Hello, I have a FreeIPA server that is currently running as a CA only, no clients connect, no LDAP entries have ever been made, no DNS etc... The original ipa CA is how it was setup during the initial install. A second CA was created, company.com CA, and certs have been created from this CA. I've setup two new freeipa boxes and have them replicated and migrated our openldap users and groups.
What we would like to do now is to export the company,com CA from the "freeipa CA only" and import it into the new freeipa environment. I haven't been able to find anything about doing this in my web searches so far.
Can somebody help me with this?
Thanks, Ralph
On Tue, Oct 16, 2018 at 01:23:11PM -0400, Ralph Crongeyer via FreeIPA-users wrote:
Hello, I have a FreeIPA server that is currently running as a CA only, no clients connect, no LDAP entries have ever been made, no DNS etc... The original ipa CA is how it was setup during the initial install. A second CA was created, company.com CA, and certs have been created from this CA. I've setup two new freeipa boxes and have them replicated and migrated our openldap users and groups.
What we would like to do now is to export the company,com CA from the "freeipa CA only" and import it into the new freeipa environment. I haven't been able to find anything about doing this in my web searches so far.
Can somebody help me with this?
Thanks, Ralph
Hi Ralph,
It's not clear what you want to accomplish. Do you want to:
- Import the company.com CA certificate into FreeIPA so that IPA servers and clients will use it as a trusted CA? (Use `ipa-cacert-manage install` to do this).
- Reissue the IPA CA certificate as a subordinate of the company.com CA? You can use `ipa-cacert-manage renew --external-ca` to do this.
- Something else?
Cheers, Fraser
freeipa-users@lists.fedorahosted.org