<div dir="ltr">ok. Is there a way to migrate from an external CA to a CA-less or a self-signed CA ? </div><div class="gmail_extra"> <div class="gmail_quote">2015-04-07 12:51 GMT+02:00 Martin Kosek <<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 04/03/2015 11:39 AM, James James wrote: > Hello, > > I want to initialize a new replica with an external CA. My Certificate > Authority wants a CSR with the field emailAddress in the subject like : > > /C=FR/O=TESTO/OU=TESTOU/CN=*.<a href="http://example.com/emailAddress=none@none.com" target="_blank">example.com/emailAddress=none@none.com</a> I am not a bit confused. Do you plan to have FreeIPA *without* a CA or with own CA signed by external CA? FreeIPA supports these kinds of setups right now: <a href="http://www.freeipa.org/page/PKI#Blending_in_PKI_infrastructure" target="_blank">http://www.freeipa.org/page/PKI#Blending_in_PKI_infrastructure</a> > How can I do with the ipa-server-install command ? I have been trying for > few days but I still can't. > > Thanks for your help. CCing Honza who should know the definitive answer. However, FreeIPA was not very flexible in configuring special subjects for it's CA certificate (i.e. cn=Certificate Authority, ou=...) or hosts in case of CA-less setup. </blockquote></div> </div>