On 28 August 2019 17:12:43 CEST, "François Cami via FreeIPA-users"
On Wed, Aug 28, 2019 at 5:08 PM Markus Larsson via FreeIPA-users
> On 28 August 2019 16:47:35 CEST, lejeczek via FreeIPA-users
> >On 28/08/2019 15:15, Markus Larsson via FreeIPA-users wrote:
> >> I might be wrong here but it sure looks like the cert is being
> >> rejected because the name on service doesn't match the cert.
> >> I'm not at a place where I could check but it looks like that to
> >> BR
> >> Markus
> >> On 28 August 2019 16:11:17 CEST, lejeczek via FreeIPA-users
> >> <freeipa-users(a)lists.fedorahosted.org> wrote:
> >> hi guys
> >> Would a subdomain on a separate subnet (from which nodes do
> >> access to IPA's IPs) to which IPA is connect via
> >> have clients successfully install and connect?
> >> I've crafted a sub domain/zone with, I think, all the records
> >> and those point to IPAs "secondary" IPs and when I install
> >clients they
> >> fail:
> >> ...
> >> Do you want to download the CA cert from
> >> http://ipa2.subdomain.private.freeipa/ipa/config/ca.crt?
> >> (this is INSECURE) [no]: yes
> >> Downloading the CA certificate via HTTP, this is INSECURE
> >> Successfully retrieved CA cert
> >> Joining realm failed: libcurl failed to execute the HTTP POST
> >> transaction, explaining: Problem with the SSL CA cert (path?
> >> rights?)
> >> Installation failed. Rolling back changes.
> >> ...
> >> Still the same client:
> >> $ curl http://ipa2.subdomain.private.freeipa/ipa/config/ca.crt
> >> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
> >> <html><head>
> >> <title>301 Moved Permanently</title>
> >> </head><body>
> >> <h1>Moved Permanently</h1>
> >> <p>The document has moved <a
> >> </body></html>
> >> That host in returned URL above is where IPA top domain lives,
> >but nodes
> >> on the subnet cannot access there.
> >> This fails by design and what I'm trying will not work? Or
> >> and I'm only missing something?
> >> If that is how IPA currently works(or rather doesn't) then is
> >> something that may get included/fixed in the future?
> >> many thanks, L>
> >Would it mean that each new subzone needs to have a bunch of
> >top of DNS) created for stuff as basic as nodes/clients want to
> >that subzone?
> >My case may be bit different from a regular - IPA top level domain
> >subdomain but only with one simple fact that subdomain is on the
> >which has no connection to IPA top level domain subnet (other than
> >servers are connected to both subnets directly) - but would this one
> >thing be such a big impediment?
> >I thought that what I'm doing is not that unusual and many have done
> >before and that IPA is prepared for this scenario.
> >p.s. I'm on Centos' 4.6.4 version.
> >thanks, L.
> Now that say that I'm probably mistaken. The certs should work given
that the ipa server has the same name just a different IP when coming
from this network.
That's split horizon DNS.
Correct. Which will be needed if he/she doesn't want to add alternate names to the
While split horizon can be problematic it is sometimes needed.
Then again adding SAN to the certs is probably better.
> If it has a different DNS name then cert work is needed.
The OP said "sub domain/zone" so the IPA servers would be named
Well OP said the machines that would be joined would be on a different network and in a
>> Another option to consider is to have a directory server on that
>> I realise now that I might be rambling so I better summarize, what
>does DNS records for the ipa server look like on that subnet?
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> Fedora Code of Conduct:
>> List Guidelines:
>> List Archives:
>FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>To unsubscribe send an email to
>Fedora Code of Conduct:
>List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines