<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body dir="auto">
<div>I wrote the following guide for sysadmins at my university in an attempt to coalesce in one place what I consider to be the good practices for X.509 certificate management using OpenSSL. I've included examples on how to load private keys, end-entity certificates
and intermediate certificates into alternate trust stores (PKCS for IIS and JKS for Java).</div>
<div id="AppleMailSignature"><br>
</div>
<div id="AppleMailSignature"><a href="https://confluence.id.ubc.ca:8443/display/ITSecurity/how+to+obtain%2C+deploy+and+verify+an+X.509+certificate">https://confluence.id.ubc.ca:8443/display/ITSecurity/how+to+obtain%2C+deploy+and+verify+an+X.509+certificate</a></div>
<div id="AppleMailSignature"><br>
</div>
<div id="AppleMailSignature">Let me know if you have suggestions for improvement.</div>
<div id="AppleMailSignature"><br>
--
<div>Luca Filipozzi, <span style="font-size: 13pt;">UBC IT Enterprise Architecture</span></div>
</div>
<div><br>
On Feb 2, 2016, at 15:43, Christopher Young <<a href="mailto:mexigabacho@gmail.com">mexigabacho@gmail.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div><span>I've been doing some reading and perhaps I'm confusing myself, but I</span><br>
<span>couldn't find any definitive guide on how to go about doing what I</span><br>
<span>think it a pretty simple thing.</span><br>
<span></span><br>
<span>My ipa-client installs appear to generate a new TLS/SSL/PKI cert for</span><br>
<span>each host when they are registered. I'd like to utilize that</span><br>
<span>certificate with Apache/tomcat/etc.. I'm aware of how to obtain the</span><br>
<span>certificate itself, however I'm not clear on how to obtain the private</span><br>
<span>key (in a format that I can use as well) that was used to generate the</span><br>
<span>certificate.</span><br>
<span></span><br>
<span>Would someone kindly point me in the right direction or ideally just</span><br>
<span>educate me on the command/options needed to do this. In particular,</span><br>
<span>I'm looking to create pem files for both the key and cert for use with</span><br>
<span>Apache, but it would be useful to understand how to do it for other</span><br>
<span>stores as well. (Hint: this would be great to just have in a document</span><br>
<span>that makes it clear). :)</span><br>
<span></span><br>
<span>Thanks again to the freeipa team. I love this product.</span><br>
<span></span><br>
<span>-- Chris</span><br>
<span></span><br>
<span>-- </span><br>
<span>Manage your subscription for the Freeipa-users mailing list:</span><br>
<span><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></span><br>
<span>Go to <a href="http://freeipa.org">http://freeipa.org</a> for more info on the project</span><br>
</div>
</blockquote>
</body>
</html>