Hey Martin and Paride,
There are also some scripts which use DNS auth and allow multiple DNS
names/aliases/principals:
In addition to that I recently started work on a Certmonger helper which
would allow one to use Let's Encrypt certs for the entire infrastructure
automatically:
--
Antonia Stevens
a(a)antevens.com
+1 416 888 6908 <+1%20+(416)%20888-6908>
On Tue, Jan 2, 2018 at 4:54 AM, Martin Kosek via FreeIPA-devel <
freeipa-devel(a)lists.fedorahosted.org> wrote:
On 12/21/2017 09:27 AM, paride.buetti--- via FreeIPA-devel wrote:
> Here the procedure to use Let’s Encrypt certificate with freeIPA
>
> Download isrgrootx1 certificate:
>
> # wget
https://letsencrypt.org/certs/isrgrootx1.pem.txt
> # mv isrgrootx1.pem.txt isrgrootx1.pem
>
> Download letsencryptauthorityx3 certificate:
>
> # wget
https://letsencrypt.org/certs/letsencryptauthorityx3.pem.txt
> # mv letsencryptauthorityx3.pem.txt letsencryptauthorityx3.pem
>
> Install CA to freeIPA
>
> # ipa-cacert-manage install isrgrootx1.pem -n ISRGRootX1 -t ,,
> # ipa-cacert-manage install letsencryptauthorityx3.pem -n letsencryptx3
-t C,,
>
> I added DSTRootCAX3 certificate, but I'm not sure if it's necessary
>
> # crete a file DSTRootCAX3.pem with the content of
https://www.identrust.com/certificates/trustid/root-download-x3.html
> # ipa-cacert-manage install DSTRootCAX3.pem -n DSTRootCAX3 -t ,,
>
> Update certificates
>
> # kinit admin
> # ipa-certupdate
>
> Install Let’s Encrypt certificate (I used a DNS-01 challenge:
http://letsencrypt.readthedocs.io/en/latest/challenges.html)
>
> # ipa-server-certinstall -w -d /etc/letsencrypt/live/your.
doma.in/privkey.pem /etc/letsencrypt/live/your.doma.in/fullchain.pem
--pin=
>
> Restart the system
>
> # systemctl restart httpd.service
> # systemctl restart dirsrv(a)BLACKPOINTS-CH.service
>
> or
>
> # ipactl restart
>
> That's all
Thanks for contributing! FreeIPA actually has some shared scripts
already hosted in the team's GitHub repo:
https://github.com/freeipa/freeipa-letsencrypt
that look quite similar to what you came up with. Maybe you want to
either use or contribute to these shared scripts?
Martin
_______________________________________________
FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org