<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 03/04/2015 04:32 PM, sipazzo wrote:<br>
</div>
<blockquote
cite="mid:1500209899.2950539.1425504749785.JavaMail.yahoo@mail.yahoo.com"
type="cite">
<div style="color:#000; background-color:#fff; font-family:bookman
old style, new york, times, serif;font-size:13px">
<div id="yui_3_16_0_1_1425499626880_29483" dir="ltr">Good
afternoon, we have a freeipa 3.0.42 installation running on
redhead 6.6 with a mix of rhel 5, rhel6 and Solaris clients.
It was originally configured with the built in dogtag
certificate CA and then one of my co-workers added our GoDaddy
certificate to the certificate bundle. My understanding is
this cert is used for communication between the ipa servers as
well as the clients are also configured to trust the GoDaddy
certificate. We recently had to get a new GoDaddy cert so our
old one is revoked. I need to figure out how to either replace
the existing revoked cert with the new one or add the new one
to the bundle and then remove the revoked certificate so as
not to break anything.</div>
<div id="yui_3_16_0_1_1425499626880_29483" dir="ltr"><br>
</div>
<div id="yui_3_16_0_1_1425499626880_29483" dir="ltr">Any help is
appreciated. I am not strong with certificates so the more
detail you can give the better.</div>
<div id="yui_3_16_0_1_1425499626880_29483" dir="ltr">Thank you.</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
You say it was running with the self signed IPA CA and than GoDaddy
cert was added to the bundle. How was it added?<br>
IPA does not use certs for communication between the instances. It
uses Kerberos. I am not sure the DoDaddy cert you added is even used
in some way by IPA.<br>
It seems that your GoDaddy cert is an orthogonal trust so if you
replaced the main key pair then you just need to distribute your new
GoDaddy cert to the clients as you did on the first place.<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>