I am trying to get my ipa certificate signed by openca and its getting rejected due to hostname.

The following hostnames were rejected because the system couldn't link them to your 
account, if they are valid please verify the domains against your account.
Rejected: Certificate Authority

does any one know how to either generate the certificates manually so all the information can be included or if there is some setting I am missing that is causing this error on the initial install of the ipa server.

host is centos 6.3 I have installed ipa-server with dns


Currently, there are 3 types how FreeIPA can blend in a existent certificate environment:

  1. No blending - FreeIPA is simply installed with own PKI and self-signed CA certificate
  2. External CA - FreeIPA is installed with own PKI, but it's CA certificate is signed with external certificate authority. This requires the external CA to allow sub CAs, which is not so common. I think this is the root cause of your problem.
  3. CA-less installation - FreeIPA does not configure own CA, but uses signed host certificates from external CA. This should work in your case. This feature was introduced in FreeIPA 3.2.0.

Thus, my advise would be to try CA-less installation with certs signed by openca.

  • I was planning to use cacert.org. I will have to double check and see if it allows sub ca's
    – Kendrick
    Feb 10 '14 at 23:49
  • just checked and there is a way but not with the certificate I had. The information was greatly appriciated. Just to verify does that mean that the ipa associated clients will be able to get a host certificate from the freeipa or is that something that has to be assigned seperatly?
    – Kendrick
    Feb 11 '14 at 0:21
  • You will be able to get client host certificate for options Self-signed CA and External CA options as there is a real PKI server running in FreeIPA server. With CA-less, there is no FreeIPA PKI and you will need to assign the host cert separately from your PKI (cacert.org or other at your disposal). Feb 11 '14 at 5:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.