On 8/17/26 11:15 AM, alexey safonov via FreeIPA-users wrote:
[asafonov@bg-vm01 ~]$ ipa cert-find --sizelimit 5
ipa: ERROR: Certificate operation cannot be completed:
HTTPSConnectionPool(host='mum-vm01.int.domain.local', port=443): Max
retries exceeded with url: /ca/rest/certs/search?size=5 (Caused by
SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] ssl/tls
alert certificate expired (_ssl.c:2651)')))
[asafonov@bg-vm01 ~]$ curl https://mum-vm01.int.domain.local -vI
--stderr - | grep "expire date"
* expire date: Mar 3 10:08:46 2027 GMT
[asafonov@bg-vm01 ~]$
See what talking to the CA directly with the RA agent returns. It should
be a 405 since we're sending a GET instead of a POST. Probably anything
other than a TLS error means the certs are ok.
# curl -v --cert /var/lib/ipa/ra-agent.pem --key
/var/lib/ipa/ra-agent.key
https://ipa.example.test:8443/ca/rest/certs/search?size=5
rob
пн, 17 авг. 2026 г. в 14:21, alexey safonov <[email protected]>:
This one shows normal date (future expiry) on my CA host
пн, 17 авг. 2026 г. в 00:21, Rob Crittenden <[email protected]>:
I don't really have much.
So this error originates within OpenSSL. It is either seeing the remote
certificate as expired or I suppose that the local copy of the RA
certificate is expired.
Look at the actual certificate with:
$ sudo openssl x509 -text -noout -in /var/lib/ipa/ra-agent.pem | more
Make sure that the Not After date is in the future.
Because the connection fails early you should be able to use curl to
troubleshoot as well as it would simplify things.
rob
On 8/14/26 2:52 AM, alexey safonov via FreeIPA-users wrote:
Hi Rob,
any ideas here? it's a quite annoying when the system is not in a
stable state. Should I debug something? or easier to do full forced
replica sync?
Alex
ср, 12 авг. 2026 г. в 22:55, Rob Crittenden <[email protected]>:
This is unexpected. So at least one other server can communicate with
the IPA server with a CA but one in particular cannot?
Are the system dates/times in sync with each other and correct?
rob
On 8/11/26 6:17 PM, alexey safonov via FreeIPA-users wrote:
so basically in my setup I have only one CA
but you are right, on one replica executing this command provide the
error I mentioned earlier. And from that server only I'm getting that
error during uninstall.
So what should I do? getcert list doesn't show any expired certificate
on that replica
ср, 12 авг. 2026 г. в 05:16, Rob Crittenden <[email protected]>:
This error originates on the IPA server. It is trying to search for any
certificates associated with this client in order to revoke them. That
search is failing with the expiration error.
In other words, this isn't a problem unconfiguring the client, it's a
problem on the IPA server (or servers).
On each IPA server you can try something like: ipa cert-find --sizelimit 5
If you get any error that then eliminates the client from the picture.
rob
On 8/11/26 4:13 PM, alexey safonov wrote:
don't have any expired here, but somehow all unenroll (--uninstall) is
causing this issue
ipa-client-install --uninstall
Unenrolling client from IPA server
Unenrolling host failed: Certificate operation cannot be completed:
HTTPSConnectionPool(host='host01.domain.int', port=443): Max retries
exceeded with url: /ca/rest/certs/search?size=5000 (Caused by
SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] ssl/tls
alert certificate expired (_ssl.c:2651)')))
вт, 11 авг. 2026 г. в 22:15, Rob Crittenden <[email protected]>:
On 8/11/26 1:53 AM, alexey safonov via FreeIPA-users wrote:
Hi,
previously I had strange situation, where one certificate had expired
I've fixed this with ipa-cert-fix, but still have this:
Number of certificates and requests being tracked: 7.
Request ID '20240815074547':
status: CA_UNREACHABLE
ca-error: Server at https://host01.int.domain/ipa/json failed request,
will retry: 4016 (503 Server Error: Service Unavailable for url:
https://host01.int.domain:443/ca/rest/account/login).
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=INT.QUANTBOX.IN
subject: CN=IPA RA,O=INT.QUANTBOX.IN
issued: 2026-08-06 16:44:29 IST
expires: 2028-07-26 16:44:29 IST
key usage: digitalSignature,keyEncipherment,dataEncipherment
eku: id-kp-clientAuth
profile: caSubsystemCert
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
I feel that everything works fine, but today I see that on enrolling
have the following error.
ipa-client-install --uninstall
Unenrolling client from IPA server
Unenrolling host failed: Certificate operation cannot be completed:
HTTPSConnectionPool(host='hos01.int.domain', port=443): Max retries
exceeded with url: /ca/rest/certs/search?size=5000 (Caused by
SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] ssl/tls
alert certificate expired (_ssl.c:2651)')))
What should I check here and any ideas how to fix?
It would seem some of your certificates are still expired. The "getcert
list" output will tell you which one(s).
rob
--
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
