Rob, thanks for your response. 

The output of both commands  is:

certutil: could not find certificate named "Server-Cert": PR_FILE_NOT_FOUND_ERROR: File not found

Any suggestions?

Thanks

On Mon, May 6, 2019 at 3:54 PM Rob Crittenden <rcritten@redhat.com> wrote:
Adrian HY via FreeIPA-users wrote:
> Exactly, I ran ipa-server-certinstall and replaced both of the Apache
> and 389-ds certificates.  I buy the certificate but I can't renew it. 
>
> I imported the certificates like this:
>
> Root Certificate: 
>
> ipa-cacert-manage -n Godaddy -p PASS_DIRECTORY_MANAGER -t CT,, install *gdroot-g2.crt*
> ipa-certupdate
>
> Intermediate certificates:
>
> ipa-cacert-manage -n Godaddy2 -p PASS_DIRECTORY_MANAGER -t CT,, install *gd_bundle-g2-g1.crt 4dfc653ab0cf823d.crt*
> ipa-certupdate
>
> Finally, the certificate:
>
> ipa-server-certinstall --dirman-password=PASS_DIRECTORY_MANAGER --pin=PASS_CERTIFICATE -w -d *cert.key gd_bundle-g2-g1.crt 4dfc653ab0cf823d.crt* --cert-name=Godaddy2
>
>
> My IPA version is 4.6.4, OS CentOS 7.6.

This is an absolutely perfect response to my question, thank you very
much :-)

Ok, so chances seem good that the original certs are still available.
Whether they are still valid is another question, they too could be
expired, but let's start there.

To check the certs and see if they are valid run:

# certutil -V -u V -d /etc/httpd/alias -n Server-Cert
certutil: certificate is valid

# certutil -V -u V -d /etc/dirsrv/slapd-EXAMPLE-TEST -n Server-Cert
certutil: certificate is valid

If you're lucky both are still valid (I'm mostly concerned that they are
expired).

If they are valid then you can manually edit /etc/httpd/conf.d/nss.conf
and find the NSSNickname line. Set the value to Server-Cert. That will
fix Apache.

To fix 389-ds you'll need to use an ldapmodify:

# ldapmodify -x -D 'cn=directory manager' -W
<password prompt>
dn: cn=RSA,cn=encryption,cn=config
changetype: modify
replace: nsSSLPersonalitySSL
nsSSLPersonalitySSL: Server-Cert
<a blank line>
^D

Run ipactl restart to restart the world and you should be back in business.

On the other hand if the certs are expired there will be a bit more
digging around. Let's hope for best case scenario and tackle the other
bit if we have to.

rob


>
> Thanks.
>
>
>
>
>
> On Mon, May 6, 2019 at 2:53 PM Rob Crittenden <rcritten@redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
>     Adrian HY via FreeIPA-users wrote:
>     > Hi Florence, thanks for your attention. 
>     >
>     > Yes, IPA was installed with self-signed CA, then I replaced the
>     > self-signed CA with 
>     > an externally-signed CA (godaddy certificate). The certificate expired
>     > and I do not need it anymore. Hence, I need the self-signed CA.
>
>     We need to know exactly what it is you did.
>
>     On one hand it sounds like you ran ipa-server-certinstall and replaced
>     one or both of the Apache and 389-ds certificates.
>
>     On the other it sounds like you go the IPA CA certificate signed by an
>     external CA. Seems dubious to me that godaddy would do this (at least
>     not without you ponying up major $$$).
>
>     It matters what you did so please be as detailed as possible.
>
>     The version of IPA would be handy to know as well.
>
>     rob
>
>     >
>     > Thanks. 
>     >
>     >
>     > On Mon, May 6, 2019 at 2:32 PM Florence Blanc-Renaud
>     <flo@redhat.com <mailto:flo@redhat.com>
>     > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> wrote:
>     >
>     >     On 5/4/19 5:29 AM, Adrian HY via FreeIPA-users wrote:
>     >     > Hello all,
>     >     >
>     >     > My commercial certificate has expired today. The pki-tomcatd
>     >     Service has
>     >     > stopped and I can´t to login at the web-gui.
>     >     > Is it possible to revert the original self signed certificate ?
>     >     >
>     >     Hi,
>     >     can you clarify which certificate expired? There are a lot of
>     >     certificates in a FreeIPA installation (IPA CA, the certs for
>     HTTP,
>     >     LDAP, Pkinit, the certs for Dogtag etc...)
>     >
>     >     You mention "the original self-signed certificate", are you
>     >     referring to
>     >     IPA CA? It would help to have the full story, for instance
>     "IPA was
>     >     installed with self-signed CA, then I replaced the self-signed
>     CA with
>     >     an externally-signed CA etc..."
>     >
>     >     flo
>     >
>     >     > Thanks.
>     >     >
>     >     > _______________________________________________
>     >     > FreeIPA-users mailing list --
>     freeipa-users@lists.fedorahosted.org
>     <mailto:freeipa-users@lists.fedorahosted.org>
>     >     <mailto:freeipa-users@lists.fedorahosted.org
>     <mailto:freeipa-users@lists.fedorahosted.org>>
>     >     > To unsubscribe send an email to
>     >     freeipa-users-leave@lists.fedorahosted.org
>     <mailto:freeipa-users-leave@lists.fedorahosted.org>
>     >     <mailto:freeipa-users-leave@lists.fedorahosted.org
>     <mailto:freeipa-users-leave@lists.fedorahosted.org>>
>     >     > Fedora Code of Conduct:
>     https://getfedora.org/code-of-conduct.html
>     >     > List Guidelines:
>     >     https://fedoraproject.org/wiki/Mailing_list_guidelines
>     >     > List Archives:
>     >   
>      https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>     >     >
>     >
>     >
>     >
>     > _______________________________________________
>     > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
>     <mailto:freeipa-users@lists.fedorahosted.org>
>     > To unsubscribe send an email to
>     freeipa-users-leave@lists.fedorahosted.org
>     <mailto:freeipa-users-leave@lists.fedorahosted.org>
>     > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>     > List Guidelines:
>     https://fedoraproject.org/wiki/Mailing_list_guidelines
>     > List Archives:
>     https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>     >
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>