<html><head></head><body><div>On Wed, 2016-05-04 at 13:26 -0400, Rob Crittenden wrote:</div><blockquote type="cite"><pre>lejeczek wrote:
<blockquote type="cite">
hi users,
as one follows official docs and issues a certificate for a
service/host, one wonders what is the correct way to move such a
certificate to a host(which is domain member) ?
I understand certificates issued with:
$ ipa cert-request -add --principal
are stored in ldap backend, (yet I don't quite get the difference
between that tool and ipa-certget).
</blockquote>
The first uses the IPA command-line to get a cert directly. ipa-getcert
uses certmonger.
If you are getting a certificate for another host, particularly if that
host isn't an IPA client, then the first form is the way to go.
<blockquote type="cite">
How do I get such a certificate off the server and to a host-not-server?
</blockquote>
$ ipa cert-show <serial#> --out cert.pem
<blockquote type="cite">
In my case I'm hoping to use this certificate in apache+nss.
I realize I also will need CA certificate on that host, which I got hold
of with certutil operated on /etc/dirsrv/slapd-MY-DOMAIN - if it's the
right way?
</blockquote>
So in this case you'd want to generate the CSR on the host-not-server
using certutil. You'd take that CSR to the enrolled host and run ipa
cert-request ...
Get a copy of the cert and get that and /etc/ipa/ca.crt to the
</pre></blockquote><div>Is this the only place where IPA' CA cert resides?</div><div>I thought that that cert will be in /etc/dirsrv/slapd-MY-DOMAIN</div><div>$ certutil -d /etc/dirsrv/slapd-MY.. </div><div>gets me:</div><div><br></div><div>MY-DOMAIN IPA CA<span class="Apple-tab-span" style="white-space:pre"> </span>CT,C,C</div><div>Server-Cert<span class="Apple-tab-span" style="white-space:pre"> </span>u,u,u</div><div><br></div><div>what is that IPA CA then?</div><div>I also see the same with:</div><div>$ certutil -d /etc/httpd/alias -L</div><div>Is this the same one certificate? (including /etc/ipa/ca.crt)</div><div><br></div><div>I get these with: ipa-getcert list</div><div>I'm guessing these are set up by installer and to be managed by certmonger, for DS and web server for certificates auto management purposes?</div><div><br></div><div>many thanks.</div><div><br></div><blockquote type="cite"><pre>host-not-server.
Use certutil to add both to your NSS database.
rob
</pre></blockquote></body></html>