<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection">Cool. I'll give this a go in the morning.</div>
<div name="messageSignatureSection"><br />
Bret Wortman
<div>http://wrapbuddies.co/</div>
</div>
<div name="messageReplySection"><br />
On Jun 2, 2016, 6:24 PM -0400, Fraser Tweedale <ftweedal@redhat.com>, wrote:<br />
<blockquote type="cite">On Thu, Jun 02, 2016 at 05:35:01PM -0400, bret.wortman@damascusgrp.com wrote:<br />
<blockquote type="cite">Sorry, let me back up a step. We need to implement hype<br />
everywhere. All our web services. And clients need to get<br />
keys&certs automatically whether through IPA or Puppet. These<br />
systems use IPA for everything but authentication (to keep most<br />
users off). I'm trying to wuss out the easiest way to make this<br />
happen smoothly.<br />
<br /></blockquote>
Hi Bret,<br />
<br />
You can use the IPA CA to sign service certificates. See<br />
http://www.freeipa.org/page/Certmonger#Request_a_new_certificate.<br />
<br />
IPA-enrolled machines already have the IPA certificate in their<br />
trust store. If the clients are IPA-enrolled, everything should<br />
Just Work, otherwise you can distribute the IPA CA certificate to<br />
clients via Puppet** or whatever means you prefer.<br />
<br />
** you will have to work out how, because I do not know Puppet :)<br />
<br />
Cheers,<br />
Fraser<br />
<br />
<blockquote type="cite"><br />
<br />
On Jun 2, 2016, 5:31 PM -0400, Rob Crittenden<rcritten@redhat.com>, wrote:<br />
<blockquote type="cite">Bret Wortman wrote:<br />
<blockquote type="cite">Is it possible to use our freeipa CA as a trusted CA to sign our<br />
internal SSL certificates? Our system runs on a private network and so<br />
using the usual trusted sources isn't an option. We've been using<br />
self-signed, but that adds some additional complications and we thought<br />
this might be a good solution.<br />
<br />
Is it possible, and, since most online guides defer to "submit the CSR<br />
to Verisign" or whomever, how would you go about producing one in this way?<br /></blockquote>
<br />
Not sure I understand the question. The IPA CA is also self-signed. For<br />
enrolled systems though at least the CA is pre-distributed so maybe that<br />
will help.<br />
<br />
rob<br />
<br /></blockquote>
</blockquote>
<br />
<blockquote type="cite">--<br />
Manage your subscription for the Freeipa-users mailing list:<br />
https://www.redhat.com/mailman/listinfo/freeipa-users<br />
Go to http://freeipa.org for more info on the project<br /></blockquote>
<br /></blockquote>
</div>
</body>
</html>