David Harvey via FreeIPA-users wrote:
Hi FreeIPA users,
As briefly mentioned in "[Freeipa-users] FreeIPA PKI with OpenVPN",
I'm looking into using FreeIPA and Dogtag to provide network certs for
Chromebooks (from reading so far it looks like I'll need to use SCEP or
CMC - the latter being preferred).
Has anyone achieved this, or can anyone offer any pointers to either the
server or client/extension side hurdles?
IPA doesn't provide direct support itself but its CA is dogtag. You
probably will need to check with the dogtag folks for more details (they
soemtimes lurk on the list so maybe one will chime in).
dogtag supports SCEP for sure, http://www.dogtagpki.org/wiki/SCEP
You just won't get IPA integration this way: issued certs won't be
automatically added to services/hosts/users, won't be revoked on
The way I've done SCEP with dogtag is create a username/pin on the
dogtag side and do SCEP enrollment using that.