[Freeipa-users] Moving from ca to ca-less without pki

[David Kupka]

On 29/07/16 15:35, Andreas Ladanyi wrote:
> Hi,
>
> is it simply possible to move from ca to a ca-less environment in ipa ?
> Because its ok for me to only use certificates in web and ldap
> components. I use freeipa 4.2 , fedora 23.
>
> regards,
> Andreas
>

Hello Andreas!

There is no tool that would do this for you, yet. You can manually 
remove CS entries from LDAP, remove CS instance, stop tracking 
certificates in certmonger and replace certificates for apache and 
dirsrv. But be very cautious any mistake may destroy the whole freeipa 
server and all data stored there.

ipa-cacert-manage does the opposite (installing CS on CA-less freeipa 
server). Feel free to file an RFE https://fedorahosted.org/freeipa/newticket

-- 
David Kupka