Peter Tselios via FreeIPA-users wrote:
I need to add a SAN in a certificate issued by FreeIPA.
I found a much older thread in the mailing list
confirmed it's possible.
But since I don't want to "destroy" the certificate, I want to know if the
ipa-getcert resubmit -i <ID> -D "newname.example.com"
will replace current SANs or just add the new SAN in the SAN list.
A new certificate is requested from IPA. You cannot "update" an existing
You have to provide all existing and new values for -D IIRC.