On 26/04/2019 09.14, luckydog xf via FreeIPA-users wrote:
Hi, list,
I replace http and dirsrv with the 3rd SSL certificated signed by Comodo, whose Root
and intermediate certs are 3 files. Below is my step.
1. remove ALL certs against httpd and dirsrv, I'll write httpd only and skip dirsrv.
# And I also removed /etc/pki/nssdb by the same way.
certutil -D -d /etc/http/alias -n 'XXX'
certutil -F -d /etc/http/alias -n 'xxxx'
Hi,
IPA has tools to replace the HTTP and DS certificates with 3rd party
certificates. The tools ensure that all places are correctly updated. We
don't support direct modification of the internal certificate databases.
I suggest that you revert your changes from a backup and perform the
steps from
https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
instead.
Christian
--
Christian Heimes
Principal Software Engineer, Identity Management and Platform Security
Red Hat GmbH,
http://www.de.redhat.com/, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Michael O'Neill, Tom Savage, Eric
Shander