Hello, I need to add a SAN in a certificate issued by FreeIPA. I found a much older thread in the mailing list (https://www.redhat.com/archives/freeipa-users/2015-September/msg00184.html) that confirmed it's possible. But since I don't want to "destroy" the certificate, I want to know if the command:
ipa-getcert resubmit -i <ID> -D "newname.example.com"
will replace current SANs or just add the new SAN in the SAN list.
Peter Tselios via FreeIPA-users wrote:
Hello, I need to add a SAN in a certificate issued by FreeIPA. I found a much older thread in the mailing list (https://www.redhat.com/archives/freeipa-users/2015-September/msg00184.html) that confirmed it's possible. But since I don't want to "destroy" the certificate, I want to know if the command:
ipa-getcert resubmit -i <ID> -D "newname.example.com"
will replace current SANs or just add the new SAN in the SAN list.
A new certificate is requested from IPA. You cannot "update" an existing certificate.
You have to provide all existing and new values for -D IIRC.
rob
freeipa-users@lists.fedorahosted.org
-
Peter Tselios -
Rob Crittenden