I also tried to set the clock back and restart certmonger. Still no luck:
getcert list gives me the following:
Number of certificates and requests being tracked: 16.
Request ID '20171205153653':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: IPA
expires: 2021-11-09 10:39:35 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-pkinit-KPKdc
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
Request ID '20180912151607':
status: CA_UNREACHABLE
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
expires: 2019-11-25 15:31:41 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180912151608':
status: CA_UNREACHABLE
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
expires: 2019-11-25 15:31:40 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180912151609':
status: CA_UNREACHABLE
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
expires: 2019-11-25 15:31:41 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180912151610':
status: NEED_CSR_GEN_PIN
stuck: yes
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
expires: 2037-12-05 15:31:39 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180912151611':
status: CA_UNREACHABLE
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
expires: 2019-11-25 15:32:12 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20180912151612':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
expires: 2021-10-29 09:40:17 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180912151613':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-CORP-MYDOMAIN-DE',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-CORP-MYDOMAIN-DE/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-CORP-MYDOMAIN-DE',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
expires: 2021-11-09 10:39:45 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv CORP-MYDOMAIN-DE
track: yes
auto-renew: yes
Request ID '20180912151615':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
expires: 2021-11-09 10:40:05 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Request ID '20190212162113':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/etc/pki/tls/private/mail.corp.mydomain.de.ley'
certificate: type=FILE,location='/etc/pki/tls/certs/mail.corp.mydomain.de.crt'
CA: IPA
expires: 2021-02-12 16:21:14 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20191017155747':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/etc/pki/tls/private/mtls.time-series-analytics-stage.corp.mydomain.de.key'
certificate: type=FILE,location='/etc/pki/tls/certs/mtls.time-series-analytics-stage.corp.mydomain.de.crt'
CA: IPA
expires: 2021-10-17 15:57:49 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20191026094947':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/etc/pki/tls/private/nas-smicro.corp.mydomain.de.key'
certificate: type=FILE,location='/etc/pki/tls/certs/nas-smicro.corp.mydomain.de.crt'
CA: IPA
expires: 2021-10-26 09:49:48 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20191026102844':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/etc/pki/tls/private/pe.corp.mydomain.de.key'
certificate: type=FILE,location='/etc/pki/tls/certs/pe.corp.mydomain.de.crt'
CA: IPA
expires: 2021-10-26 10:28:45 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20191027134809':
status: CA_UNREACHABLE
stuck: no
key pair storage: type=FILE,location='/etc/pki/tls/private/lb.corp.mydomain.de.key'
certificate: type=FILE,location='/etc/pki/tls/certs/lb.corp.mydomain.de.crt'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20191027135053':
status: CA_REJECTED
stuck: yes
key pair storage: type=FILE,location='/etc/pki/tls/private/lb-vmnet.lb.corp.mydomain.de.key'
certificate: type=FILE,location='/etc/pki/tls/certs/lb-vmnet.lb.corp.mydomain.de.crt'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20191027135738':
status: CA_UNREACHABLE
stuck: no
key pair storage: type=FILE,location='/etc/pki/tls/private/vm-net.lb.corp.mydomain.de.key'
certificate: type=FILE,location='/etc/pki/tls/certs/vm-net.lb.corp.mydomain.de.crt'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command:
track: yes
auto-renew: yes
[14/Feb/2020:15:09:36][http-bio-8080-exec-13]: according to ccMode, authorization for servlet: caProfileList is LDAP based, not XML {1}, use default authz mgr: {2}.
[14/Feb/2020:15:09:36][http-bio-8080-exec-13]: according to ccMode, authorization for servlet: caProfileList is LDAP based, not XML {1}, use default authz mgr: {2}.
