<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Exchange Server">  <style></style> </head> <body> <font face="Calibri" size="2"><span style="font-size:11pt;"> <div>I am following the various Fedora guides for installing Freeipa with sync of users/passwords from AD server.</div> <div> </div> <div><a href="https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/managing-sync-agmt.html"><font color="#0563C1"><u>https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/managing-sync-agmt.html</u></font></a> </div> <div> </div> <div>Hoiwever the documentation says “Active Directory CA certificate needs to be imported into the FreeIPA database” my windows colleague at head office says:</div> <div style="padding-left:36pt;"><font color="#1F497D"> </font></div> <div style="padding-left:36pt;"><font color="#1F497D">There is no CA in XXXXXX domain, so I can’t provide any certificates to you from there.</font></div> <div style="padding-left:36pt;"><font color="#1F497D">This seems to be a LDAPS connection, and it will work if we use certificate that is trusted by both of the servers.</font></div> <div style="padding-left:36pt;"><font color="#1F497D"> </font></div> <div style="padding-left:36pt;"><font color="#1F497D">I can sign the server with our internal CA and provide this to you.</font></div> <div style="padding-left:36pt;"><font color="#1F497D">or</font></div> <div style="padding-left:36pt;"><font color="#1F497D">We can sign both servers with Vaisala CA, and use these certificates. </font></div> <div style="padding-left:36pt;"><font color="#1F497D">To use this setup, I’ll need a CSR from IPA</font></div> <div style="padding-left:36pt;"><font color="#1F497D"> </font></div> <div style="padding-left:36pt;"><font color="#1F497D">Also, you have to download and install our root and intermediate CA’s to IPA server, so it will trust certificates signed by those.</font></div> <div> </div> <div>Not being that familiar with certs and with FreeIPA I have got a bit stuck on what I should do in order to resolve this and get the FreeIPA up and syncronised to one of our AD servers, can anyone offer some suggestions please ? he has sent me the ROOT and Intermediate Certs for the domain server.</div> <div> </div> <div>Thanks </div> <div> </div> <div>Ian</div> <div> </div> </span></font> </body> </html>