On ti, 02 heinä 2019, lejeczek via FreeIPA-users wrote:
On 20/06/2019 14:38, Alexander Bokovoy wrote:
> On to, 20 kesä 2019, lejeczek via FreeIPA-users wrote:
>> hi guys,
>> I'm starting to look more thoroughly into CA and something I'm not sure
>> is possible, and hoping you could shed more light onto, is - having IPA
>> deployed with own CA is it possible to then, at a later point,
>> move/migrate/change IPA to subordinate type of CA with AD's CA as root?
>> Is such a change a SOP or rather something undocumented-unsupported but
>> possible & risky?
> It is possible and is a routine action.
> See also
> -- these are our tests of this feature which run for every pull request.
> Look at TestSelfExternalSelf suite, it should be more or less
okey, great, that should help, many! thanks.
I've just thumbed through it - either I missed it or it's not there, to
clearly get the process, as I mentioned earlier, of move/migrate/change
IPA's CA/PKI to Win AD.
Does IPA CA has to be removed, demoted first or clean setup without CA
is required in order to tap into AD's?
It is up to you. The process to switch to
an external CA is the same,
use 'ipa-cacert-manage renew' command:
# ipa-cacert-manage renew --external-ca-type ms-cs \
Exporting CA certificate signing request, please wait
Step 2 is to get /var/lib/ipa/ca.csr signed by your CA and re-run ipa-cacert-manage as:
# ipa-cacert-manage renew --external-cert-file=/path/to/signed_certificate
The ipa-cacert-manage command was successful
This is all described in the Fraser's blog  above.
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland