Hi, which version are you using? ipa-cert-fix is available since IPA 4.6.6 and can help you renew expired certs. The doc is available at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/... flo On Mon, Mar 20, 2023 at 2:23 PM Omar Pagan via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org&gt; wrote:

Omar Pagan via FreeIPA-users wrote: It means that 389-ds is not running. rob

Omar Pagan via FreeIPA-users wrote: We need more context to understand what is happening. I'd recommend running with the -v option as well (verbose). rob

Hi, On Tue, Mar 21, 2023 at 2:53 PM Omar Pagan via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org&gt; wrote: You can ignore the above 3 warnings if you didn't install the KRA on this server. Is the directory server running? You can run "ipactl status" to check if all IPA services are running and launch them with "ipactl start --ignore-service-failures". flo

Sorry, here is the link for the paste errors: https://justpaste.it/57k4t

Thanks, I got all the services up and running, yet I can't get the certs to renew. When I look at certmonger it seems to be having dbus connection issues. Are those normal? I have tried to use the `resubmit` option for the certs ID but that doesn't seem to work. Thoughts?

Hello guys, The team was trying some new things and we got some errors we would like to share: ERR - _csngen_adjust_local_time - Adjustment limit exceeded; value - ####, limit - #### (I'm not sure if you care to see the actual numbers) ERR - ldbm_back_modify - failed to generate modify CSN for entry (cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca), aborting operation After some google searches we found the following links, but want to validate with you guys the steps are what we need. Here are some of those links we have found: We have perform the following steps following this link: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... The steps are (for the case where your certs are still valid): 1. Stop certmonger 2. grep dogtag-ipa-ca-renew-agent /var/lib/certmonger/cas/* 3. There should be two. You want the one with "id=dogtag-ipa-ca-renew-agent" 4. Modify that file and add -N to ca_external_helper. It needs to look like: ca_external_helper=/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit -N We have also found the following link, but not perform the suggested steps. https://directory.fedoraproject.org/docs/389ds/howto/howto-fix-and-reset-... Since the only way to get the service back is to set the local time and date back to a time before the certs expired, do you know of any way to resolve the clock skew problem with the directory service? Other than what is suggested in the link above?

not sure I follow your answers, can you clarify what I should be doing to get those Errors or the `clock skew` issue resolved?

but it seems that I'm getting the clock skew error for the directory service every time I try to resubmit the cert renewal because the rolling back of the date/time to the local server is affecting the clock for the directory service. I think that's causing my renewals to fail.

Hello Flo, We have three (3) servers and two of them are replicas. From the cli: # `ipa-getcert list` shows two certs both expired, # `getcert list` shows 8 certs, 7 of those expired. We are working from the CA master and trying everything we have listed above. We tried the ipa-cert-fix too, time rolled back and everything done on the CA master, but nothing worked.