I have a FreeIPA server running on CentOS7 and now I am trying to create a replica copy using RockyLinux 9.3. When I try to join, the error related cert expires. I have checked everywhere and didn't find any expired certificates. 

/usr/sbin/ipa-client-install -p admin -w XXXX --realm=FOO.COM --domain=foo.com --server=ldap-1.foo.com --hostname ldap-2.foo.com -N --no-ssh --no-sshd --request-cert -U --force-join

...

...

Joining realm failed: Unable to initialize STARTTLS session
    Connect error: error:0A000086:SSL routines::certificate verify failed (certificate has expired)
Failed to bind to server!
Retrying with pre-4.0 keytab retrieval method...
Unable to initialize STARTTLS session
    Connect error: error:0A000086:SSL routines::certificate verify failed (certificate has expired)
Failed to bind to server!
Failed to get keytab
child exited with 9

Installation failed. Rolling back changes.
Disabling client Kerberos and LDAP configurations
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Client uninstall complete.

On master ldap node I did "/usr/bin/getcert list" and all certs are up to date. Now sure from where this expired cert error is coming from.