26.9. Replacing the Web Server's and LDAP Server's Certificate
To replace the service certificates for the web server and LDAP server:
- Request a new certificate. You can do this using:
- the integrated CA: see Section 24.1.1, “Requesting New Certificates for a User, Host, or Service” for details.
- an external CA: generate a private key and certificate signing request (CSR). For example, using OpenSSL:
$ openssl req -new -newkey rsa:2048 -days 365 -nodes -keyout new.key -out new.csr -subj '/CN=idmserver.idm.example.com,O=IDM.EXAMPLE.COM'
Submit the CSR to the external CA. The process differs depending on the service to be used as the external CA.
- Replace the Apache web server's private key and certificate:
[root@ipaserver ~]# ipa-server-certinstall -w --pin=password new.key new.crt
- Replace the LDAP server's private key and certificate:
[root@ipaserver ~]# ipa-server-certinstall -d --pin=password new.key new.cert
