32.2. Certificates internal to IdM

Your internal certificates can depend on how you installed IdM and what components were included in that installation. Depending on that installation, you might have the following certificates stored on your system.

IdM CA certificate

The IdM CA certificate is used by IdM to sign all other certificates. Note that it is not present in CA-less installations.

Expand

caSigningCert	Description
File system location	`nickname=caSigningCert cert-pki-ca` in `/etc/pki/pki-tomcat/alias` NSS database `nickname=REALM.NAME IPA CA` in `/etc/ipa/nssdb/` and `/etc/ipa/ca.crt` (populated from LDAP)
LDAP location	`cn=REALM.NAME IPA CA,cn=certificates,cn=ipa,cn=etc,dc=realm,dc=name and ou=authorities,ou=ca,o=ipaca`
Issuer	Self-signed or signed by an external CA
Subject	`O = REALM.NAME, CN = Certificate Authority` Note that this is the default value but it can be customized during the IdM server installation.
Additional information	Must have `CA:true` critical constraint and must have `CT,C,C` trust flags in the NSS database.

External CA certificate

If you are using an external CA, the chain of external CAs must be available in IdM to validate IdM certificates. For a CA-less installation, the external CA certificate must be present in various locations, including LDAP and in the /etc/ipa/ca.crt directory to validate HTTPD and LDAP certificates.

注意

You do not have to manually add the external CA certificate to all the required locations as it is done automatically during the installation. However, if the external CA certificate is updated later, you should follow the steps in Renewing the IdM CA renewal server certificate using an external CA to ensure the new certificate is added to every location where it is required.

Expand

External certificate	Description
File system location	`/etc/pki/pki-tomcat/alias nssdb` and as part of chain in `/etc/ipa/ca.crt` (populated from LDAP)
LDAP location	`cn=SUBJECT,cn=certificates,cn=ipa,cn=etc,dc=realm,dc=name and ou=authorities,ou=ca,o=ipaca`
Issuer	External CA-signed
Subject	External CA subject
Additional information	You must have all the certificates in the chain in DER format and you must import them into LDAP. Must have `CT,C,C` trust flags in the NSS database.

Subsystem CA certificate

This certificate is used to authenticate to the LDAP server when writing to the LDAP database. This certificate is not present in CA-less installations.

Expand

subsystemCert	Description
File system location	`nickname=subsystemCert cert-pki-ca` in `/etc/pki/pki-tomcat/alias nssdb`
LDAP location	`uid=pkidbuser,ou=people,o=ipaca`
Issuer	IPA CA
Subject	`CN=CA Subsystem,O=REALM.NAME`
Additional information	Be wary of a serial and blob mismatch in LDAP. For example, `2;SERIAL;CN=Certificate Authority,O=REALM.NAME;CN=CA Subsystem,O=REALM.NAME` and `userCertificate` must match the one on the file system.

Audit signing certificate

This certificate is used to sign the audit logs. Note that it is not present in CA-less installations.

Expand

auditSigningCert	Description
File system location	`nickname=auditSigningCert cert-pki-ca` in `/etc/pki/pki-tomcat/alias nssdb`
LDAP location	No dedicated LDAP location, shared via `ou=certificateRepository,ou=ca,o=ipaca`
Issuer	IPA CA
Subject	`CN=CA Audit,O=REALM.NAME`
Additional information	Must have `,,P` trust flags in the NSS database.

OCSP signing certificate

This certificate is used to provide Online Certificate Status Protocol (OCSP) services. Note that it is not present in CA-less installations.

Expand

ocspSigningCert	Description
File system location	`nickname=ocspSigningCert cert-pki-ca` in `/etc/pki/pki-tomcat/alias nssdb`
LDAP location	No dedicated LDAP location, shared via `ou=certificateRepository,ou=ca,o=ipaca`
Issuer	IPA CA
Subject	`CN=OCSP Subsystem,O=REALM.NAME`

Tomcat servlet certificate

This certificate is used when a client contacts the PKI. Note that this server certificate is specific to the host and it is not present in CA-less installations.

