Rob for the winWhen comparing the serial numbers there is big difference, one digit on the failing system and 10 digits on the working system.  Upon further inspection, I noticed the ldapsearch returned two usercertificates where the failing system returned one.

Is there a bit of magic sauce to update the certificate?

Michael Rainey
Network Representative
Naval Research Laboratory, Code 7320
Building 1009, Room C156
Stennis Space Center, MS 39529

On 05/10/2018 10:01 AM, Rob Crittenden via FreeIPA-users wrote:
openssl x509 -text -in /var/lib/ipa/ra-agent.pem | grep Number: