[Freeipa-users] Re: IPA API can't talk to PKI

[Sam Morris]

On 27/04/2022 14:09, Sam Morris wrote:
> Hi folks. PKI-related commands have started to fail on my setup:

Oh, it turns out this is 
https://bugzilla.redhat.com/show_bug.cgi?id=2006070 again, but this 
time manifesting slightly differently: secret="oldsecret" was replaced 
by "requiredSecret="newsecret" in </etc/pki/pki-tomcat/server.xml>.
> Are the expired certs in CS.cfg causing the problem?

No. According to https://github.com/dogtagpki/pki/issues/2157 dogtag 
doesn't even use them, is that right? In which case should 
ipa-healthcheck stop warning about them?
> Which bit of FreeIPA updates the certificate copies in CS.cfg?

I'm now pretty sure FreeIPA doesn't update CS.cfg except for the CA 
certificate. And on my CA renewal master, that wouldn't happen because 
subsystem.select is set to Clone. Should I change that?