On to, 17 marras 2022, Francis Augusto Medeiros-Logeay via FreeIPA-users wrote:
Hi,
I try to find good documentation on SCEP and FreeIPA, but I cannot
find something that seems updated nor conclusive.
Does FreeIPA support SCEP out of the box, or does it need some hacking
to do so?
And does it support other types of certificate enrolment besides its
own api/client?
It really depends on what you are asking for: FreeIPA as an integrated
CA or FreeIPA as a consumer of some other CA.
As a consumer of some other CAs, certmonger supports requesting
certificates through SCEP. See certmonger-scep-submit(8) man page and
/usr/share/doc/certmonger/scep.txt for details.
FreeIPA integrated CA does not support SCEP itself. Well, Dogtag PKI
does have support for SCEP responder but it is not configured by default
and is not supported in IPA frontend that does verification of the
request.
FreeIPA integrated CA supports ACME protocol (same as Let's Encrypt).
Would using ACME be a better option?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland