Henery Hawk via FreeIPA-users wrote:
I've tinkered with FreeIPA a while ago when I was investigating
various ways to control WiFi access but have not been very active lately with it.
I have a new topic that popped up where I need to create user certificates for access to
a specific web site hosted behind an Nginx Reverse Proxy.
I have manually created a (forgive my incorrect terms) ca cert and pointed nginx to it
and then I created user certs for each user that needs to be granted access. This was
done manually using openssh in the pilot phase.
Would FreeIPA be able to do this at scale? I see some chatter about FreeIPA 4.x
introducing user certs, but that chatter hasn't specifically covered how to get the
master ca cert linked to nginx/apache.
The noob question might be useful for someone doing similar research. I am not mission
critical in this investigation, just trying to minimize my manual management of user
certs.
The procedure for IPA wouldn't be that different than any other PKI:
- create a CA
- issue a web server cert from that CA
- issue user certs from that CA
- profit!
To do it in IPA you'd do something like:
- install IPA (you get a CA with that, using ipa-server-install)
- enroll your web host as an IPA client (ipa-client-install)
- create the service HTTP/web.example.com
- on
web.example.com use ipa-getcert to request a certificate with -K
HTTP/web.example.com along with the other options specific to the host
- The IPA CA chain is in /etc/ipa/ca.crt, you can point your web server
config to that for the CA path
- Create users in IPA
- issue user certs for those users
This still glosses over some of the details but it should point you in
the right direction.
rob