Hi all,
There was recently discussion about how to issue sub-CA certificates
to external entities in FreeIPA (i.e. not lightweight CAs which are
internal to an IPA deployment). So I blogged a comprehensive HOWTO,
with a discussion of the caveats/limitations.
https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordi...
As always, feedback/errata/follow-up questions are welcome.
Cheers,
Fraser