On Tue, Mar 20, 2018 at 08:22:53AM -0500, Kirk VanOpdorp via FreeIPA-users wrote:
I have an external CA that I need to renew due to the root CA
expiring soon
and they grumbled at the CA subject last time and I suggested I would look
into changing it. I don't see any route via the ipa-cacert-manage renew to
change the subject but I'd be up for investigating if you have any general
guidance on what may be involved to get it to work. I don't know if there
are a lot of things tied to the CA subject in the inner workings of the
system that may result in unexpected results but I can work through that
also and provide feedback.
Hi Kirk,
Changing the CA subject DN is a drastic measure. Many problems can
arise. I blogged about this last year. The first post discusses
why you should not do this and the problems that arise, and the
second post discusses how to change the CA subject DN in FreeIPA.
https://frasertweedale.github.io/blog-redhat/posts/2017-11-20-changing-ca...
https://frasertweedale.github.io/blog-redhat/posts/2017-11-22-changing-ca...
If you proceed with this, good luck! Let us know how it goes.
Cheers,
Fraser