Josip Domšić via FreeIPA-users wrote:
> Bundle = server.cert + intermediate-ipa.cert.
>
> Currently, I figured to distribute rootCA to all clients, and each
> server (e.g. nginx) has to serve a bundle (server.cert + intermediate).
> The issue with my work flow is: when ipa-getcert generates a
> certificate, it doesn't include intermediate-ipa.cert.
> So, I have to manually parse */etc/ipa/ca.crt* for a intermediate and
> include it in server.cert.
>
> Am I making any sense?
I don't know why nginx requires this but what you could could try is
write a post-install script (-C) that executes when certmonger saves the
updated certificate that will add the intermediate certificate(s) as
required by nginix. You can pull the intermediates out of
/etc/ipa/ca.crt by excluding the root (issuer == subject).
rob
>
>
> On Thu, Jun 6, 2019 at 7:48 PM Rob Crittenden <rcritten@redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
> Jo Domsic via FreeIPA-users wrote:
> > Hi,
> >
> > I've deployed FreeIPA and now am trying to use ipa-getcert.
> > FreeIPA has been deployed with external CA, and the root CA cert
> has been deployed to all servers.
> > FreeIPA is acting as an intermediate ssl authority.
> >
> > So, when I run ipa-getcert request .... I generate ssl key
> (server.key) and receive vaild ssl cert (server.cert).
> > However the certificate in not quite valid, since it's missing the
> intermediate certificate in the server.cert bundle.
> > Is there a way (e.g. flag or a feature) to include
> intermediate.cert to server.cert?
>
> Missing in what bundle?
>
> There is a way, -R, but it is broken for this use case,
> https://bugzilla.redhat.com/show_bug.cgi?id=1710632
>
> > Or better yet: how did you envision the whole PKI with FreeIPA as
> intermediate certificate?
>
> It should still work fine. The whole chain should be trusted
> system-wide.
>
> rob
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>