<div dir="ltr"><div>It's a little bit more clear. Thanks. </div><div>I have created a new ipa 4.1 replica but when I want run : # ipa-cacert-manage renew --self-signed </div><div>I've got this message : </div><div>[root@ipa-devel-centos7 ~]# ipa-cacert-manage renew --self-signed CA is not configured on this system </div><div>If I want to install the CA I've got this message : [root@ipa-devel-centos7 system]# ipa-ca-install --password=mypassorwd -U CA is already installed. </div><div>Should I have to promote the replica to a standalone master before installing the CA ? </div><div>Any hints will be appreciated... </div><div class="gmail_extra"> </div><div class="gmail_extra">James </div><div class="gmail_extra"><div class="gmail_quote">2015-04-08 7:27 GMT+02:00 Jan Cholasta <<a href="mailto:jcholast@redhat.com" target="_blank">jcholast@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Dne 7.4.2015 v 15:31 Martin Kosek napsal(a): <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> On 04/07/2015 02:08 PM, James James wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> I will try to give a better explanation : I have a CentOS 6.6 with ipa 3.0 named ipa-master. ipa-master has been installed with an external CA about 3 years ago and I will have to renew the certificate soon. I have created a test server (ipa-dev) with the same configuration (centos 6.6 and ipa 3.0) to test the renewal process. I want the new ipa-dev sever to be installed with an external CA. In the same time my external CA has changed and wants the emailAddress field in the certificate request 's subject. </blockquote> CSR during installation with external CA is produced by Dogtag, so you are constrained with the options and capabilities provided by ipa-server-install. Maybe it would be possible to modify the CSR and update the Subject manually, but I expect it would crash the installer later (JanC may know more (CCed)) </blockquote> The subject name identifies the CA in server (and other) certificates. If you change it, you break the trust chain from the CA certificate to the server certificates and that will break all SSL in IPA. <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> If it is not possible to add emailAddress in the subject, is it possible to migrate my ipa-master CA system from an external CA to a CA-less or self-signed CA ? </blockquote> It is, with ipa-cacert-manage - see links below. </blockquote> You can change your external CA to self-signed CA in IPA 4.1 or newer by running: # ipa-cacert-manage renew --self-signed You can't change external CA to CA-less.<div class=""><div class="h5"> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Thanks. 2015-04-07 13:48 GMT+02:00 Martin Kosek <<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> On 04/07/2015 01:44 PM, James James wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> ok. Is there a way to migrate from an external CA to a CA-less or a </blockquote> self-signed <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> CA ? </blockquote> Yes, you can use ipa-cacert-manage tool introduced in FreeIPA 4.1.0: <a href="https://www.freeipa.org/page/Howto/CA_Certificate_Renewal" target="_blank">https://www.freeipa.org/page/Howto/CA_Certificate_Renewal</a> <a href="https://www.freeipa.org/page/V4/CA_certificate_renewal" target="_blank">https://www.freeipa.org/page/V4/CA_certificate_renewal</a> (Although I am still not sure about your use case and if this would help you) <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> 2015-04-07 12:51 GMT+02:00 Martin Kosek <<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> On 04/03/2015 11:39 AM, James James wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Hello, I want to initialize a new replica with an external CA. My Certificate Authority wants a CSR with the field emailAddress in the subject like : /C=FR/O=TESTO/OU=TESTOU/CN=*.<a href="http://example.com/emailAddress=none@none.com" target="_blank">example.com/emailAddress=none@none.com</a> </blockquote> I am not a bit confused. Do you plan to have FreeIPA *without* a CA or with own CA signed by external CA? FreeIPA supports these kinds of setups right now: <a href="http://www.freeipa.org/page/PKI#Blending_in_PKI_infrastructure" target="_blank">http://www.freeipa.org/page/PKI#Blending_in_PKI_infrastructure</a> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> How can I do with the ipa-server-install command ? I have been trying </blockquote> for <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> few days but I still can't. Thanks for your help. </blockquote> CCing Honza who should know the definitive answer. However, FreeIPA was </blockquote></blockquote> not <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> very flexible in configuring special subjects for it's CA certificate </blockquote></blockquote> (i.e. <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> cn=Certificate Authority, ou=...) or hosts in case of CA-less setup. </blockquote> </blockquote> </blockquote> </blockquote> </blockquote> </div></div> -- Jan Cholasta </blockquote></div> </div></div>