What is the serial number for the two "QC.LRTECH.CA IPA
CA"
certificates? Are they different? If not that would explain the Firefox
error.
They are different:
Serial Number: 4098 (0x1002)
Serial Number: 00:8a:58:8a:64:a9:7d:dc:a0
On the IPA server with the CA up, does ipa cert-show 1 work?
If not we need to work on that first. It means the CA isn't quite
functioning despite the renewed certificates.
No ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS
(500)
With the renewed certificates you shouldn't have to fiddle with
time
anymore. Do basic operations work on the server with current time?
What is a basic operations?
I can do ipactl restart, status without problem.
I can do getcert list.
kinit is working.
certutil is working too
I'm not sure if this is a typo or not, # certutil -L -d
/etc/httpd/nssdb
Did you mean /etc/pki/nssdb?
It wasn't a typo and I looked in /etc/pki/nssdb and it was empty.
I'm not the one that setup FreeIPA so if something isn't at the right place I
can't really explain why.
Eric