On 20/06/2019 14:38, Alexander Bokovoy wrote:
On to, 20 kesä 2019, lejeczek via FreeIPA-users wrote:
> hi guys,
> I'm starting to look more thoroughly into CA and something I'm not sure
> is possible, and hoping you could shed more light onto, is - having IPA
> deployed with own CA is it possible to then, at a later point,
> move/migrate/change IPA to subordinate type of CA with AD's CA as root?
> Is such a change a SOP or rather something undocumented-unsupported but
> possible & risky?
It is possible and is a routine action.
-- these are our tests of this feature which run for every pull request.
Look at TestSelfExternalSelf suite, it should be more or less
okey, great, that should help, many! thanks.
I've just thumbed through it - either I missed it or it's not there, to
clearly get the process, as I mentioned earlier, of move/migrate/change
IPA's CA/PKI to Win AD.
Does IPA CA has to be removed, demoted first or clean setup without CA
is required in order to tap into AD's?