Hi Alexander,
On Thu, 30 Nov 2017, Alexander Bokovoy via FreeIPA-users wrote:
On to, 30 marras 2017, dbischof--- via FreeIPA-users wrote:
>
> one of my IPA masters (
master.example.com, IPA 4.5) runs a Dokuwiki and a
> DAViCal instance besides IPA. DNS is external (not managed by IPA) and I
> asked the DNS admin to create CNAMEs
wiki.example.com and
cal.example.com
> that point to
master.example.com).
>
> That works, but my users get browser warnings "SSL_ERROR_BAD_CERT_DOMAIN"
> upon first connect via the CNAMEs and have to allow exceptions.
> Unbeautiful.
>
> Therefore, I force-created dummy hosts in IPA and let them be managed by
>
master.example.com:
>
> $ ipa host-add
wiki.example.com --force
> $ ipa service-add HTTP/wiki.example.com --force
> $ ipa service-add-host HTTP/wiki.example.com --host
master.example.com
>
> If i would revoke the certificate for HTTP/master.example.com now (didn't
> dare yet), will a new certificate be created that contains
wiki.example.com
> as X509v3 Subject Alternative Name? It probably isn't that easy, right?
Yes, it is not that easy. You do not need to revoke anything, though.
Use getcert to re-submit existing certificate request that tracks your
http certificate in /etc/httpd/alias:
1. Obtain request ID
# getcert list -d /etc/httpd/alias
2. Re-submit the request with additional SANs and retaining original SAN and Kerberos
principal:
# getcert resubmit -i "REQUEST-ID" -D
master.example.com -D
wiki.example.com -K
HTTP/master.example.com
3. Watch that the request went to the MONITORING state
# getcert list -i "REQUEST-ID"
You'll see that it has two 'dns' properties now.
works like a charm, even with multiple "-D"s, big thank you.
Mit freundlichen Gruessen/With best regards,
--Daniel.