I'm having some trouble getting sub-ca signed certificates issued and managed by
certmonger. The implementation here [https://www.freeipa.org/page/V4/Sub-CAs
how that should work. I see that the -X option can be passed to ipa-getcert to specify the
issuer, but every time I create a request with -X specified I get an error.
Steps to reproduce:
1. Create a new CA named "Test" through the FreeIPA web UI.
2. Run the following on a host enrolled in freeIPA:
ipa-getcert request -k /root/test.key -f /root/test.crt -I "testrequest" -X
3. Run ipa-getcert list and receive the an error message:
Request ID 'test':
ca-error: Server at https://ipa02.mgmt.crosschx.com/ipa/xml
failed request, will retry:
4035 (RPC failed at server. Request failed with status 500: Non-2xx response from CA REST
API: 500. ).
key pair storage: type=FILE,location='/root/test.key'
Running FreeIPA 4.6.4
Thanks for the help!