I know what is not the issue. No certs are expired
expires: 2020-01-13 13:27:04 UTC
expires: 2020-01-02 13:25:21 UTC
expires: 2020-01-02 13:25:20 UTC
expires: 2020-01-02 13:25:20 UTC
expires: 2038-01-12 13:25:20 UTC
expires: 2020-01-02 13:25:38 UTC
expires: 2020-01-02 13:25:20 UTC
expires: 2020-01-13 13:26:31 UTC
expires: 2020-01-13 13:26:54 UTC
trusts are good
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Server-Cert cert-pki-ca u,u,u
auditSigningCert cert-pki-ca u,u,Pu
caSigningCert cert-pki-ca CTu,Cu,Cu
ocspSigningCert cert-pki-ca u,u,u
subsystemCert cert-pki-ca u,u,u
and
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
SERVER IPA CA CT,C,C
Server-Cert u,u,u
I have moved system time back to a day prior to failure, restarted certmonger, then tried
to start everything again. No go.
Removed custom ldap Default group objectclasses
Reverted CS.cfg to an archive
Re-installed all the PKI rpms
Checked file permissions
Changed from SSL + Cert auth in CS.cfg to basic auth - spoiler, no difference.
I do not want to rebuild the domain. Its looking more and more like I may have to. I may
try the recover/replace CA steps I found in my searches.