Goal

• To be able to change the ca.crl.MasterCRL.nextUpdateGracePeriod setting with IPA tools

• • For example: We have a freeradius server that for various reason we must use CRLs with instead of OCSP.  Currently the CRL is generated on the CA at the exact time of expiration.  This forces a time window where the CRL is expired on the freeradius server until the new CRL can be fetch.  Adding a grace period resolves this.

Acceptance Criteria

A list of verification conditions, successful functional tests, or expected outcomes in order to declare this story/task successfully completed.

• curl -s --location http://ipa-mry01.mry.nwra.com/ipa/c
  rl/MasterCRL.bin | openssl crl -inform der -text | grep Next

• Verify that the time is incremented by the grace period.