Hi all,
There was recently discussion about how to issue sub-CA certificates to external entities in FreeIPA (i.e. not lightweight CAs which are internal to an IPA deployment). So I blogged a comprehensive HOWTO, with a discussion of the caveats/limitations.
https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordinat...
As always, feedback/errata/follow-up questions are welcome.
Cheers, Fraser
freeipa-users@lists.fedorahosted.org