3.2. Requesting new certificates for a user, host, or service from IdM CA using certutil

Procedure

1. Create a temporary directory for the certificate database:

   # mkdir ~/certdb/

2. Create a new temporary certificate database, for example:

   # certutil -N -d ~/certdb/

3. Create the CSR and redirect the output to a file. For example, to create a CSR for a 4096 bit certificate and to set the subject to CN=server.example.com,O=EXAMPLE.COM:

   # certutil -R -d ~/certdb/ -a -g 4096 -s "CN=server.example.com,O=EXAMPLE.COM" -8 server.example.com > certificate_request.csr

4. Submit the certificate request file to the CA running on the IdM server. Specify the Kerberos principal to associate with the newly-issued certificate:

   # ipa cert-request certificate_request.csr --principal=host/server.example.com

   The ipa cert-request command in IdM uses the following defaults:

   • The caIPAserviceCert certificate profile

     To select a custom profile, use the --profile-id option.

   • The integrated IdM root CA, ipa

     To select a sub-CA, use the --ca option.