SupportoConsoleSviluppatoriInizia una provaContatti

Questo contenuto non è disponibile nella lingua selezionata.

Chapter 30. Adding the IdM CA service to an IdM server in a deployment without a CA

If you previously installed an Identity Management (IdM) domain without the certificate authority (CA) component, you can add the IdM CA service to the domain by using the ipa-ca-install command. Depending on your requirements, you can select one of the following options:

Note

For details on the supported CA configurations, see Planning your CA services.

30.1. Installing the first IdM CA as the root CA into an existing IdM domain

If you previously installed Identity Management (IdM) without the certificate authority (CA) component, you can install the CA on an IdM server subsequently. Follow this procedure to install, on the idmserver server, an IdM CA that is not subordinate to any external root CA.

Prerequisites

  • You have root permissions on idmserver.
  • The IdM server is installed on idmserver.
  • Your IdM deployment has no CA installed.
  • You know the IdM Directory Manager password.

Procedure

  1. On idmserver, install the IdM Certificate Server CA: 

    [root@idmserver ~] ipa-ca-install

  2. On each IdM host in the topology, run the ipa-certupdate utility to update the host with the information about the new certificate from the IdM LDAP.

    Important

    If you do not run ipa-certupdate after generating the IdM CA certificate, the certificate will not be distributed to the other IdM machines.

30.2. Installing the first IdM CA with an external CA as the root CA into an existing IdM domain

If you previously installed Identity Management (IdM) without the certificate authority (CA) component, you can install the CA on an IdM server subsequently. Follow this procedure to install, on the idmserver server, an IdM CA that is subordinate to an external root CA, with zero or several intermediate CAs in between.

Prerequisites

  • You have root permissions on idmserver.
  • The IdM server is installed on idmserver.
  • Your IdM deployment has no CA installed.
  • You know the IdM Directory Manager password.

Procedure

  1. Start the installation: 

    [root@idmserver ~] ipa-ca-install --external-ca
  2. Wait till the command-line interface informs you that a certificate signing request (CSR) has been saved.
  3. Submit the CSR to the external CA.
  4. Copy the issued certificate to the IdM server.

  5. Continue the installation by adding the certificates and full path to the external CA files to ipa-ca-install: 

    [root@idmserver ~]# ipa-ca-install --external-cert-file=/root/master.crt --external-cert-file=/root/ca.crt

  6. On each IdM host in the topology, run the ipa-certupdate utility to update the host with the information about the new certificate from the IdM LDAP.

    Important

    Failing to run ipa-certupdate after generating the IdM CA certificate means that the certificate will not be distributed to the other IdM machines.

Red Hat logoGithubRedditYoutubeTwitter

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Aiutiamo gli utenti Red Hat a innovarsi e raggiungere i propri obiettivi con i nostri prodotti e servizi grazie a contenuti di cui possono fidarsi.

Rendiamo l’open source più inclusivo

Red Hat si impegna a sostituire il linguaggio problematico nel codice, nella documentazione e nelle proprietà web. Per maggiori dettagli, visita ilBlog di Red Hat.

Informazioni su Red Hat

Forniamo soluzioni consolidate che rendono più semplice per le aziende lavorare su piattaforme e ambienti diversi, dal datacenter centrale all'edge della rete.

© 2024 Red Hat, Inc.