Hi,
this is the output that looks good to me... but I'm not the expert.
[root@ipa-replica ~]# getcert list -f /var/kerberos/krb5kdc/kdc.crt
Number of certificates and requests being tracked: 4.
Request ID '20181202164246':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: IPA
issuer: CN=ipa-replica.mydomain.de,O=MYDOMAIN.DE
subject: CN=ipa-replica.mydomain.de,O=MYDOMAIN.DE
expires: 2019-12-02 17:26:59 CET
principal name: krbtgt/MYDOMAIN.DE(a)MYDOMAIN.DE
certificate template/profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
THX for your advise.