On to, 10 syys 2020, Dominik Vogt via FreeIPA-users wrote:
On Thu, Sep 10, 2020 at 11:17:42AM -0400, Rob Crittenden via
FreeIPA-users wrote:
> > a customer wants to use the Redhat certificate system instead of
> > the one built into freeipa. AFAIK both use dogtag under the hood.
>
> Can you expand on what "instead of" means here? What type of integration
> are they looking for? You seem to suggest below that both would be running.
I'm really no freeipa expert. All I know is that some certificate
system is normally installed with the ipa-server package. The
customer wants to use RHCS instead because of some feature that's
only present in RHCS. (We've already dicussed that with Redhat
support.).
RHEL IdM does not support a configuration where RHCS is used on the same
host as RHEL IdM server and as a replacement of integrated RHEL IdM CA.
This is not tested and was never supported.
If you want, you may involve me into your support case with Red Hat.
You can, of course, run RHCS on a separate system and use RHEL IdM with
external CA provided by RHCS. With this configuration, no integration
would really exist between the two systems beyond external CA providing
standard way of signing IPA CA as its own sub-CA or by issuing server
certificates for IPA services.
If possible, we want to disable the certificate system that comes
with freeipa and use only RHCS.
The point is that the customer wants some evidence against running
RHCS on the freeipa server. (Not just security and availability
issues.)
What else is needed other than it is not supported, not tested, and not
considered as a supported configuration by RHEL IdM team?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland