curl -v --cert /var/lib/ipa/ra-agent.pem --key /var/lib/ipa/ra-agent.key https://vm01.int.domain.in/ca/rest/certs/search?size * Trying 192.168.150.66:443... * Connected to vm01.int.domain.in (192.168.150.66) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * CAfile: /etc/pki/tls/certs/ca-bundle.crt * TLSv1.0 (OUT), TLS header, Certificate Status (22): * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS header, Certificate Status (22): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS header, Finished (20): * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): * TLSv1.2 (IN), TLS header, Unknown (23): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.2 (IN), TLS header, Unknown (23): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS header, Unknown (23): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.2 (IN), TLS header, Unknown (23): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.2 (OUT), TLS header, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.2 (OUT), TLS header, Unknown (23): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 * ALPN, server accepted to use http/1.1 * Server certificate: * subject: CN=*.int.domain.in * start date: Aug 17 10:08:46 2026 GMT * expire date: Mar 3 10:08:46 2027 GMT * subjectAltName: host "vm01.int.domain.in" matched cert's "*.int.domain.in" * issuer: C=US; O=GoDaddy.com; CN=GoDaddy TLS Intermediate CA DV - R1v1 * SSL certificate verify ok. * TLSv1.2 (OUT), TLS header, Unknown (23): > GET /ca/rest/certs/search?size HTTP/1.1 > Host: vm01.int.domain.in > User-Agent: curl/7.76.1 > Accept: */* > * TLSv1.2 (IN), TLS header, Unknown (23): * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * TLSv1.2 (IN), TLS header, Unknown (23): * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * old SSL session ID is stale, removing * TLSv1.2 (IN), TLS header, Unknown (23): * TLSv1.3 (IN), TLS handshake, Request CERT (13): * TLSv1.2 (OUT), TLS header, Unknown (23): * TLSv1.3 (OUT), TLS handshake, Unknown (25): * TLSv1.2 (OUT), TLS header, Unknown (23): * TLSv1.3 (OUT), TLS handshake, CERT verify (15): * TLSv1.2 (OUT), TLS header, Unknown (23): * TLSv1.3 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS header, Unknown (23): * TLSv1.3 (IN), TLS alert, certificate expired (557): * OpenSSL SSL_read: error:0A000415:SSL routines::ssl/tls alert certificate expired, errno 0 * Closing connection 0 curl: (56) OpenSSL SSL_read: error:0A000415:SSL routines::ssl/tls alert certificate expired, errno 0
чт, 20 авг. 2026 г. в 03:47, Rob Crittenden <[email protected]>: > > On 8/17/26 11:15 AM, alexey safonov via FreeIPA-users wrote: > > [asafonov@bg-vm01 ~]$ ipa cert-find --sizelimit 5 > > ipa: ERROR: Certificate operation cannot be completed: > > HTTPSConnectionPool(host='mum-vm01.int.domain.local', port=443): Max > > retries exceeded with url: /ca/rest/certs/search?size=5 (Caused by > > SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] ssl/tls > > alert certificate expired (_ssl.c:2651)'))) > > [asafonov@bg-vm01 ~]$ curl https://mum-vm01.int.domain.local -vI > > --stderr - | grep "expire date" > > * expire date: Mar 3 10:08:46 2027 GMT > > [asafonov@bg-vm01 ~]$ > > See what talking to the CA directly with the RA agent returns. It should > be a 405 since we're sending a GET instead of a POST. Probably anything > other than a TLS error means the certs are ok. > > # curl -v --cert /var/lib/ipa/ra-agent.pem --key > /var/lib/ipa/ra-agent.key > https://ipa.example.test:8443/ca/rest/certs/search?size=5 > > rob > > > > > пн, 17 авг. 2026 г. в 14:21, alexey safonov <[email protected]>: > >> > >> This one shows normal date (future expiry) on my CA host > >> > >> > >> пн, 17 авг. 2026 г. в 00:21, Rob Crittenden <[email protected]>: > >>> > >>> I don't really have much. > >>> > >>> So this error originates within OpenSSL. It is either seeing the remote > >>> certificate as expired or I suppose that the local copy of the RA > >>> certificate is expired. > >>> > >>> Look at the actual certificate with: > >>> > >>> $ sudo openssl x509 -text -noout -in /var/lib/ipa/ra-agent.pem | more > >>> > >>> Make sure that the Not After date is in the future. > >>> > >>> Because the connection fails early you should be able to use curl to > >>> troubleshoot as well as it would simplify things. > >>> > >>> rob > >>> > >>> On 8/14/26 2:52 AM, alexey safonov via FreeIPA-users wrote: > >>>> Hi Rob, > >>>> > >>>> any ideas here? it's a quite annoying when the system is not in a > >>>> stable state. Should I debug something? or easier to do full forced > >>>> replica sync? > >>>> > >>>> Alex > >>>> > >>>> ср, 