Jakob Ackermann via FreeIPA-users wrote:
The client is joined to the IPA domain and gets a certificate from
the
sub-ca `puppet` with `ipa-getcert request -x puppet`. In order to have
the puppet agent to be able to talk to puppet server I need the puppet
sub-ca certificate.
How can I distribute the sub-ca certificate to the client? Running
`ipa-certupdate` did not work.
Create a file containing the pem for the sub CA:
$ ipa ca-show test --certificate-out=/tmp/test.pem
Add that to the list of managed CA certs
# ipa-cacert-manage install /tmp/test.pem
Now ipa-certupdate will pull it.
rob