_url":"https://github.com/dogtagpki","followers_url":"https://api.github.com/users/dogtagpki/followers","following_url":"https://api.github.com/users/dogtagpki/following{/other_user}","gists_url":"https://api.github.com/users/dogtagpki/gists{/gist_id}","starred_url":"https://api.github.com/users/dogtagpki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dogtagpki/subscriptions","organizations_url":"https://api.github.com/users/dogtagpki/orgs","repos_url":"https://api.github.com/users/dogtagpki/repos","events_url":"https://api.github.com/users/dogtagpki/events{/privacy}","received_events_url":"https://api.github.com/users/dogtagpki/received_events","type":"Organization","site_admin":false},"repo":{"id":82218569,"node_id":"MDEwOlJlcG9zaXRvcnk4MjIxODU2OQ==","name":"pki","full_name":"dogtagpki/pki","private":false,"owner":{"login":"dogtagpki","id":25308299,"node_id":"MDEyOk9yZ2FuaXphdGlvbjI1MzA4Mjk5","avatar_url":"https://avatars3.githubusercontent.com/u/25308299?v=4","gravatar_id":"","url":"https://api.github.com/users/dogtagpki","html_url":"https://github.com/dogtagpki","followers_url":"https://api.github.com/users/dogtagpki/followers","following_url":"https://api.github.com/users/dogtagpki/following{/other_user}","gists_url":"https://api.github.com/users/dogtagpki/gists{/gist_id}","starred_url":"https://api.github.com/users/dogtagpki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dogtagpki/subscriptions","organizations_url":"https://api.github.com/users/dogtagpki/orgs","repos_url":"https://api.github.com/users/dogtagpki/repos","events_url":"https://api.github.com/users/dogtagpki/events{/privacy}","received_events_url":"https://api.github.com/users/dogtagpki/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/dogtagpki/pki","description":"Dogtag PKI Issues should be reported to the Dogtag PKI Pagure Issues site","fork":false,"url":"https://api.github.com/repos/dogtagpki/pki","forks_url":"https://api.github.com/repos/dogtagpki/pki/forks","keys_url":"https://api.github.com/repos/dogtagpki/pki/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dogtagpki/pki/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dogtagpki/pki/teams","hooks_url":"https://api.github.com/repos/dogtagpki/pki/hooks","issue_events_url":"https://api.github.com/repos/dogtagpki/pki/issues/events{/number}","events_url":"https://api.github.com/repos/dogtagpki/pki/events","assignees_url":"https://api.github.com/repos/dogtagpki/pki/assignees{/user}","branches_url":"https://api.github.com/repos/dogtagpki/pki/branches{/branch}","tags_url":"https://api.github.com/repos/dogtagpki/pki/tags","blobs_url":"https://api.github.com/repos/dogtagpki/pki/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dogtagpki/pki/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dogtagpki/pki/git/refs{/sha}","trees_url":"https://api.github.com/repos/dogtagpki/pki/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dogtagpki/pki/statuses/{sha}","languages_url":"https://api.github.com/repos/dogtagpki/pki/languages","stargazers_url":"https://api.github.com/repos/dogtagpki/pki/stargazers","contributors_url":"https://api.github.com/repos/dogtagpki/pki/contributors","subscribers_url":"https://api.github.com/repos/dogtagpki/pki/subscribers","subscription_url":"https://api.github.com/repos/dogtagpki/pki/subscription","commits_url":"https://api.github.com/repos/dogtagpki/pki/commits{/sha}","git_commits_url":"https://api.github.com/repos/dogtagpki/pki/git/commits{/sha}","comments_url":"https://api.github.com/repos/dogtagpki/pki/comments{/number}","issue_comment_url":"https://api.github.com/repos/dogtagpki/pki/issues/comments{/number}","contents_url":"https://api.github.com/repos/dogtagpki/pki/contents/{+path}","compare_url":"https://api.github.com/repos/dogtagpki/pki/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dogtagpki/pki/merges","archive_url":"https://api.github.com/repos/dogtagpki/pki/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dogtagpki/pki/downloads","issues_url":"https://api.github.com/repos/dogtagpki/pki/issues{/number}","pulls_url":"https://api.github.com/repos/dogtagpki/pki/pulls{/number}","milestones_url":"https://api.github.com/repos/dogtagpki/pki/milestones{/number}","notifications_url":"https://api.github.com/repos/dogtagpki/pki/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dogtagpki/pki/labels{/name}","releases_url":"https://api.github.com/repos/dogtagpki/pki/releases{/id}","deployments_url":"https://api.github.com/repos/dogtagpki/pki/deployments","created_at":"2017-02-16T19:36:36Z","updated_at":"2019-01-02T15:56:58Z","pushed_at":"2019-01-02T15:56:55Z","git_url":"git://github.com/dogtagpki/pki.git","ssh_url":"git@github.com:dogtagpki/pki.git","clone_url":"https://github.com/dogtagpki/pki.git","svn_url":"https://github.com/dogtagpki/pki","homepage":"https://pagure.io/dogtagpki/issues","size":29743,"stargazers_count":37,"watchers_count":37,"language":"Java","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":35,"mirror_url":null,"archived":false,"open_issues_count":17,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":35,"open_issues":17,"watchers":37,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/dogtagpki/pki/pulls/132"},"html":{"href":"https://github.com/dogtagpki/pki/pull/132"},"issue":{"href":"https://api.github.com/repos/dogtagpki/pki/issues/132"},"comments":{"href":"https://api.github.com/repos/dogtagpki/pki/issues/132/comments"},"review_comments":{"href":"https://api.github.com/repos/dogtagpki/pki/pulls/132/comments"},"review_comment":{"href":"https://api.github.com/repos/dogtagpki/pki/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/dogtagpki/pki/pulls/132/commits"},"statuses":{"href":"https://api.github.com/repos/dogtagpki/pki/statuses/9f5d4c21e80e52b6ef7fd23d5ff1a61e538089e9"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"edewata"}}