32.2. Installing the first IdM CA with an external CA as the root CA into an existing IdM domain

Procedure

1. Start the installation:

   [root@idmserver ~] ipa-ca-install --external-ca

2. Wait till the command line informs you that a certificate signing request (CSR) has been saved.
3. Submit the CSR to the external CA.
4. Copy the issued certificate to the IdM server.

5. Continue the installation by adding the certificates and full path to the external CA files to ipa-ca-install:

   [root@idmserver ~]# ipa-ca-install --external-cert-file=/root/master.crt --external-cert-file=/root/ca.crt

6. On each IdM host in the topology, run the ipa-certupdate utility to update the host with the information about the new certificate from the IdM LDAP.

   重要

   Failing to run ipa-certupdate after generating the IdM CA certificate means that the certificate will not be distributed to the other IdM machines.