Red Hat Summit Red Hat SummitSupportoConsoleSviluppatoriInizia una provaContatti

Questo contenuto non è disponibile nella lingua selezionata.

26.8. Installing a CA Into an Existing IdM Domain

If an IdM domain was installed without a Certificate Authority (CA), you can install the CA services subsequently. Depending on your environment, you can install the IdM Certificate Server CA or use an external CA.
Note
For details on the supported CA configurations, see Section 2.3.2, “Determining What CA Configuration to Use”.
Installing an IdM Certificate Server
  1. Use the following command to install the IdM Certificate Server CA: 
    [root@ipa-server ~] ipa-ca-install
    Copy to Clipboard Toggle word wrap
  2. Run the ipa-certupdate utility on all servers and clients to update them with the information about the new certificate from LDAP. You must run ipa-certupdate on every server and client separately.
    Important
    Always run ipa-certupdate after manually installing a certificate. If you do not, the certificate will not be distributed to the other machines.
Installing External CA
The subsequent installation of an external CA consists of multiple steps:
  1. Start the installation: 
    [root@ipa-server ~] ipa-ca-install --external-ca
    Copy to Clipboard Toggle word wrap
    After this step an information is shown that a certificate signing request (CSR) was saved. Submit the CSR to the external CA and copy the issued certificate to the IdM server.
  2. Continue the installation with passing the certificates and full path to the external CA files to ipa-ca-install: 
    [root@ipa-server ~]# ipa-ca-install --external-cert-file=/root/master.crt --external-cert-file=/root/ca.crt
    Copy to Clipboard Toggle word wrap
  3. Run the ipa-certupdate utility on all servers and clients to update them with the information about the new certificate from LDAP. You must run ipa-certupdate on every server and client separately.
    Important
    Always run ipa-certupdate after manually installing a certificate. If you do not, the certificate will not be distributed to the other machines.
The CA installation does not replace the existing service certificates for the LDAP and web server with ones issued by the new installed CA. For details how to replace the certificates, see Section 26.9, “Replacing the Web Server's and LDAP Server's Certificate”.
Torna in cima
Red Hat logoGithubredditYoutubeTwitter

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Aiutiamo gli utenti Red Hat a innovarsi e raggiungere i propri obiettivi con i nostri prodotti e servizi grazie a contenuti di cui possono fidarsi. Esplora i nostri ultimi aggiornamenti.

Rendiamo l’open source più inclusivo

Red Hat si impegna a sostituire il linguaggio problematico nel codice, nella documentazione e nelle proprietà web. Per maggiori dettagli, visita il Blog di Red Hat.

Informazioni su Red Hat

Forniamo soluzioni consolidate che rendono più semplice per le aziende lavorare su piattaforme e ambienti diversi, dal datacenter centrale all'edge della rete.

Theme

© 2025 Red Hat