[Freeipa-users] Install IPA Servers with third-party certificate(external CA)

[beeth beeth]

I am trying to set up IPA servers with Verisign certificate, so that the
Admin Web console can use public signed certificate to meet company's
security requirement. But when I try to follow Red Hat's instructions at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-external-ca,

2.3.5. Installing a Server with an External CA as the Root CA,
at the first step it says to generate CSR by adding the --external-ca
option to the ipa-server-install utility, which does generate a CRS at
/root/ipa.csr. However, the ipa-server-install command in fact doesn't ask
for Distinguished Name (DN) or the organization info(like country, state,
etc.), which are required in the CSR. Without a valid CSR file, I can't
request for new Verisign certs. Did I miss something?

Originally I once tried to change the default certificate for Apache(the
Web Admin console) ONLY to the Verisign one, by adding the certificates to
the /etc/httpd/alias database with the command:
  # ipa-server-certinstall -w --http_pin=test verisign.pk12
And updated the nss.conf for httpd, so that the new Nickname is used to
point to the Verisign certs. That worked well for the website. However, the
IPA client installation failed after that for the "ipa-client-install":

ERROR Joining realm failed: libcurl failed to execute the HTTP POST
transaction, explaining:  Peer's certificate issuer has been marked as not
trusted by the user.

Even I tried to also update the certificate for the Directory
service(ipa-server-certinstall -d ... ), the client installation still
failed. I believe the new Verisign cert messed up the communication of the
IPA components. Then I am thinking to install the IPA server from scratch
with the Verisign cert, but then I hit the CSR problem described above.

Please advise. Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20160929/5f057fde/attachment.htm>