[14/Feb/2020:15:10:12][http-bio-8443-exec-13]: SignedAuditLogger: event ACCESS_SESSION_ESTABLISH
[14/Feb/2020:15:10:12][http-bio-8443-exec-13]: LogFile: event type not selected: ACCESS_SESSION_ESTABLISH
[14/Feb/2020:15:10:22][http-bio-8443-exec-14]: SignedAuditLogger: event ACCESS_SESSION_ESTABLISH
[14/Feb/2020:15:10:22][http-bio-8443-exec-14]: LogFile: event type not selected: ACCESS_SESSION_ESTABLISH
[14/Feb/2020:15:10:32][http-bio-8443-exec-15]: SignedAuditLogger: event ACCESS_SESSION_ESTABLISH
[14/Feb/2020:15:10:32][http-bio-8443-exec-15]: LogFile: event type not selected: ACCESS_SESSION_ESTABLISH
[14/Feb/2020:15:10:42][http-bio-8443-exec-16]: SignedAuditLogger: event ACCESS_SESSION_ESTABLISH
[14/Feb/2020:15:10:42][http-bio-8443-exec-16]: LogFile: event type not selected: ACCESS_SESSION_ESTABLISH
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: About to start updateCertStatus
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: Starting updateCertStatus (entered lock)
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In updateCertStatus()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In LdapBoundConnFactory::getConn()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: masterConn is connected: true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: conn is connected true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: mNumConns now 4
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getInvalidCertificatesByNotBeforeDate filter (certStatus=INVALID)
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getInvalidCertificatesByNotBeforeDate: about to call findCertRecordsInList
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In LdapBoundConnFactory::getConn()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: masterConn is connected: true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: conn is connected true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: mNumConns now 3
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In findCertRecordsInListRawJumpto with Jumpto 20200214151315Z
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=INVALID) attrs: [objectclass, certRecordId, x509cert] pageSize -200 startFrom 20200214151315Z
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: returnConn: mNumConns now 4
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In getInvalidCertsByNotBeforeDate finally.
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: returnConn: mNumConns now 5
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: searching for entry 20200214151315Z
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList.getEntries()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: entries: 0
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: top: 0
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: size: 0
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: index may be empty
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In LdapBoundConnFactory::getConn()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: masterConn is connected: true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: conn is connected true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: mNumConns now 4
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getValidCertsByNotAfterDate filter (certStatus=VALID)
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In LdapBoundConnFactory::getConn()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: masterConn is connected: true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: conn is connected true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: mNumConns now 3
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In findCertRecordsInListRawJumpto with Jumpto 20200214151315Z
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=VALID) attrs: [objectclass, certRecordId, x509cert] pageSize -200 startFrom 20200214151315Z
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: returnConn: mNumConns now 4
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: returnConn: mNumConns now 5
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: searching for entry 20200214151315Z
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList.getEntries()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: entries: 1
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: top: 0
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: size: 1
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: transidValidCertificates: list size: 1
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: transitValidCertificates: ltSize 1
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: Record does not qualify,notAfter Fri Oct 29 11:40:17 CEST 2021 date Fri Feb 14 15:13:15 CET 2020
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: transitCertList EXPIRED
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In LdapBoundConnFactory::getConn()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: masterConn is connected: true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: conn is connected true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: mNumConns now 4
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getRevokedCertificatesByNotAfterDate filter (certStatus=REVOKED)
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getRevokedCertificatesByNotAfterDate: about to call findCertRecordsInList
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In LdapBoundConnFactory::getConn()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: masterConn is connected: true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: conn is connected true
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: getConn: mNumConns now 3
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In findCertRecordsInListRawJumpto with Jumpto 20200214151315Z
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=REVOKED) attrs: [objectclass, certRevokedOn, certRecordId, certRevoInfo, notAfter, x509cert] pageSize -200 startFrom 20200214151315Z
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: returnConn: mNumConns now 4
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: returnConn: mNumConns now 5
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: searching for entry 20200214151315Z
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList.getEntries()
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: entries: 0
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: top: 0
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: DBVirtualList: size: 0
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: index may be empty
[14/Feb/2020:15:13:15][CertStatusUpdateTask]: updateCertStatus done
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: About to start updateSerialNumbers
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: Starting updateSerialNumbers (entered lock)
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: CertificateRepository: updateCounter mEnableRandomSerialNumbers=false mCounter=-1
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: In LdapBoundConnFactory::getConn()
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: masterConn is connected: true
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: getConn: conn is connected true
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: getConn: mNumConns now 4
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: Releasing ldap connection
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: returnConn: mNumConns now 5
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: DBSubsystem: getEntryAttribute: dn=ou=certificateRepository, ou=ca, o=ipaca attr=description:;
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: CertificateRepository: updateCounter mEnableRandomSerialNumbers=false
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: CertificateRepository: updateCounter CertificateRepositoryMode =
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: CertificateRepository: updateCounter modeChange=false
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: CertificateRepository: UpdateCounter mEnableRandomSerialNumbers=false mCounter=-1
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: Starting cert checkRanges
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: Repository: Server not completely started. Returning ..
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: Starting request checkRanges
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: Repository: Server not completely started. Returning ..
[14/Feb/2020:15:13:15][SerialNumberUpdateTask]: updateSerialNumbers done
I'm really stuck now.