Editing Tornedo.tetrain.com Runbook (section)

=== 0.1 Cert auto-renewal was broken (found, not caused, by this work) ===

Symptom: three certmonger-tracked certs (LDAP/<code><nowiki>dirsrv</nowiki></code>, <code><nowiki>httpd</nowiki></code>, KDC) all show <code><nowiki>status: MONITORING</nowiki></code> / <code><nowiki>auto-renew: yes</nowiki></code> but every renewal attempt fails with:

<pre>
<nowiki>
Error setting up ccache for "host" service on client using default keytab:
Keytab contains no suitable keys for host/ip-172-26-27-51.ap-south-1.compute.internal@.
</nowiki>
</pre>

Root cause: this is an AWS EC2 instance; its live system hostname had drifted to the AWS internal DNS name instead of the enrolled FQDN (<code><nowiki>/etc/krb5.keytab</nowiki></code> only has keys for <code><nowiki>host/tornedo.tetrain.com</nowiki></code>) — almost certainly cloud-init resetting the hostname on a prior reboot.

<pre>
<nowiki>
hostnamectl set-hostname tornedo.tetrain.com

# prevent recurrence — stop cloud-init from resetting it again on the next reboot
cat >> /etc/cloud/cloud.cfg <<'EOF'
preserve_hostname: true
EOF

# resubmit the three near-expiry cert requests (get the request IDs from `getcert list` first)
getcert resubmit -i <ldap-request-id>
getcert resubmit -i <httpd-request-id>
getcert resubmit -i <kdc-request-id>

# confirm
getcert list   # all should show status: MONITORING, no ca-error, new far-future expiry
</nowiki>
</pre>

Verified: all three cleared, new expiry <code><nowiki>2028-07-23</nowiki></code> on all three.