Questo contenuto non è disponibile nella lingua selezionata.
Chapter 26. Adding the IdM CA service to an IdM server in a deployment without a CA
If you previously installed an Identity Management (IdM) domain without the certificate authority (CA) component, you can add the IdM CA service to the domain by using the ipa-ca-install command. Depending on your requirements, you can select one of the following options:
For details on the supported CA configurations, see Planning your CA services.
26.1. Installing the first IdM CA as the root CA into an existing IdM domain
If you previously installed Identity Management (IdM) without the certificate authority (CA) component, you can install the CA on an IdM server subsequently. Follow this procedure to install, on the idmserver server, an IdM CA that is not subordinate to any external root CA.
Prerequisites
-
You have
rootpermissions on idmserver. - The IdM server is installed on idmserver.
- Your IdM deployment has no CA installed.
-
You know the IdM
Directory Managerpassword.
Procedure
On idmserver, install the IdM Certificate Server CA:
[root@idmserver ~] ipa-ca-installOn each IdM host in the topology, run the
ipa-certupdateutility to update the host with the information about the new certificate from the IdM LDAP.ImportantIf you do not run
ipa-certupdateafter generating the IdM CA certificate, the certificate will not be distributed to the other IdM machines.
26.2. Installing the first IdM CA with an external CA as the root CA into an existing IdM domain
If you previously installed Identity Management (IdM) without the certificate authority (CA) component, you can install the CA on an IdM server subsequently. Follow this procedure to install, on the idmserver server, an IdM CA that is subordinate to an external root CA, with zero or several intermediate CAs in between.
Prerequisites
-
You have
rootpermissions on idmserver. - The IdM server is installed on idmserver.
- Your IdM deployment has no CA installed.
-
You know the IdM
Directory Managerpassword.
Procedure
Start the installation:
[root@idmserver ~] ipa-ca-install --external-ca- Wait till the command-line interface informs you that a certificate signing request (CSR) has been saved.
- Submit the CSR to the external CA.
- Copy the issued certificate to the IdM server.
Continue the installation by adding the certificates and full path to the external CA files to
ipa-ca-install:[root@idmserver ~]# ipa-ca-install --external-cert-file=/root/master.crt --external-cert-file=/root/ca.crtOn each IdM host in the topology, run the
ipa-certupdateutility to update the host with the information about the new certificate from the IdM LDAP.ImportantFailing to run
ipa-certupdateafter generating the IdM CA certificate means that the certificate will not be distributed to the other IdM machines.
