Hi Rob,

Some good news. I did the same with the secondary server. Now on secondary server I can navigate through GUI with out any errors (authentication->certificates->certificates). But on the first server Subjects are missing and all certificates are grayed-out except one.

Another good thing - on both servers I can go to identity->users, then I click on a user who has a personal certificate. And I can see the certificate data via GUI.

Also if I run ipa-server-upgrade it fails on a first server with he following message:
2019-11-25T13:34:26Z DEBUG The ipa-server-upgrade command failed, exception: NetworkError: cannot connect to 'https://freeipa.corp.mydomain.de:8443/ca/rest/account/login': [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:618)
2019-11-25T13:34:26Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details:
NetworkError: cannot connect to 'https://freeipa.corp.mydomain.de:8443/ca/rest/account/login': [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:618)
2019-11-25T13:34:26Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information

If I run ipa-cert-show 1 on a first server I see this:

[root@freeipa ipa]# ipa cert-show 1
ipa: DEBUG: importing all plugin modules in ipaclient.remote_plugins.schema$5131ac65...
ipa: DEBUG: importing plugin module ipaclient.remote_plugins.schema$5131ac65.plugins
ipa: DEBUG: importing all plugin modules in ipaclient.plugins...
ipa: DEBUG: importing plugin module ipaclient.plugins.automember
ipa: DEBUG: importing plugin module ipaclient.plugins.automount
ipa: DEBUG: importing plugin module ipaclient.plugins.ca
ipa: DEBUG: importing plugin module ipaclient.plugins.cert
ipa: DEBUG: importing plugin module ipaclient.plugins.certmap
ipa: DEBUG: importing plugin module ipaclient.plugins.certprofile
ipa: DEBUG: importing plugin module ipaclient.plugins.csrgen
ipa: DEBUG: importing plugin module ipaclient.plugins.dns
ipa: DEBUG: importing plugin module ipaclient.plugins.hbacrule
ipa: DEBUG: importing plugin module ipaclient.plugins.hbactest
ipa: DEBUG: importing plugin module ipaclient.plugins.host
ipa: DEBUG: importing plugin module ipaclient.plugins.idrange
ipa: DEBUG: importing plugin module ipaclient.plugins.internal
ipa: DEBUG: importing plugin module ipaclient.plugins.location
ipa: DEBUG: importing plugin module ipaclient.plugins.migration
ipa: DEBUG: importing plugin module ipaclient.plugins.misc
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken_yubikey
ipa: DEBUG: importing plugin module ipaclient.plugins.passwd
ipa: DEBUG: importing plugin module ipaclient.plugins.permission
ipa: DEBUG: importing plugin module ipaclient.plugins.rpcclient
ipa: DEBUG: importing plugin module ipaclient.plugins.server
ipa: DEBUG: importing plugin module ipaclient.plugins.service
ipa: DEBUG: importing plugin module ipaclient.plugins.sudorule
ipa: DEBUG: importing plugin module ipaclient.plugins.topology
ipa: DEBUG: importing plugin module ipaclient.plugins.trust
ipa: DEBUG: importing plugin module ipaclient.plugins.user
ipa: DEBUG: importing plugin module ipaclient.plugins.vault
ipa: DEBUG: found session_cookie in persistent storage for principal 'admin@CORP.mydomain.DE', cookie: 'ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d'
ipa: DEBUG: setting session_cookie into context 'ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;'
ipa: DEBUG: New HTTP connection (freeipa.corp.mydomain.de)
ipa: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;path=/ipa;httponly;secure;']'
ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;' for principal admin@CORP.mydomain.DE
ipa: DEBUG: Created connection context.rpcclient_140099072449040
ipa: DEBUG: raw: cert_show(u'1', version=u'2.230')
ipa: DEBUG: cert_show(u'1', version=u'2.230')
ipa: INFO: [try 1]: Forwarding 'cert_show/1' to json server 'https://freeipa.corp.mydomain.de/ipa/session/json'
ipa: DEBUG: HTTP connection keep-alive (freeipa.corp.mydomain.de)
ipa: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;path=/ipa;httponly;secure;']'
ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;' for principal admin@CORP.mydomain.DE
ipa: DEBUG: Destroyed connection context.rpcclient_140099072449040
ipa: ERROR: cannot connect to 'https://freeipa.corp.mydomain.de:443/ca/agent/ca/displayBySerial': [Errno 13] Permission denied




on a second server it prints a certificate:
[root@freeipa-02 ~]# ipa cert-show 1
  Issuing CA: ipa
  Certificate: MIIDozCC.....uU=
  Subject: CN=Certificate Authority,O=CORP.MYDOMAIN.DE
  Issuer: CN=Certificate Authority,O=CORP.MYDOMAIN.DE
  Not Before: Tue Dec 05 15:31:39 2017 UTC
  Not After: Sat Dec 05 15:31:39 2037 UTC
  Serial number: 1
  Serial number (hex): 0x1
  Revoked: False

пн, 25 нояб. 2019 г. в 14:07, Robert Crittenden <rcritten@redhat.com>:
I am out of the office until December 2, 2019.



--
With best regards/Mit freundlichen Grüßen

Moudraninets Dmitry, RHCSA
http://www.linkedin.com/in/moudraninets
http://www.xing.com/profile/Dmitry_Mudraninets