8.2. Requesting SSL certificates without single sign-on

Prerequisites

• An IdM client configured without Kerberos single-sign on.

Procedure

• Use certmonger to request a certificate using the FQDN:

  [root@idm-client.ad.example.com ~]# ipa-getcert request -r \
        -f /etc/httpd/alias/server.crt \
        -k /etc/httpd/alias/server.key \
        -N CN=ipa-client.ad.example.com \
        -D ipa-client.ad.example.com \
        -K host/idm-client.ad.example.com@IDM.EXAMPLE.COM \
        -U id-kp-serverAuth

  The certmonger service uses the default host key stored in the /etc/krb5.keytab file to authenticate to the IdM Certificate Authority (CA).