On pe, 14 helmi 2020, Florence Blanc-Renaud via FreeIPA-users wrote:
On 2/14/20 9:39 AM, lejeczek via FreeIPA-users wrote:
>On 13/02/2020 14:46, Fraser Tweedale wrote:
>>On Thu, Feb 13, 2020 at 11:59:34AM +0000, lejeczek via FreeIPA-users
>>wrote:
>>>hi everyone,
>>>
>>>how, if possible at, to have IPA sing a cert sign request which is
>>>not part of IPA's domain/realm?
>>>
>>>many thanks, L.
>>>
>>You sure can. Just add the host principal for the name you want,
>>and use it as the subject principal. The same operator
>>authorisation and CA ACLs enforcement is applied for every
>>certificate request, whether the subject DNS name is within the IPA
>>domain or not.
>>
>>Cheers,
>>Fraser
>>
>okey, would you correct whatever my wrongdoing here was?
>
>$ ipa dnsrecord-add dracownia.nr. idrac-HV2315J-rider --a-rec=192.168.2.11
>
>$ ipa host-add idrac-941415J-swir.dracownia.nr
>
>$ ipa service-add http/idrac-941415J-swir.dracownia.nr
>
>$ ipa service-add-host --hosts=idrac-941415J-swir.dracownia.nr
>http/idrac-941415J-swir.dracownia.nr
>
>$ ipa cert-request idrac-941415J-swir.csr
>--principal=http/idrac-941415J-swir.dracownia.nr
>ipa: ERROR: invalid 'csr': hostname in subject of request
>'idrac-941415J-swir' does not match name or aliases of principal
>'http/idrac-941415J-swir.dracownia.nr@IPA_DOMAIN'
>
It looks like the CSR contains a hostname not fully qualified in its
subject. You can check with:
$ openssl req -noout -text -in idrac-941415J-swir.csr
Correct. Also, browsers will expect a service principal starting with
HTTP/..., not http/... -- the case matters!
So you should create a proper principal first and also re-generate your
CSR.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland