Hi all,

I think that I found a way to solve the problem from: http://lists.ovirt.org/pipermail/users/2018-January/086441.html and I'm trying to fix it.

But my servers are in Production(50%) and I found that are some errors with my SSL Certificates.

## What I need now? Fixes all certificates problems using my Freeipa generated certificates: vdsmclient* on hosts, ovirt-engine communication ssl certificates on  hosted-engine.

I made with Freeipa(internal) the certificates for ovirt-engine( only apache - self hosted) and Hosts(vsdmclient and vdsmkey....) and replaced using this howto:

## Now ovirt-engine can't contact a Host(Non Responsive) with the errors(Yes, I have a Backup from all old certificates):

On engine.log:

## I read, that ovirt-engine generates certificates for all hosts and it uses his own CA.

Questions:

- How can I fix the communication from hosted-engine and vsdm on hosts? Should I copy my Freeipa ca.crt and replace the ca.der file on /etc/pki/ovirt-engine/certs?

- Should I  change the engine.cer certificate from /etc/pki/ovirt-engine/certs with my Certificate made using Freeipa?

- How to do that properly?

- Where can I find a complete workflow from SSL Certificates from oVirt? What certificates should I change?

## I found some links that to me are confusing(or I'm just dumb), I will take my end solution and do a howto to all: 

- https://www.ovirt.org/develop/release-management/features/infra/pki/ - how updated is that? I can't overwrite a ca from ovirt-engine? 

- https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL/ - Note: Using a commercially issued certificate for HTTPS connections does not affect the certificate used for authentication between your Engine and hosts. They will continue to use the self-signed certificate generated by the Engine...