I reset system clock to a proper point now IPA is working.
Server-Cert cert-pki-ca was not tracked by certmonger somehow, I add it but it says
# output of getcert list.
-------------------------------------
Request ID '20191101102140':
status: MONITORING
ca-error: Server at "http://ipa.ipa.pthl.hk:8080/ca/ee/ca/profileSubmit"
replied: Certificate serial number {0} to be renewed is revoked. Cannot renew a revoked
certificate
stuck: no
----- --------------------
And it was not renewed.
So how to renew this certificate manually?
I also read
https://frasertweedale.github.io/blog-redhat/posts/2019-02-28-dogtag-cert... but
there is no 'cert-fix' command in my IPA.
Thanks.