Bundle = server.cert + intermediate-ipa.cert.
Currently, I figured to distribute rootCA to all clients, and each server
(e.g. nginx) has to serve a bundle (server.cert + intermediate).
The issue with my work flow is: when ipa-getcert generates a certificate,
it doesn't include intermediate-ipa.cert.
So, I have to manually parse */etc/ipa/ca.crt* for a intermediate and
include it in server.cert.
Am I making any sense?
On Thu, Jun 6, 2019 at 7:48 PM Rob Crittenden <rcritten(a)redhat.com> wrote:
Jo Domsic via FreeIPA-users wrote:
> Hi,
>
> I've deployed FreeIPA and now am trying to use ipa-getcert.
> FreeIPA has been deployed with external CA, and the root CA cert has
been deployed to all servers.
> FreeIPA is acting as an intermediate ssl authority.
>
> So, when I run ipa-getcert request .... I generate ssl key (server.key)
and receive vaild ssl cert (server.cert).
> However the certificate in not quite valid, since it's missing the
intermediate certificate in the server.cert bundle.
> Is there a way (e.g. flag or a feature) to include intermediate.cert to
server.cert?
Missing in what bundle?
There is a way, -R, but it is broken for this use case,
https://bugzilla.redhat.com/show_bug.cgi?id=1710632
> Or better yet: how did you envision the whole PKI with FreeIPA as
intermediate certificate?
It should still work fine. The whole chain should be trusted system-wide.
rob