Hi, you can set the server in debug mode by creating a file /etc/ipa/server.conf with the following content: [global] debug = True
Do this on the renewal master (you can find it with *ipa** config-show | grep renewal*), then restart httpd with *systemctl restart **httpd*. Once the server is in debug mode, try to renew the RA cert with *getcert resubmit -f /var/lib/ipa/ra-agent.pem* The logs will be visible in /var/log/httpd/error, starting with *ipa: DEBUG: raw: cert_request(* Please paste the logs starting from this line, it may help us understand the issue. flo On Tue, Jun 9, 2026 at 10:59 AM David Hanina via FreeIPA-users < [email protected]> wrote: > Hi, > > Can't see anything out of ordinary :/ I've used: > > openssl x509 -text -in cert -noout -subject > openssl req -text -in csr -noout -subject > > To verify the contents of the certs and cert request presented here, maybe > it will tell you more? > -- > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > Do not reply to spam, report it: > https://forge.fedoraproject.org/infra/tickets/issues/new >
-- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
