On 8/11/26 1:53 AM, alexey safonov via FreeIPA-users wrote:
Hi,
previously I had strange situation, where one certificate had expired
I've fixed this with ipa-cert-fix, but still have this:
Number of certificates and requests being tracked: 7.
Request ID '20240815074547':
status: CA_UNREACHABLE
ca-error: Server at https://host01.int.domain/ipa/json failed request,
will retry: 4016 (503 Server Error: Service Unavailable for url:
https://host01.int.domain:443/ca/rest/account/login).
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=INT.QUANTBOX.IN
subject: CN=IPA RA,O=INT.QUANTBOX.IN
issued: 2026-08-06 16:44:29 IST
expires: 2028-07-26 16:44:29 IST
key usage: digitalSignature,keyEncipherment,dataEncipherment
eku: id-kp-clientAuth
profile: caSubsystemCert
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
I feel that everything works fine, but today I see that on enrolling
have the following error.
ipa-client-install --uninstall
Unenrolling client from IPA server
Unenrolling host failed: Certificate operation cannot be completed:
HTTPSConnectionPool(host='hos01.int.domain', port=443): Max retries
exceeded with url: /ca/rest/certs/search?size=5000 (Caused by
SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] ssl/tls
alert certificate expired (_ssl.c:2651)')))
What should I check here and any ideas how to fix?
It would seem some of your certificates are still expired. The "getcert
list" output will tell you which one(s).
rob
--
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
