start by checking the certificates stored in the LDAP database (replace $SUFFIX with your actual suffix):
# ldapsearch -D "cn=directory manager" -W -b cn=certificates,cn=ipa,cn=etc,$SUFFIX
You will get a list of entries, one for each CA cert, each entry may contain multiple values for the attribute "cACertificate;binary".
You need to make sure that the expected certs are present, and the conflicting one (the cross-signed) is absent (otherwise it will get re-added by ipa-certupdate on the other places).

Then look at the file /etc/ipa/ca.crt. You should make a backup copy of this file and then edit it in order to remove the wrong CA cert and add the right one. The file must contain the whole certificate chain.
The other places where the CA chain is needed are NSS databases, /etc/ipa/nssdb, /etc/httpd/alias, /etc/dirsrv/slapd-$DOMAIN but IIRC they can be updated later by re-running ipa-certupdate once the /etc/ipa/ca.crt file is fixed.

Let me know if it solves your issue.

On Fri, Oct 8, 2021 at 10:51 AM Stefan Fleischmann via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:
I've tried that actually, but then I'm also getting an error

cannot connect to 'https://XXXX/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1131)
The ipa-certupdate command failed.

My certificate is still valid, so this must also be related to the expired root CA. Is there a manual way to update the NSS database? Our FreeIPA version is 4.8.10 by the way. I remember fixing the NSS db on an older installation at some time, but I haven't found the db location on this new installation yet.

I guess I could reconfigure Apache to use a different certificate or even a self-signed one to get `ipa-certupdate` working again.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure