<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1429276997465_5645"><br></div><div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1429276997465_5665"><div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1429276997465_5664"><div class="y_msg_container" id="yui_3_16_0_1_1429276997465_5667">> You are going way to far back in time AFAICT. The certs expired on April<br clear="none">> 5 of this year so you don't need to go back to 2014. Just go back to<br clear="none">> April 3 or 4.<br clear="none"><br clear="none">> You'll also need to restart IPA before kicking certmonger ipactl restart<br clear="none"><br clear="none">> rob<div class="qtdSeparateBR"><br><br></div><div class="yqt9779263921" id="yqtfd14198"><br clear="none"></div><div class="y_msg_container" id="yui_3_16_0_1_1429276997465_5667"><br></div>******* SNIP *******</div><div class="y_msg_container" id="yui_3_16_0_1_1429276997465_5667" dir="ltr"><br></div><div class="y_msg_container" id="yui_3_16_0_1_1429276997465_5667" dir="ltr">Thanks!!</div><div class="y_msg_container" id="yui_3_16_0_1_1429276997465_5667" dir="ltr"><br></div><div class="" id="yui_3_16_0_1_1429276997465_5667" dir="ltr" style=""><br class="" style=""></div><div class="y_msg_container" id="yui_3_16_0_1_1429276997465_5667" dir="ltr"><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4744" style="">Following your advice, it looks like only one of the eight certificates are now monitoring. Check out the following:</div><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4745" style=""><br clear="none" class="" style=""></div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7455" style=""><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4746" style=""><br clear="none" class="" style=""></div><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4747" style="">[root@ipa ~]# getcert list | grep -A1 status</div><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4749" style=""><span class="" id="yui_3_16_0_1_1429276997465_4748" style="white-space: pre-wrap;"> </span>status: CA_UNREACHABLE</div><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4751" style=""><span class="" id="yui_3_16_0_1_1429276997465_4750" style="white-space: pre-wrap;"> </span>ca-error: Error 60 connecting to https://ipa.infra.idef:9443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with known CA certificates.</div><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4752" style="">--</div><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4753" style=""><span class="" style="white-space: pre-wrap;"> </span>status: CA_UNREACHABLE</div><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4754" style=""><span class="" style="white-space: pre-wrap;"> </span>ca-error: Error 60 connecting to https://ipa.infra.idef:9443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with known CA certificates.</div><div class="" dir="ltr" id="yui_3_16_0_1_1429276997465_4755" style="">--</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7454" style=""><span class="" style="white-space: pre-wrap;"> </span>status: CA_UNREACHABLE</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7457" style=""><span class="" style="white-space: pre-wrap;"> </span>ca-error: Error 60 connecting to https://ipa.infra.idef:9443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with known CA certificates.</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7473" style="">--</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7474" style=""><span class="" style="white-space: pre-wrap;"> </span>status: CA_UNREACHABLE</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7475" style=""><span class="" style="white-space: pre-wrap;"> </span>ca-error: Error 60 connecting to https://ipa.infra.idef:9443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with known CA certificates.</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7476" style="">--</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7477" style=""><span class="" style="white-space: pre-wrap;"> </span>status: CA_UNREACHABLE</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7478" style=""><span class="" style="white-space: pre-wrap;"> </span>ca-error: Error 60 connecting to https://ipa.infra.idef:9443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with known CA certificates.</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7479" style="">--</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7480" style=""><span class="" style="white-space: pre-wrap;"> </span>status: CA_UNREACHABLE</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7481" style=""><span class="" style="white-space: pre-wrap;"> </span>ca-error: Server at https://ipa.infra.idef/ipa/xml failed request, will retry: 4301 (RPC failed at server. Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)).</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7482" style="">--</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7483" style=""><span class="" style="white-space: pre-wrap;"> </span>status: CA_UNREACHABLE</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7484" style=""><span class="" style="white-space: pre-wrap;"> </span>ca-error: Server at https://ipa.infra.idef/ipa/xml failed request, will retry: 4301 (RPC failed at server. Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)).</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7485" style="">--</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7486" style=""><span class="" style="white-space: pre-wrap;"> </span>status: MONITORING</div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7487" style=""><span class="" style="white-space: pre-wrap;"> </span>ca-error: Server at https://ipa.infra.idef/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: hostname in subject of request 'ipa.infra.idef' does not match principal hostname 'ipa').</div></div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7488" style=""><br clear="none" class="" style=""></div><div class="" dir="ltr" id="yiv4221041194yui_3_16_0_1_1429208191129_7489" style="">How can I get the remaining certs fixed as well? Thanks in advance.</div><div class="" id="yiv4221041194yqtfd59897" style=""></div><br></div> <div class="" id="yui_3_16_0_1_1429276997465_5667" dir="ltr" style=""><br class="" style=""><br class="" style=""></div></div> </div> </div></body></html>