As part of a larger IPA "health" checker and driven largely by necessity I have the beginning of a certificate checking tool available at https://github.com/rcritten/checkcerts
It works for me in IPA 4.5.4, IPA 4.6.0 and IPA master (basically 4.7+ patches). YMMV.
There is not much of a user-friendly interface to it. There are only two options, debug and verbose, which increase the amount of debug output (and it is immense).
The UI is limited because I expect it to be rolled up into some larger tool at some point and don't want to have to throw away a ton of framework code.
It needs to be run on an IPA master and checks the things I thought of to check. I've only done limited testing on mostly brand new installs so I'd appreciate feedback. Don't freak out of it spits out errors as it could just be bugs on my part :-)
It is read-only so it shouldn't blow up anything.
So if you want to run it against your system and send me the any output I can try to figure out if it is my tool that is the issue or your system (it is supposed to help pro-actively diagnose issues after all).
To use just clone it from git (or download ipa-checkcerts.py from the repo)
Run it as root:
# kinit admin # python ipa-checkcerts.py IPA version 4.5.4-10.el7_5.3 Check CA status Check tracking Check NSS trust Check dates Checking certificates in CS.cfg Comparing certificates to requests in LDAP Checking RA certificate Checking authorities Checking host keytab Validating certificates Checking renewal master End-to-end cert API test Checking permissions and ownership All checks passed
thanks
rob