Hi,
I am considering FreeIPA for a multi-site project, to provide both PKI and LDAP services. So ideally, I would like to have one separate FreeIPA server on each site + one central FreeIPA server. And this is what I have in mind: 1. The central FreeIPA server will be my master for LDAP/Kerberos. And each site will have a replica (so that the users can still authenticate, even if the connectivity to the central location is broken). 2. As for PKI - I'd prefer to build a hierarchy: central server would be RootCA and each site would be a separate SubCA (signed by the RootCA).
I tried to implement this, but seems that it is impossible... I've installed the replica for LDAP/Kerberos successfully, using ipa-replica-install. But now I cannot add a SubCA to it:
$ sudo ipa-ca-install --external-ca --ca-subject="CN=FreeIPA-SubCA,O=WOOF.NET" --ca-subject cannot be used when installing a CA replica
So looks like on LDAP replica server I can only install CA replica... not a full SubCA... Is there a way to solve this?
* One way, of course, is to install a separate Dogtag CA on each site, and keep CA-less FreeIPA server just for the LDAP/Kerberos replica...
--- Regards, Dmitry Perets