Hi Mike,

Did you have any joy with this?

I've been using my IPA PKI for our 802.1x infrastructure - which is working nicely for the enrolled Linux hosts.

I've been considering adding some Chrome OS into the mix, but before shelling out for some devices I've been trying to navigate both the manual and extension based install methods.

It looks like some additional Network management options including some certificate bits have been added into the Google admin console which I thought might yield a method for doing per-device certificates, and I've also been trying to make sense of if the extension based bits in https://support.google.com/chrome/a/answer/6080885?hl=en could be made to play nicely with Dogtag.

https://support.google.com/chrome/a/answer/6321820?hl=en Looks like a no-go due to wanting an AD infrastructure!

Anyway, would be interested to hear how you're getting along,

David

On 30 January 2018 at 20:49, Rob Crittenden via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:

Ian Pilcher wrote:
> On 01/30/2018 02:27 PM, Rob Crittenden wrote:
>> Not sure what you mean by arbitrary. You can definitely generate a CSR
>> using your favorite tool and pass that to ipa cert-request.
>
> By arbitrary I meant a CSR/certificate that doesn't correspond to a host
> (or user) that is managed by the FreeIPA server. In my situation, I
> would like to sign TLS certificates for several of my network switches,
> wireless access points, etc., none of which can be enrolled as IPA
> hosts.
>

I see. Well, technically a host/service/whatever doesn't need to be
enrolled to get a cert it just needs a presence within IPA. Basically a
bucket into which to drop the cert for tracking.

So you can do this:

$ ipa host-add router.example.com
$ openssl ...
$ ipa cert-request host/router.example.com ...

I realize even this can seem a bit overbearing when you just want a cert
but given that IPA tries to be the central authority on things it made
sense to make it know about all issued certs as well.

That and my fear that if the requirement was relaxed an intruder,
disgruntled admin, whatever who got IPA admin rights could really do
some nasty things (e.g. add a DNS record for yourbank.com, get a valid,
trusted cert for it, etc).

rob

_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org