Red Hat Summit Red Hat SummitSupportoConsoleSviluppatoriInizia una provaContatti

Questo contenuto non è disponibile nella lingua selezionata.

Chapter 11. Additional installation options

All Red Hat Certificate System instances created with pkispawn make certain assumptions about the instances being installed, such as the default signing algorithm to use for CA signing certificates and whether to allow IPv6 addresses for hosts.

This chapter describes additional configuration options that impact the installation and configuration for new instances, so many of these procedures occur before the instance is created.

11.1. Lightweight sub-CAs
Copia collegamento

Using the default settings, you are able to create lightweight sub-CAs. They enable you to configure services, like virtual private network (VPN) gateways, to accept only certificates issued by one sub-CA. At the same time, you can configure other services to accept only certificates issued by a different sub-CA or the root CA.

If you revoke the intermediate certificate of a sub-CA, all certificates issued by this sub-CA are automatically invalid.

If you set up the CA subsystem in Certificate System, it is automatically the root CA. All sub-CAs you create, are subordinated to this root CA.

11.1.1. Setting up a lightweight sub-CA
Copia collegamento

Depending on your environment, the installation of a sub-CA differs between Internal CAs and External CAs. For more information, see example in Installing CA with external CA signing certificate.

11.1.2. Disabling the creation of lightweight sub-CAs
Copia collegamento

In certain situations, administrators want to disable lightweight sub-CAs. To prevent adding, modifying, or removing sub-CAs, enter the following command on the Directory Server instance used by Certificate System: 

# ldapmodify -D "cn=Directory Manager" -W -x -h server.example.com

dn: cn=aclResources,o=instance_name
changetype: modify
delete: resourceACLS
resourceACLS: certServer.ca.authorities:create,modify:allow (create,modify)
  group="Administrators":Administrators may create and modify lightweight authorities
delete: resourceACLS
resourceACLS: certServer.ca.authorities:delete:allow (delete)
  group="Administrators":Administrators may delete lightweight authorities
Copy to Clipboard Toggle word wrap

This command removes the default Access Control List (ACL) entries, which grant the permissions to manage sub-CAs.

Note

If any ACLs related to lightweight sub-CA creation have been modified or added, remove the relevant values.

11.1.3. Re-enabling the creation of lightweight sub-CAs
Copia collegamento

If you previously disabled the creation of lightweight sub-CAs, you can re-enable the feature by entering the following command on the Directory Server instance used by Certificate System: 

# ldapmodify -D "cn=Directory Manager" -W -x -h server.example.com

dn: cn=aclResources,o=instance_name
changetype: modify
add: resourceACLS
resourceACLS: certServer.ca.authorities:create,modify:allow (create,modify)
  group="Administrators":Administrators may create and modify lightweight authorities
resourceACLS: certServer.ca.authorities:delete:allow (delete)
  group="Administrators":Administrators may delete lightweight authorities
Copy to Clipboard Toggle word wrap

This command adds the Access Control List (ACL) entries, which grant the permissions to manage sub-CAs.

11.2. Enabling IPv6 for a subsystem
Copia collegamento

Certificate System automatically configures and manages connections between subsystems. Every subsystem must interact with a CA as members of a security domain and to perform their PKI operations.

For these connections, Certificate System subsystems can be recognized by their host’s fully-qualified domain name or an IP address. By default, Certificate System resolves IPv4 addresses and host names automatically, but Certificate System can also use IPv6 for their connections. IPv6 is supported for all server connections: to other subsystems, to the administrative console (pkiconsole), or through command-line scripts such as tpsclient: 

op=var_set name=ca_host value=IPv6 address
Copy to Clipboard Toggle word wrap
  1. Install the Red Hat Certificate System packages.

  2. Set the IPv4 and IPv6 addresses in the /etc/hosts file. For example: 

     # vim /etc/hosts

 192.0.0.0    server.example.com IPv4 address
 3ffe:1234:2222:2000:202:55ff:fe67:f527         server6.example.com IPv6 address
    Copy to Clipboard Toggle word wrap

  3. Then, export the environment variable to use the IPv6 address for the server. For example: 

    export PKI_HOSTNAME=server6.example.com
    Copy to Clipboard Toggle word wrap
  4. Run pkispawn to create the new instance. The values for the server host name in the CS.cfg file will be set to the IPv6 address.

11.3. Enabling LDAP-based enrollment profiles
Copia collegamento

  • To install with LDAP-based profiles, set the pki_profile_in_ldap=True option in the [CA] section of the pkispawn configuration file.
Note

In this case, profile files will still appear in /var/lib/pki/ instance_name/ca/profiles/ca/, but will be ignored.

  • To enable LDAP-based profiles on an existing instance, change the following in the instance’s CS.cfg: 

    subsystem.1.class=com.netscape.cmscore.profile.LDAPProfileSubsystem
    Copy to Clipboard Toggle word wrap

    Then, import profiles manually into the database using either the pki command line utility or a custom script.

Torna in cima
Red Hat logoGithubredditYoutubeTwitter

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Aiutiamo gli utenti Red Hat a innovarsi e raggiungere i propri obiettivi con i nostri prodotti e servizi grazie a contenuti di cui possono fidarsi. Esplora i nostri ultimi aggiornamenti.

Rendiamo l’open source più inclusivo

Red Hat si impegna a sostituire il linguaggio problematico nel codice, nella documentazione e nelle proprietà web. Per maggiori dettagli, visita il Blog di Red Hat.

Informazioni su Red Hat

Forniamo soluzioni consolidate che rendono più semplice per le aziende lavorare su piattaforme e ambienti diversi, dal datacenter centrale all'edge della rete.

Theme

© 2025 Red Hat