https://bugzilla.redhat.com/show_bug.cgi?id=2326918
--- Comment #11 from Sumit Bose sbose@redhat.com --- Hi,
about your confusion with LUKS2, it looks like LUKS2 is only using the private key stored on the Nitrokey and is initially only referring to the certificate to locate the matching private key. As long as you have regenerated the certificate with the same public and private key than the old certificate the private key stored on the Nitrokey didn't change and as a result you do not have to re-enroll it.
HTH
bye, Sumit
sssd-maintainers@lists.fedoraproject.org