If the Apache, 389-ds or KDC certificate was issued by a third party there is nothing we can do, regardless of whether it is expired or not. Report which certificates will not be renewed so the admin can manually do do (likely in the event of a third-party certificate). https://pagure.io/freeipa/issue/8600 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>