Corey Devenport via FreeIPA-users wrote:
ldap has many cert blobs, the ipa server has the second to last blob,
which is said to expire in 2022. Performing an ldap search gives two serial numbers:
description: 2;805175304;CN=Certificate Authority,O=...;CN=IPA RA,O=...
description: 2;804978693;CN=Certificate Authority,O=...;CN=IPA RA,O=...'
I'm pretty sure this is expected to be single-valued. The
usercertificate should be ok being multi-valued.
The ipa server's ra-agent has the first serial number. Could there be two
conflicting certs?
For some reason ipa-healthcheck doesn't seem to be installed, which I find odd
because it seems it should come included in ipa 4.8 right?
It's a separate package not installed by default.
rob