don't have any expired here, but somehow all unenroll (--uninstall) is causing this issue
ipa-client-install --uninstall Unenrolling client from IPA server Unenrolling host failed: Certificate operation cannot be completed: HTTPSConnectionPool(host='host01.domain.int', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=5000 (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] ssl/tls alert certificate expired (_ssl.c:2651)'))) вт, 11 авг. 2026 г. в 22:15, Rob Crittenden <[email protected]>: > > On 8/11/26 1:53 AM, alexey safonov via FreeIPA-users wrote: > > Hi, > > > > previously I had strange situation, where one certificate had expired > > > > I've fixed this with ipa-cert-fix, but still have this: > > > > Number of certificates and requests being tracked: 7. > > Request ID '20240815074547': > > status: CA_UNREACHABLE > > ca-error: Server at https://host01.int.domain/ipa/json failed request, > > will retry: 4016 (503 Server Error: Service Unavailable for url: > > https://host01.int.domain:443/ca/rest/account/login). > > stuck: no > > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=INT.QUANTBOX.IN > > subject: CN=IPA RA,O=INT.QUANTBOX.IN > > issued: 2026-08-06 16:44:29 IST > > expires: 2028-07-26 16:44:29 IST > > key usage: digitalSignature,keyEncipherment,dataEncipherment > > eku: id-kp-clientAuth > > profile: caSubsystemCert > > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > > track: yes > > auto-renew: yes > > > > > > I feel that everything works fine, but today I see that on enrolling > > have the following error. > > > > ipa-client-install --uninstall > > Unenrolling client from IPA server > > Unenrolling host failed: Certificate operation cannot be completed: > > HTTPSConnectionPool(host='hos01.int.domain', port=443): Max retries > > exceeded with url: /ca/rest/certs/search?size=5000 (Caused by > > SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] ssl/tls > > alert certificate expired (_ssl.c:2651)'))) > > > > What should I check here and any ideas how to fix? > > It would seem some of your certificates are still expired. The "getcert > list" output will tell you which one(s). > > rob -- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
