[Freeipa-users] ipa-getcert request results in CA_REJECTED, on an enrolled host

[Bo Lind]

I'm having a weird one. This has worked well on a number of other, identical hosts, but one is repeatedly giving me trouble:

root@naughtyhost:~# ipa-getcert request -f /etc/pki/tls/certs/xrdp.pem -k /etc/pki/tls/private/xrdp.key -r -w -v
New signing request "20240312125107" added.
State NEWLY_ADDED_READING_KEYINFO, stuck: no.
State SUBMITTING, stuck: no.
State CA_REJECTED, stuck: yes.

root@naughtyhost:~# ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20240312125107':
    status: CA_REJECTED
    ca-error: Server at https://idm0.example.local/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Credential cache is empty)).
    stuck: yes
    key pair storage: type=FILE,location='/etc/pki/tls/private/xrdp.key'
    certificate: type=FILE,location='/etc/pki/tls/certs/xrdp.pem'
    CA: IPA
    issuer: 
    subject: 
    issued: unknown
    expires: unknown
    pre-save command: 
    post-save command: 
    track: yes
    auto-renew: yes

I've tried looking in the logfiles on idm0, but couldn't really find anything useful.