On 6/30/23 12:38, Rob Crittenden wrote:
The CA is stored in the NSS database /etc/pki/pki-tomcat/alias. You
can
use pk12util to extract it into a PKCS#12, then extract that and you'll
have the CA. This would keep the CA trust the same but with a fresh
install you'd need new keytabs for any enrolled clients.
FYI< I ran into an issue trying to re-use the root CA from the existing
install. ipa-server-install won't accept the --external-cert-file
option unless it's previously been run with --external-ca. And, of
course, the pre-existing CA certificate and key don't match the CSR
(and presumably the private key) that are used to create the CSR.
I'm starting to suspect that it will be easier to just accept that I'm
going to have to use a new root CA, rather than trying to re-use the old
one.
--
========================================================================
Google Where SkyNet meets Idiocracy
========================================================================