3.3. Requesting new certificates for a user, host, or service from IdM CA using openssl

Procedure

1. Create one or more aliases for your Kerberos principal test/server.example.com. For example, test1/server.example.com and test2/server.example.com.

2. In the CSR, add a subjectAltName for dnsName (server.example.com) and otherName (test2/server.example.com). To do this, configure the openssl.conf file to include the following line specifying the UPN otherName and subjectAltName:

   otherName=1.3.6.1.4.1.311.20.2.3;UTF8:test2/server.example.com@EXAMPLE.COM
   DNS.1 = server.example.com

3. Create a certificate request using openssl:

   openssl req -new -newkey rsa:2048 -keyout test2service.key -sha256 -nodes -out certificate_request.csr -config openssl.conf

4. Submit the certificate request file to the CA running on the IdM server. Specify the Kerberos principal to associate with the newly-issued certificate:

   # ipa cert-request certificate_request.csr --principal=host/server.example.com

   The ipa cert-request command in IdM uses the following defaults:

   • The caIPAserviceCert certificate profile

     To select a custom profile, use the --profile-id option.

   • The integrated IdM root CA, ipa

     To select a sub-CA, use the --ca option.