Hi guys.
I am thinking perhaps these things IPA does not allow, certs
for hosts in "outside" domain which IPA serves?
I do simple
-> $ ipa-getcert request -f
/etc/pki/tls/certs/datastor.outside.crt -k
/etc/pki/tls/private/datastor.outside.key
--dns=DNSNAME=datastor.outside -K
host/datastor.outside(a)PRIVATE.LOT
...
Request ID '20211115180241':
status: CA_REJECTED
ca-error: Server at
https://c8kubermaster1.private.lot/ipa/json denied our
request, giving up: 2100 (Insufficient access: Insufficient
'write' privilege to the 'userCertificate' attribute of
entry
'fqdn=datastor.outside,cn=computers,cn=accounts,dc=private,dc=lot'.).
stuck: yes
Or am I doing something silly there?
This is for a host/service.
many thanks, L.