ipa-healthcheck CA errors are often timeouts, not expired certificates
Running ipa-healthcheck --failures-only on my FreeIPA primary (idm.gnali.home, RHEL 10.2, IPA 4.13.1) reported two ERROR results against the Dogtag CA subsystem: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 { "source": "pki.server.healthcheck.certs.expiration", "check": "CASystemCertExpiryCheck", "result": "ERROR", "kw": { "exception": "Request timed out" } }, { "source": "pki.server.healthcheck.certs.trustflags", "check": "CASystemCertTrustFlagCheck", "result": "ERROR", "kw": { "key": "ocsp_signing", "nssdbDir": "/var/lib/pki/pki-tomcat/conf/alias", "msg": "Unable to load cert from NSSDB: Request timed out" } } The wording sounds alarming — certificate expiry and trust flags are core PKI concerns. In this case, the CA was healthy. The healthcheck simply ran out of time while reading the NSS database. ...