HI Rob,

Thank, that's what I came up as well, but wanted to make sure there really isn't a simpler way.

Regarding the nginx example. It's not really a nginx issue, it's how the whole PKI works.
Let's say we have Root -> Intermediate -> Server cert chain.
Client trusts the root CA, and server sends server CA on each request.
If the client doesn't know about the intermediate (either by having it saved in trust, or receiving it from client on each request) the chain is invalid.
So to combat this issue, server should transmit 2 certificates on each request (e.g. "bundle" them together).


On Fri, Jun 7, 2019 at 5:06 PM Rob Crittenden <rcritten@redhat.com> wrote:
Josip Domšić via FreeIPA-users wrote:
> Bundle  = server.cert + intermediate-ipa.cert.
>
> Currently, I figured to distribute rootCA to all clients, and each
> server (e.g. nginx) has to serve a bundle (server.cert + intermediate).
> The issue with my work flow is: when ipa-getcert generates a
> certificate, it doesn't include intermediate-ipa.cert.
> So, I have to manually parse */etc/ipa/ca.crt* for a intermediate and
> include it in server.cert.
>
> Am I making any sense?

I don't know why nginx requires this but what you could could try is
write a post-install script (-C) that executes when certmonger saves the
updated certificate that will add the intermediate certificate(s) as
required by nginix. You can pull the intermediates out of
/etc/ipa/ca.crt by excluding the root (issuer == subject).

rob

>
>
> On Thu, Jun 6, 2019 at 7:48 PM Rob Crittenden <rcritten@redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
>     Jo Domsic via FreeIPA-users wrote:
>     > Hi,
>     >
>     > I've deployed FreeIPA and now am trying to use ipa-getcert.
>     > FreeIPA has been deployed with external CA, and the root CA cert
>     has been deployed to all servers.
>     > FreeIPA is acting as an intermediate ssl authority.
>     >
>     > So, when I run ipa-getcert request .... I generate ssl key
>     (server.key) and receive vaild ssl cert (server.cert).
>     > However the certificate in not quite valid, since it's missing the
>     intermediate certificate in the server.cert bundle.
>     > Is there a way (e.g. flag or a feature) to include
>     intermediate.cert to server.cert?
>
>     Missing in what bundle?
>
>     There is a way, -R, but it is broken for this use case,
>     https://bugzilla.redhat.com/show_bug.cgi?id=1710632
>
>     > Or better yet: how did you envision the whole PKI with FreeIPA as
>     intermediate certificate?
>
>     It should still work fine. The whole chain should be trusted
>     system-wide.
>
>     rob
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>