Hi Rob, I follow one of your suggestions in another post, it's :
"certmonger _should_ have renewed them. Try killing ntpd, going back a few days,
restart krb5kdc, dirsrv, httpd and the CA then certmonger and see what happens"
I did it, no success with messages:
- MainThread ipa DEBUG Could not connect to the Directory Server on
ca-ldap01.domain.com: Insufficient access: Invalid credentials
- ca-dap01 certmonger: 2018-08-07 10:40:39 [4831] Internal error
- ca-ldap01 [sssd[ldap_child[5045]]]: Failed to initialize credentials using keytab
[MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm 'DOMAIN.COM'. Unable
to create GSSAPI-encrypted LDAP connection.
- ca-ldap01 [sssd[ldap_child[5045]]]: Cannot contact any KDC for realm
'DOMAIN.COM'
And I notice that Kerberos somehow still shows current date, instead of 2018-08-07 (my
back in time).
[root@ca-ldap01 ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin(a)DOMAIN.COM
Valid starting Expires Service principal
10/25/2018 20:55:02 10/26/2018 20:54:58 krbtgt/DOMAIN.COM(a)DOMAIN.COM
Is this reason for failure?