Ian Pilcher wrote:
On 6/30/23 12:38, Rob Crittenden wrote:
> The CA is stored in the NSS database /etc/pki/pki-tomcat/alias. You can
> use pk12util to extract it into a PKCS#12, then extract that and you'll
> have the CA. This would keep the CA trust the same but with a fresh
> install you'd need new keytabs for any enrolled clients.
FYI< I ran into an issue trying to re-use the root CA from the existing
install. ipa-server-install won't accept the --external-cert-file
option unless it's previously been run with --external-ca. And, of
course, the pre-existing CA certificate and key don't match the CSR
(and presumably the private key) that are used to create the CSR.
I'm starting to suspect that it will be easier to just accept that I'm
going to have to use a new root CA, rather than trying to re-use the old
one.
IPA doesn't support providing an existing CA cert and key to bootstrap
the install. In this case the new install will be an external CA with
that CA being your previous cert and key. You'll need to roll your own
signing using the private key.
I forgot to mention that if you're using the same domain/realm
combination you'll need to use the --subject-base option with the new
install so that the "new" IPA CA subject is different from the previous one.
rob