On Tue, 4 Dec 2018, Fraser Tweedale wrote:
On Tue, Dec 04, 2018 at 01:49:04AM -0500, Rob Foehl via FreeIPA-users
wrote:
> Is the service principal necessary just to satisfy this requirement?
>
It is required, but you can use the host principal, i.e.
"host/foo.example.com(a)YOUR.REALM".
Ahhh, of course. Works fine, thanks!
(For what it's worth, every reference I could find for ipa-getcert -K
explicitly calls it a service principal, while the getcert-request(1) man
page just says principal name. I also couldn't find an example of how to
create a host certificate using ipa-getcert, only via the UI or at
ipa-client-install time.)
-Rob