I should have realized that. We'll just stick with FQDNs from now on.

I adjusted my wrapper and now it runs to completion and does what we expect. Thanks, Rob!


photo
Bret Wortman
Founder, Damascus Products, LLC

855-644-2783 | bret@wrapbuddies.co

http://wrapbuddies.co/

70 Main St. Suite 23 Warrenton, VA 20186
On Apr 11 2019, at 1:47 pm, Rob Crittenden <rcritten@redhat.com> wrote:
Bret Wortman via FreeIPA-users wrote:
Thanks, Rob. I'm a lot closer now.

What I'm getting now looks like:

# KRB5_CLIENT_KTNAME=/etc/krb5.keytab ipa cert-request --add
--principal=HTTP/$HOST $DB/$HOST.csr
IPA: error: tHE SERVICE PRINCIPAL FOR SUBJECT ALT NAME myhost in
certificate request does not exist

What we've done before is set up each system with its FQDN and just its
hostname (and some have other aliases as well). Is that what's causing a
problem?

I've looked for documentation on the ipa cert-request command but can't
seem to find anything.

IPA requires that every hostname in a cert exist in IPA (so you don't
request a SAN for a host you don't own). In this case it is looking for
HTTP/<shortname> which I presume doesn't exist.

You can try forcing the creation with:

$ ipa service-add HTTP/<shortname> --force

rob



photo
*Bret Wortman*
Founder, Damascus Products, LLC

855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<https://link.getmailspring.com/link/99891C0D-0C1A-4459-8062-779D1E4268C1@getmailspring.com/0?redirect=mailto%3Abret%40wrapbuddies.co&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>

http://wrapbuddies.co/
<https://link.getmailspring.com/link/99891C0D-0C1A-4459-8062-779D1E4268C1@getmailspring.com/1?redirect=http%3A%2F%2Fwrapbuddies.co%2F&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>

70 Main St. Suite 23 Warrenton, VA 20186

<https://link.getmailspring.com/link/99891C0D-0C1A-4459-8062-779D1E4268C1@getmailspring.com/2?redirect=http%3A%2F%2Ffacebook.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>
<https://link.getmailspring.com/link/99891C0D-0C1A-4459-8062-779D1E4268C1@getmailspring.com/3?redirect=http%3A%2F%2Fwww.linkedin.com%2Fin%2Fbretwortman&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn> <https://link.getmailspring.com/link/99891C0D-0C1A-4459-8062-779D1E4268C1@getmailspring.com/4?redirect=http%3A%2F%2Ftwitter.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn> <https://link.getmailspring.com/link/99891C0D-0C1A-4459-8062-779D1E4268C1@getmailspring.com/5?redirect=http%3A%2F%2Finstagram.com%2Fwrapbuddies&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>

On Apr 11 2019, at 11:31 am, Rob Crittenden <rcritten@redhat.com> wrote:

Bret Wortman via FreeIPA-users wrote:

I know I can paste a CSR from one of our servers into the GUI and
generate a new cert, but how can I do this from a command line?

I've been working with this:

# ipa cert-request --principal=HTTP/$HOST $DB/$HOST.csr


Add the --add option to create the principal if it doesn't already exist
(assuming your kerberos principal has rights to add one).

You can make this all automatic with something like:

# KRB5_CLIENT_KTNAME=/etc/krb5.keytab ipa cert-request --add
--principal=HTTP/$HOST $DB/$HOST.csr

No kinit needed.

But that's giving me an error that the principal doesn't exist. Then
(admittedly, I picked up this command from a discussion I found):

# ipa cert-show $SERIAL_NUMBER --out=$DB/sslcert.pem

How do I get the serial number?

Basically, I'm trying to wrap and automate the process of
granting a new
cert to a server.


The serial number will be in the output from the cert-request command,
twice actually: one decimal, one hex.

You can do it hackily via something like:

SERIAL_NUMBER=$(KRB5_CLIENT_KTNAME=/etc/krb5.keytab ipa cert-request
--principal bar/`hostname` /tmp/csr --add 2>&1 | grep "Serial number:
" | cut -d: -f2)

Though that won't catch errors. You can also do a service-show
HTTP/$HOST to get the serial number.

rob

Sent from Mailspring


_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Sent from Mailspring