[Freeipa-users] Removal of host certificates

[Gerrard Geldenhuis]

Hi
I am trying to remove old host certificates.

I generated a list using:
ipa cert-find --sizelimit 0

One of the certs are:
Issuing CA: ipa
Subject: CN=server.example.com,O=COMPANY.COM
Issuer: CN=Certificate Authority,O=COMPANY.COM
Not Before: Fri May 20 15:56:37 2016 UTC
Not After: Mon May 21 15:56:37 2018 UTC
Serial number: 268238888
Serial number (hex): 0xFFD002D
Status: REVOKED_EXPIRED
Revoked: True

I also did:
ipa cert-show 268238888

I then tried to remove the cert by using:
ipa host-remove-cert server.example.com

which then prompts me for the certificate, I enter the certificate as I got it from ipa
cert-show command, using the "Certificate: " part.

But I get the error:
ipa: ERROR: server.examle.com: host not found

I also tried to remove the certificate from the UI, which shows quite a lot more expired
certificates for the host, but does not give me any option to delete/remove the
certificates

Am I missing something obvious with regards to the steps required to remove old
certificates? Am I not supposed to remove them?

FreeIPA, version: 4.5.4

Regards