<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yiv6408672923"><div id="yui_3_16_0_1_1428517846112_8937"><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;" id="yui_3_16_0_1_1428517846112_8936"><div id="yiv6408672923"><div id="yiv6408672923yui_3_16_0_1_1428517846112_7561"><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;" id="yiv6408672923yui_3_16_0_1_1428517846112_7560"><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr">I'm looking at the following link for recovering expired certificates on FreeeIPA 3.0.0:</div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr"><br></div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr"><a href="https://www.freeipa.org/page/Howto/CA_Certificate_Renewal" id="yui_3_16_0_1_1428517846112_9013">https://www.freeipa.org/page/Howto/CA_Certificate_Renewal</a><br></div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553"> </div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr"><br></div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr">Problem is when Iook inside my /etc/pki-ca/CS.cfg file for a subsystemCert I do not find one. I see the other three:</div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr"><br></div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr" class="" style="">auditSigningCert cert-pki-ca => updated</div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr" class="" style="">ocspSigningCert cert-pki-ca => updated</div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr" class="" style="">Server-Cert cert-pki-ca => no cert here</div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr">subsystemCert cert-pki-ca => updated </div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr"><br></div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr">Has anyone ever run across this? Any suggestions or hints would be appreciated. If I role the clock back on my system I can login to IPA, but if the time is updated, I cannot login.</div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr"><br></div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr">Please help. </div><div id="yiv6408672923yui_3_16_0_1_1428517846112_4553" dir="ltr"><br></div></div></div></div></div></div></div></div></body></html>