6.3. Copying certificates to the SSSD directory

Procedure

1. Ensure that you have SSSD installed on the system.

   # rpm -q sssd
   sssd-2.0.0.43.el8_0.3.x86_64

2. Create a /etc/sssd/pki directory:

   # file /etc/sssd/pki
   /etc/sssd/pki/: directory

3. Copy the rootCA.crt as a PEM file in the /etc/sssd/pki/ directory:

   # cp /tmp/ca/rootCA.crt /etc/sssd/pki/sssd_auth_ca_db.pem

   Now you have successfully generated the certificate authority and certificates, and you have saved them in the /etc/sssd/pki directory.

   注記

   If you want to share the Certificate Authority certificates with another application, you can change the location in sssd.conf:

   • SSSD PAM responder: pam_cert_db_path in the [pam] section
   • SSSD ssh responder: ca_db in the [ssh] section

   For details, see man page for sssd.conf.

   Red Hat recommends keeping the default path and using a dedicated Certificate Authority certificate file for SSSD to make sure that only Certificate Authorities trusted for authentication are listed here.