Chapter 2. Managing certificates for users, hosts, and services using the integrated IdM CA

Procedure

1. Under the Identity tab, select the Users, Hosts, or Services subtab.

2. Click the name of the user, host, or service to open its configuration page.

   Figure 2.1. List of Hosts

   
3. Click Actions New Certificate.
4. Optional: Select the issuing CA and profile ID.
5. Follow the instructions for using the certutil command-line (CLI) utility on the screen.
6. Click Issue.

Procedure

1. Create a temporary directory for the certificate database:

   # mkdir ~/certdb/

2. Create a new temporary certificate database, for example:

   # certutil -N -d ~/certdb/

3. Create the CSR and redirect the output to a file. For example, to create a CSR for a 4096 bit certificate and to set the subject to CN=server.example.com,O=EXAMPLE.COM:

   # certutil -R -d ~/certdb/ -a -g 4096 -s "CN=server.example.com,O=EXAMPLE.COM" -8 server.example.com > certificate_request.csr

4. Submit the certificate request file to the CA running on the IdM server. Specify the Kerberos principal to associate with the newly-issued certificate:

   # ipa cert-request certificate_request.csr --principal=host/server.example.com

   The ipa cert-request command in IdM uses the following defaults:

   • The caIPAserviceCert certificate profile

     To select a custom profile, use the --profile-id option.

   • The integrated IdM root CA, ipa

     To select a sub-CA, use the --ca option.

Procedure

1. Create one or more aliases for your Kerberos principal test/server.example.com. For example, test1/server.example.com and test2/server.example.com.

2. In the CSR, add a subjectAltName for dnsName (server.example.com) and otherName (test2/server.example.com). To do this, configure the openssl.conf file to include the following line specifying the UPN otherName and subjectAltName:

   otherName=1.3.6.1.4.1.311.20.2.3;UTF8:test2/server.example.com@EXAMPLE.COM
   DNS.1 = server.example.com

3. Create a certificate request using openssl:

   openssl req -new -newkey rsa:2048 -keyout test2service.key -sha256 -nodes -out certificate_request.csr -config openssl.conf

4. Submit the certificate request file to the CA running on the IdM server. Specify the Kerberos principal to associate with the newly-issued certificate:

   # ipa cert-request certificate_request.csr --principal=host/server.example.com

   The ipa cert-request command in IdM uses the following defaults:

   • The caIPAserviceCert certificate profile

     To select a custom profile, use the --profile-id option.

   • The integrated IdM root CA, ipa

     To select a sub-CA, use the --ca option.