Expand

Server-Cert	Description
File system location	`Nickname=Server-Cert cert-pki-ca` in `/etc/pki/pki-tomcat/alias nssdb`
LDAP location
Issuer	IPA CA
Subject	CN=$HOSTNAME,O=REALM.NAME

Registration authority certificate

Certificate used by certmonger as well as by the IdM framework to authenticate to the PKI. For example, if you run ipa cert-show 1, HTTPD communicates with the PKI and authenticates with this certificate. Not present in CA-less installations.

Expand

RA agent	Description
File system location	`/var/lib/ipa/ra-agent.pem` (used to be in `/etc/httpd/alias` before RHEL 7.4)
LDAP location	`uid=ipara,ou=people,o=ipaca`
Issuer	IPA CA
Subject	`CN=IPA RA,O=REALM.NAME`
Additional information	Be wary of a serial and blob mismatch in LDAP. For example, `2;SERIAL;CN=Certificate Authority,O=REALM.NAME;CN=IPA RA,O=REALM.NAME` and `userCertificate` must match the one on the file system.

HTTPD front end certificate

Certificate used for the HTTPD frontend to secure connections to the Web UI and API. Must be present.

Expand

HTTPD	Description
File system location	`/var/lib/ipa/certs/httpd.crt` (used to be in `/etc/httpd/alias` before RHEL 8)
LDAP location
Issuer	IPA CA or external CA in CA-less installations
Subject	`CN=$HOSTNAME,O=REALM.NAME`
The extensions that the certificate must contain	`Certificate Subject Alt Name` extension with principal name as `otherName = 1.3.6.1.4.1.311.20.2.3;UTF8:HTTP/$HOSTNAME@REALM, DNS name = $HOSTNAME` `Authority Key Identifier` with a value containing the `Subject Key Identifier` of the certificate authority that issued the certificate `Key Usage extension` with the `Digital Signature`, `Key Encipherment` and `Data Encipherment` usages `Extended Key Usage` with the OID of 1.3.6.1.5.5.7.3.1, corresponding to `TLS Web Server Authentication Certificate`

LDAP TLS and STARTTLS certificate

Certificate used for LDAP TLS and STARTTLS connections. Must be present.

Expand

LDAP	Description
File system location	`nickname=Server-Cert` in `/etc/dirsrv/slapd-DOMAIN` NSS database (can be other nickname, matching `nsSSLPersonalitySSL` in `dse.ldif`)
LDAP location
Issuer	IPA CA or external CA in CA-less installations
Subject	`CN=$HOSTNAME,O=REALM.NAME`
The extensions that the certificate must contain	`Certificate Subject Alt Name` extension with principal name as `otherName = 1.3.6.1.4.1.311.20.2.3;UTF8:ldap/$HOSTNAME@REALM, DNS name = $HOSTNAME` `Authority Key Identifier` with a value containing the `Subject Key Identifier` of the certificate authority that issued the certificate `Key Usage extension` with the `Digital Signature`, `Key Encipherment` and `Data Encipherment` usages `Extended Key Usage` with the OID of 1.3.6.1.5.5.7.3.1, corresponding to `TLS Web Server Authentication Certificate`

KDC certificate

Certificate used for PKINIT for the IdM KDC.

Expand

KDC	Description
File system location	`/var/kerberos/krb5kdc/kdc.crt`
LDAP location
Issuer	IPA CA or external CA in CA-less installations
Subject	`CN=$HOSTNAME,O=REALM.NAME`
Additional information	Must have extended key usage `id-pkinit-KPkdc (1.3.6.1.5.2.3.5)`, principal name as `otherName = 1.3.6.1.4.1.311.20.2.3;UTF8:krbtgt/REALM@REALM, DNS name = $HOSTNAME`.

32.2. Certificates internal to IdM

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links