Hello John,

Thank you for your comments. They are really helpful.

[root@freeipa certs]# ipa-server-certinstall -w -d --pin= name.key name.crt
Directory Manager Password: "I introduce it"

I tried those, but I get the following message:
The full certificate chain is not present in name.key, name.crt
The ipa-server-certinstall command failed.

Is it because this has to be run first?

# ipa-cacert-manage -p DM_PASSWORD -n NICKNAME -t C,, install ca.crt
# ipa-certupdate

NICKNAME not sure what it is.


I am not sure why it still fails. I have combined the main cer with the intermediate certificate in just one file too. 

Thank you for your comments 
Guille

El sáb, 24 abr 2021 a las 14:14, John Keates (<john@keates.nl>) escribió:
Hi Guille,

The meaning of "Pass --pin-" means: pass along the argument --pin and set it to an empty value (because --pin= does exactly that, it says "pin equals to nothing").
In your case this might look like:

ipa-server-certinstall -w -d --pin= mysite.key mysite.crt

Or, if the command allows it, you could position it elsewhere, i.e. at the beginning:

 ipa-server-certinstall --pin= -w -d mysite.key mysite.crt

If you want to know for sure what the command supports, you can generally use the help commands to find out, or use the manual, accessible via the man command:

man ipa-server-certinstall

If you have multiple files you can generally combine them. Wildcard certificates are the same as normal certificates, so they don't come with 'extra files' just because their are wildcard.
It is possible that you have three files:

1. The private key
2. The actual certificate
3. An intermediate certificate chain

If that is the case you can often simply combine the certificate and the intermediate certificate(s) into a single file. This is not specific for FreeIPA and resources on PKI and intermediate certificates are readily available online. There are cases where the intermediate certificates are not required if they are available in major operating systems by default already.

John

> On 24 Apr 2021, at 14:21, G Col via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:
>
> Hello rob,
>
> Thank you for your help. The command I try to run is ipa-server-certinstall -w -d mysite.key mysite.crt
>
> but as it is a wildcard certificate, it has also associated a third file .crt
>
> So when I run that command, it asks for a passphrase, but certs and key don't have any passphrase associated. What could I do?
> What  this line means " Pass --pin=''.    " 
>
>
> Thx u ;)
> guille
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure