Awesome, thanks for the info Rob. I will check out your method. It looks like it (Dogtag) has some improvimg CMC support too, so will have a dig.

On Tue, 3 Apr 2018, 18:19 Rob Crittenden, <rcritten@redhat.com> wrote:
David Harvey via FreeIPA-users wrote:
> Hi FreeIPA users,
>
> As briefly mentioned in "[Freeipa-users] FreeIPA PKI with OpenVPN",
>
> I'm looking into using FreeIPA and Dogtag to provide network certs for
> Chromebooks (from reading so far it looks like I'll need to use SCEP or
> CMC - the latter being preferred).
> Has anyone achieved this, or can anyone offer any pointers to either the
> server or client/extension side hurdles?

IPA doesn't provide direct support itself but its CA is dogtag. You
probably will need to check with the dogtag folks for more details (they
soemtimes lurk on the list so maybe one will chime in).

dogtag supports SCEP for sure, http://www.dogtagpki.org/wiki/SCEP

You just won't get IPA integration this way: issued certs won't be
automatically added to services/hosts/users, won't be revoked on
removal, etc.

The way I've done SCEP with dogtag is create a username/pin on the
dogtag side and do SCEP enrollment using that.

rob