On Wed, Oct 09, 2019 at 06:28:11PM -0500, Kevin Vasko via FreeIPA-users wrote:
I’m wanting to make our https servers use a trusted certificate within our LAN only. So
for example if I have websrv1.ny.example.com
when a user uses a machine that’s enrolled
into our realm and they visit https://websrv1.ny.example.com
they shouldn’t be prompted to
accept the self signed certificate.
I think I’m pretty close but I’m missing a small part.
The ipa server is all setup and working. Hosts are enrolled to ipa and have the
I have created a service for the http server in IPA. I have obtained a .key file and .crt
file for my web server. Those keys for the web server are in the appropriate location and
the web server is pointing at the certs correctly.
On my clients when I go to the web servers URl I am no longer getting a “self signed
cert” error message in the browser.
That message has now changed to “unverified certificate authority”. Which basically
indicates to me that the browser doesn’t know if this certificate authority should/can be
If i go in the browser (firefox or chrome) in the certificate authority section and
import the /etc/ipa/ca.crt i get no errors in the browser about it being unverified.
So my question is, what am I missing to make the /etc/ipa/ca.crt file globally available
for browsers to pick up the certificate automatically?
when we enroll a host we simply do
freeipa-install-client —domain=example.com —realm=EXAMPLE.COM —mkhomedir
Accept the defaults, put in the password to enroll and that’s it. Is there something I’m
Looks like the browser is not using the system trust store. Please
provide full details of operating system and package versions for
both freeipa and browser packages.