29.3. Configuring client and replica systems to use DoT exclusively

Procedure

1. Copy the IdM server’s DoT certificate to the client and replica system.

   $ scp /etc/pki/tls/certs/bind_dot.crt <username>@<ip>:/etc/pki/ca-trust/source/anchors/

2. Update the system-wide trust store configuration:

   # update-ca-trust extract

3. On the client and replica system, install the dnsconfd package:

   # dnf install dnsconfd

4. Generate the default configuration files for DoT on your system:

   dnsconfd config install

5. Enable the dnsconfd service:

   # systemctl enable --now dnsconfd

6. Reload NetworkManager to apply the configuration:

   # nmcli g reload

7. Configure the system’s DNS settings in NetworkManager.

   # nmcli device modify <device_name> ipv4.dns dns+tls://<idm_server_ip>
   
   Connection successfully reapplied to device '<device_name>'.