On Thu, Feb 13, 2020 at 11:59:34AM +0000, lejeczek via FreeIPA-users
how, if possible at, to have IPA sing a cert sign request which is
not part of IPA's domain/realm?
many thanks, L.
You sure can. Just add the host principal for the name you want,
and use it as the subject principal. The same operator
authorisation and CA ACLs enforcement is applied for every
certificate request, whether the subject DNS name is within the IPA
domain or not.