[Freeipa-users] Re: freeipa expired certificates

[john john]

IPA version is 4.5.0
In this topic https://lists.fedorahosted.org/archives/list/[e-mail]...
explains that different versions of IPA have different RA certificate locations.

In my case I have both certificates one already expired in /etc/httpd/alias and one valid in /var/lib/ipa/ra-agent.{key|pem}.
Which one is used to interact with ldap service?
ldapsearch -D "cn=directory manager" -W -b o=ipaca -LLL -o ldif-wrap=no "(uid=ipara)" usercertificate description
Usercertificate has a completely different certificate.

If I understand correctly I need to install the correct certificate in the ldap service through the ldapmodify command.
But I don't understand which certificate to use.