Josip Domšić via FreeIPA-users wrote:
Bundle = server.cert + intermediate-ipa.cert.
Currently, I figured to distribute rootCA to all clients, and each
server (e.g. nginx) has to serve a bundle (server.cert + intermediate).
The issue with my work flow is: when ipa-getcert generates a
certificate, it doesn't include intermediate-ipa.cert.
So, I have to manually parse */etc/ipa/ca.crt* for a intermediate and
include it in server.cert.
Am I making any sense?
I don't know why nginx requires this but what you could could try is
write a post-install script (-C) that executes when certmonger saves the
updated certificate that will add the intermediate certificate(s) as
required by nginix. You can pull the intermediates out of
/etc/ipa/ca.crt by excluding the root (issuer == subject).
rob
On Thu, Jun 6, 2019 at 7:48 PM Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com>> wrote:
Jo Domsic via FreeIPA-users wrote:
> Hi,
>
> I've deployed FreeIPA and now am trying to use ipa-getcert.
> FreeIPA has been deployed with external CA, and the root CA cert
has been deployed to all servers.
> FreeIPA is acting as an intermediate ssl authority.
>
> So, when I run ipa-getcert request .... I generate ssl key
(server.key) and receive vaild ssl cert (server.cert).
> However the certificate in not quite valid, since it's missing the
intermediate certificate in the server.cert bundle.
> Is there a way (e.g. flag or a feature) to include
intermediate.cert to server.cert?
Missing in what bundle?
There is a way, -R, but it is broken for this use case,
https://bugzilla.redhat.com/show_bug.cgi?id=1710632
> Or better yet: how did you envision the whole PKI with FreeIPA as
intermediate certificate?
It should still work fine. The whole chain should be trusted
system-wide.
rob
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...