0

We have a certificate authority with Freeipa and I try to put in place a subordinate CA with Freeipa too.

I started the installation of the subordinate CA with the ipa-server-install --external-ca command. The result is an ipa.csr file.

The Freeipa documentation says I have to have the certificate signed by the root CA:

This will generate a CSR in /root/ipa.csr. This is the file you need to provide to your CA for signing. You will also need to obtain a PEM copy of your CA trust chain.

Once you have both of these you can continue the installer

But there is no details. The ipa-getcert request command tells Certmonger to generate a signing request and to submit the request to for signing to a CA.

I would like just to sign the CSR by the root CA (because I already have the CSR automatically generated during the installation). How to do that please?

Thank you a lot!

Improve this question
0

The --external-ca flag is used only if you want FreeIPA to be a "subordinate" CA off of an external CA. For example, if you have Active Directory, and you want AD to be your root CA. If FreeIPA is going to be your root CA, then you don't need the --external-ca flag.

The best thing to do in this case would be to reinstall your OS, and start over.

Improve this answer
2
  • Thank you David. If i install a CA without the --external-ca option then this CA will have its own self signed certificate... I would like to have an intermediary CA whose certificate is signed by the root CA. So I will have a chain of certification with two CA (it's important for the planned architecture). So I don't know how to do... – Beretta Dec 7 '19 at 9:44
  • Ah, my apologies. I was confused about your end goal. I know that you can run ipa-server-install --external-ca once to get a new CSR, and then you can run ipa-server-install again once you have the signed cert. I cannot remember the flags off the top of my head for the second run, but I do know that you would run the ipa-server-install a second time -- assuming you were also generating the CSR. If at all possible, that's what I would recommend. If you absolutely do have to use a CSR that was already generated elsewhere, then bear in mind that you'll also need the private key. – David W Dec 7 '19 at 20:08
0

I found a solution.

You must export the profile of the root CA, modify it and then import it.

Then you have to install the subordinate AC with the command ipa-server-install --external-ca (...).

The root CA signs the csr generated with the ipa cert-request command.

Then we can continue the installation of the subordinate CA.

More details are given here:

https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordinate-ca.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.