What version of python-pyasn1 and pyasn1-modules is installed? You
might
try upgrading/downgrading them to see if that helps.
There are two versions:
python-pyasn1(-modules)
python3-pyasn1(-modules)
I tried to uninstall the first with apt—doing so was also going to
remove all of freeipa(!) so I did not go through with that!
Digging a bit more, it appears that ipa is using the Apache2 wsgi mod to
run python code and mod_wsgi is specifically Python 2.7. Also, in the
apache error trace all the ipa-specific python files are in
/usr/lib/python2.7/dist-packages/ and those don't exist anywhere else.
So I'm thinking it's unlikely to be a version problem.
I'm not sure how to get any more information... is there a way to try
and manually make the same requests on the command line and maybe get
something more useful? Or is there away to manually just replace the
expired cert with a new on?
Thanks,
Sean