Red Hat SummitEste conteúdo não está disponível no idioma selecionado.
26.6. Installing Third-Party Certificates for HTTP or LDAP
Installing a new SSL server certificate for the Apache Web Server, the Directory Server, or both replaces the current SSL certificate with a new one. To do this, you need:
- your private SSL key (
ssl.keyin the procedure below) - your SSL certificate (
ssl.crtin the procedure below)
For a list of accepted formats of the key and certificate, see the ipa-server-certinstall(1) man page.
Prerequisites
The
ssl.crt certificate must be signed by a CA known by the service you are loading the certificate into. If this is not the case, install the CA certificate of the CA that signed ssl.crt into IdM, as described in Section 26.3, “Installing a CA Certificate Manually”.
This ensures that IdM recognizes the CA, and thus accepts
ssl.crt.
Installing the Third-Party Certificate
- Use the
ipa-server-certinstallutility to install the certificate. Specify where you want to install it:--httpinstalls the certificate in the Apache Web Server--dirsrvinstalls the certificate on the Directory Server
For example, to install the SSL certificate into both:ipa-server-certinstall --http --dirsrv ssl.key ssl.crt
# ipa-server-certinstall --http --dirsrv ssl.key ssl.crtCopy to Clipboard Copied! Toggle word wrap Toggle overflow - Restart the server into which you installed the certificate.
- To restart the Apache Web Server:
systemctl restart httpd.service
# systemctl restart httpd.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow - To restart the Directory Server:
systemctl restart dirsrv@REALM.service
# systemctl restart dirsrv@REALM.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow
- To verify that the certificate has been correctly installed, make sure it is present in the certificate database.
- To display the Apache certificate database:
certutil -L -d /etc/httpd/alias
# certutil -L -d /etc/httpd/aliasCopy to Clipboard Copied! Toggle word wrap Toggle overflow - To display the Directory Server certificate database:
certutil -L -d /etc/dirsrv/slapd-REALM/
# certutil -L -d /etc/dirsrv/slapd-REALM/Copy to Clipboard Copied! Toggle word wrap Toggle overflow
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}