Dungan, Scott A. via FreeIPA-users wrote:
Happy new year, everyone.
We have an unused letsencrypt CA cert and associated the DSTRootCAX3
cert installed on version 4.8.7. Due to firewall issues, we moved to a
paid commercial cert (Comodo) for the https service. My question is, how
can we remove the two unused CA certs? If we do so, is it necessary to
update the clients with ipa-certupdate, or will the removal be transparent?
~]# ipa-cacert-manage list
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater
CN=USERTrust RSA Certification Authority,O=The USERTRUST
Network,L=Jersey City,ST=New Jersey,C=US
CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US
The ipa-cacert-manage command was successful
ipa-cacert-manage delete [options] NICKNAME
ipa-certupdate will need to be run on all enrolled machines.