[Freeipa-users] Re: RA Agent certificate authorisation fails – how to debug?

[Rob Crittenden]

Tomasz Torcz via FreeIPA-users wrote:
> On Sat, Oct 02, 2021 at 04:38:34PM +0200, Tomasz Torcz via FreeIPA-users wrote:
> > $ ipa-acme-manage enable
> > Failed to authenticate to CA REST API
> > The ipa-acme-manage command failed.
> > Then SNIPPED portion is the same data as in /var/lib/ipa/ra-agent.pem.
> > This is the same certificate; serial number matches, too.
> > What should I do next to resolve this authentication issue?
>
> No ideas how to proceed?
> Most troubleshooting guides end at comparing certs on the filesystem and
> in LDAP. What's the next step?

I'd suggest trying ipa-healthcheck. It does these comparisons and more.

Does the RA cert work in other contexts? Does ipa cert-find work? Can
you request a test certificate?

rob