Payroll server: Kerberos logons refused and HR API “certificate not yet valid”

Groupe Bennani Distribution (food wholesaler, Tangier) calculates the payroll of 1,200 employees on srv-paie-01, a Debian 12 server joined to the company directory (BENNANI.LAN, SSSD + Kerberos). Every night, it fetches absences from the internal HR API (https://api-rh.bennani.lan), whose certificate is issued by the internal authority and renewed automatically.

Since 10:02 (your workstation's time), two things are breaking at once:

• payroll staff can no longer open an SSH session with their directory account;
• synchronisation with the HR API fails with a certificate error.

The network team says nothing has changed. The local root account works. Find the common cause.