12 авг. 2026 г. в 22:55, Rob Crittenden <[email protected]>: > >>>>> > >>>>> This is unexpected. So at least one other server can communicate with > >>>>> the IPA server with a CA but one in particular cannot? > >>>>> > >>>>> Are the system dates/times in sync with each other and correct? > >>>>> > >>>>> rob > >>>>> > >>>>> On 8/11/26 6:17 PM, alexey safonov via FreeIPA-users wrote: > >>>>>> so basically in my setup I have only one CA > >>>>>> > >>>>>> but you are right, on one replica executing this command provide the > >>>>>> error I mentioned earlier. And from that server only I'm getting that > >>>>>> error during uninstall. > >>>>>> > >>>>>> So what should I do? getcert list doesn't show any expired certificate > >>>>>> on that replica > >>>>>> > >>>>>> ср, 12 авг. 2026 г. в 05:16, Rob Crittenden <[email protected]>: > >>>>>>> > >>>>>>> This error originates on the IPA server. It is trying to search for > >>>>>>> any > >>>>>>> certificates associated with this client in order to revoke them. That > >>>>>>> search is failing with the expiration error. > >>>>>>> > >>>>>>> In other words, this isn't a problem unconfiguring the client, it's a > >>>>>>> problem on the IPA server (or servers). > >>>>>>> > >>>>>>> On each IPA server you can try something like: ipa cert-find > >>>>>>> --sizelimit 5 > >>>>>>> > >>>>>>> If you get any error that then eliminates the client from the picture. > >>>>>>> > >>>>>>> rob > >>>>>>> > >>>>>>> On 8/11/26 4:13 PM, alexey safonov wrote: > >>>>>>>> don't have any expired here, but somehow all unenroll (--uninstall) > >>>>>>>> is > >>>>>>>> causing this issue > >>>>>>>> > >>>>>>>> ipa-client-install --uninstall > >>>>>>>> Unenrolling client from IPA server > >>>>>>>> Unenrolling host failed: Certificate operation cannot be completed: > >>>>>>>> HTTPSConnectionPool(host='host01.domain.int', port=443): Max retries > >>>>>>>> exceeded with url: /ca/rest/certs/search?size=5000 (Caused by > >>>>>>>> SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] ssl/tls > >>>>>>>> alert certificate expired (_ssl.c:2651)'))) > >>>>>>>> > >>>>>>>> вт, 11 авг. 2026 г. в 22:15, Rob Crittenden <[email protected]>: > >>>>>>>>> > >>>>>>>>> On 8/11/26 1:53 AM, alexey safonov via FreeIPA-users wrote: > >>>>>>>>>> Hi, > >>>>>>>>>> > >>>>>>>>>> previously I had strange situation, where one certificate had > >>>>>>>>>> expired > >>>>>>>>>> > >>>>>>>>>> I've fixed this with ipa-cert-fix, but still have this: > >>>>>>>>>> > >>>>>>>>>> Number of certificates and requests being tracked: 7. > >>>>>>>>>> Request ID '20240815074547': > >>>>>>>>>> status: CA_UNREACHABLE > >>>>>>>>>> ca-error: Server at https://host01.int.domain/ipa/json failed > >>>>>>>>>> request, > >>>>>>>>>> will retry: 4016 (503 Server Error: Service Unavailable for url: > >>>>>>>>>> https://host01.int.domain:443/ca/rest/account/login). > >>>>>>>>>> stuck: no > >>>>>>>>>> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > >>>>>>>>>> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > >>>>>>>>>> CA: dogtag-ipa-ca-renew-agent > >>>>>>>>>> issuer: CN=Certificate Authority,O=INT.QUANTBOX.IN > >>>>>>>>>> subject: CN=IPA RA,O=INT.QUANTBOX.IN > >>>>>>>>>> issued: 2026-08-06 16:44:29 IST > >>>>>>>>>> expires: 2028-07-26 16:44:29 IST > >>>>>>>>>> key usage: digitalSignature,keyEncipherment,dataEncipherment > >>>>>>>>>> eku: id-kp-clientAuth > >>>>>>>>>> profile: caSubsystemCert > >>>>>>>>>> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > >>>>>>>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > >>>>>>>>>> track: yes > >>>>>>>>>> auto-renew: yes > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> I feel that everything works fine, but today I see that on > >>>>>>>>>> enrolling > >>>>>>>>>> have the following error. > >>>>>>>>>> > >>>>>>>>>> ipa-client-install --uninstall > >>>>>>>>>> Unenrolling client from IPA server > >>>>>>>>>> Unenrolling host failed: Certificate operation cannot be completed: > >>>>>>>>>> HTTPSConnectionPool(host='hos01.int.domain', port=443): Max retries > >>>>>>>>>> exceeded with url: /ca/rest/certs/search?size=5000 (Caused by > >>>>>>>>>> SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] > >>>>>>>>>> ssl/tls > >>>>>>>>>> alert certificate expired (_ssl.c:2651)'))) > >>>>>>>>>> > >>>>>>>>>> What should I check here and any ideas how to fix? > >>>>>>>>> > >>>>>>>>> It would seem some of your certificates are still expired. The > >>>>>>>>> "getcert > >>>>>>>>> list" output will tell you which one(s). > >>>>>>>>> > >>>>>>>>> rob > >>>>>>> > >>>>> > >>> > -- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
