GH via FreeIPA-users wrote:
The best I could tell was an upgrade back in Dec. 2019/Jan. 2020. It
seems like it was a move from NSS to SSL for a number of pieces? Anyways, I'd had
Ipsilon configured on the same server, and that move didn't make things happy as there
was a port overlap. (Unsupported configuration, I know.) Lots of reconfiguration and
copying certs around to get it straightened out.
Right now, everything starts on both servers. However, on the "secondary" that
is not the renewal master, there's a number of "certificate doesn't match the
Along with a:
"msg": "Incorrect NSS trust for Server-Cert cert-pki-ca. Got ,, expected
The "primary", which is the renewal master listed on both boxes, shows none of
those errors. At one point, I had figured out how to "force sync" the certs,
but I've since forgotten.
This means there is no associated private key with the certificate. The
"Server-Cert cert-pki-ca" certificate is used by tomcat and is unique
per installation. The others are common and need to be identical on all CAs.
What does getcert list show?