Exactly, I ran ipa-server-certinstall and replaced both of the Apache and 389-ds certificates.  I buy the certificate but I can't renew it. 

I imported the certificates like this:

Root Certificate: 
ipa-cacert-manage -n Godaddy -p PASS_DIRECTORY_MANAGER -t CT,, install gdroot-g2.crt
ipa-certupdate
Intermediate certificates:

ipa-cacert-manage -n Godaddy2 -p PASS_DIRECTORY_MANAGER -t CT,, install gd_bundle-g2-g1.crt 4dfc653ab0cf823d.crt
ipa-certupdate
Finally, the certificate:

ipa-server-certinstall --dirman-password=PASS_DIRECTORY_MANAGER --pin=PASS_CERTIFICATE -w -d cert.key gd_bundle-g2-g1.crt 4dfc653ab0cf823d.crt --cert-name=Godaddy2

My IPA version is 4.6.4, OS CentOS 7.6.

Thanks.





On Mon, May 6, 2019 at 2:53 PM Rob Crittenden <rcritten@redhat.com> wrote:
Adrian HY via FreeIPA-users wrote:
> Hi Florence, thanks for your attention. 
>
> Yes, IPA was installed with self-signed CA, then I replaced the
> self-signed CA with 
> an externally-signed CA (godaddy certificate). The certificate expired
> and I do not need it anymore. Hence, I need the self-signed CA.

We need to know exactly what it is you did.

On one hand it sounds like you ran ipa-server-certinstall and replaced
one or both of the Apache and 389-ds certificates.

On the other it sounds like you go the IPA CA certificate signed by an
external CA. Seems dubious to me that godaddy would do this (at least
not without you ponying up major $$$).

It matters what you did so please be as detailed as possible.

The version of IPA would be handy to know as well.

rob

>
> Thanks. 
>
>
> On Mon, May 6, 2019 at 2:32 PM Florence Blanc-Renaud <flo@redhat.com
> <mailto:flo@redhat.com>> wrote:
>
>     On 5/4/19 5:29 AM, Adrian HY via FreeIPA-users wrote:
>     > Hello all,
>     >
>     > My commercial certificate has expired today. The pki-tomcatd
>     Service has
>     > stopped and I can´t to login at the web-gui.
>     > Is it possible to revert the original self signed certificate ?
>     >
>     Hi,
>     can you clarify which certificate expired? There are a lot of
>     certificates in a FreeIPA installation (IPA CA, the certs for HTTP,
>     LDAP, Pkinit, the certs for Dogtag etc...)
>
>     You mention "the original self-signed certificate", are you
>     referring to
>     IPA CA? It would help to have the full story, for instance "IPA was
>     installed with self-signed CA, then I replaced the self-signed CA with
>     an externally-signed CA etc..."
>
>     flo
>
>     > Thanks.
>     >
>     > _______________________________________________
>     > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
>     <mailto:freeipa-users@lists.fedorahosted.org>
>     > To unsubscribe send an email to
>     freeipa-users-leave@lists.fedorahosted.org
>     <mailto:freeipa-users-leave@lists.fedorahosted.org>
>     > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>     > List Guidelines:
>     https://fedoraproject.org/wiki/Mailing_list_guidelines
>     > List Archives:
>     https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>     >
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>