Managing certificates in IdM

Administrators use X.509 certificates to authenticate users, hosts, and services, and to enable digital signing and encryption. In Red Hat Identity Management (IdM), you can manage certificates by using the integrated or an external Certificate Authority (CA).

You can request and renew certificates by using the certmonger service, the certutil tool, or Ansible Playbooks. To replace the web server and LDAP server certificates of IdM servers, you must perform manual actions.

Administrators can create lightweight sub-CAs to issue certificates for a specific purpose, such as user certificates for a VPN gateway. The administrator can then invalidate all certificates for this service by revoking the sub-CA's certificate when this VPN gateway is no longer needed.