第12章 アイデンティティー: ホストおよびサービスへのアクセス委譲

ipa service-add-host principal --hosts=hostnames

# ipa service-add-host principal --hosts=hostnames

ipa service-add-host http/web.example.com --hosts=client1.example.com

# ipa service-add-host http/web.example.com --hosts=client1.example.com

kinit -kt /etc/krb5.keytab host/`hostname`
ipa-getkeytab -s `hostname` -k /tmp/test.keytab -p http/web.example.com

# kinit -kt /etc/krb5.keytab host/`hostname`
# ipa-getkeytab -s `hostname` -k /tmp/test.keytab -p http/web.example.com
Keytab successfully retrieved and stored in: /tmp/test.keytab

ipa cert-request --add --principal=http/web.example.com web.csr

# ipa cert-request --add --principal=http/web.example.com web.csr
  Certificate: MIICETCCAXqgA...[snip]
  Subject: CN=web.example.com,O=EXAMPLE.COM
  Issuer: CN=EXAMPLE.COM Certificate Authority
  Not Before: Tue Feb 08 18:51:51 2011 UTC
  Not After: Mon Feb 08 18:51:51 2016 UTC
  Fingerprint (MD5): c1:46:8b:29:51:a6:4c:11:cd:81:cb:9d:7c:5e:84:d5
  Fingerprint (SHA1):
  01:43:bc:fa:b9:d8:30:35:ee:b6:54:dd:a4:e7:d2:11:b1:9d:bc:38
  Serial number: 1005