Kristian Petersen via FreeIPA-users wrote:
> That outlines the options, but not why I should or shouldn't use any of
> them. That is more of what I am looking for.
It's less benefit analysis and more forced by internal requirements.
Often an organization already has a CA and wants any additional CA's to
be subordinates.
The downsides of an external CA is some additional complexity.
Installation can be more difficult (users often have issues getting
their external CA to properly sign the IPA CSR), dealing with a longer
certificate chain and being bound by the expiration date of the external CA.
rob
>
> On Fri, Oct 11, 2019 at 9:47 AM François Cami <fcami@redhat.com
> <mailto:fcami@redhat.com>> wrote:
>
> Hi,
>
> On Fri, Oct 11, 2019 at 5:34 PM Kristian Petersen via FreeIPA-users
> <freeipa-users@lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>> wrote:
> >
> > Hey y'all,
> >
> > What are the pros and cons of using and external or internal CA
> for FreeIPA/IdM? I am trying to decide which to do but having
> trouble finding a lot of info about why I would want to do one or
> the other.
>
> The choices are documented there:
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/install-server
>
> François
>
> > Thanks in advance!
> >
> > --
> > Kristian Petersen
> > System Administrator
> > BYU Dept. of Chemistry and Biochemistry
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>
> > To unsubscribe send an email to
> freeipa-users-leave@lists.fedorahosted.org
> <mailto:freeipa-users-leave@lists.fedorahosted.org>
> > Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>
>
>
> --
> Kristian Petersen
> System Administrator
> BYU Dept. of Chemistry and Biochemistry
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>