On 20/06/2019 14:38, Alexander Bokovoy wrote:
On to, 20 kesä 2019, lejeczek via FreeIPA-users wrote:
> hi guys,
>
> I'm starting to look more thoroughly into CA and something I'm not sure
> is possible, and hoping you could shed more light onto, is - having IPA
> deployed with own CA is it possible to then, at a later point,
> move/migrate/change IPA to subordinate type of CA with AD's CA as root?
>
> Is such a change a SOP or rather something undocumented-unsupported but
> possible & risky?
It is possible and is a routine action.
[1]
https://frasertweedale.github.io/blog-redhat/posts/2018-11-20-ca-renewal-...
[2]
https://frasertweedale.github.io/blog-redhat/posts/2017-08-14-ad-cs.html
[3]
https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordi...
See also
https://pagure.io/freeipa/blob/master/f/ipatests/test_integration/test_ex...
-- these are our tests of this feature which run for every pull request.
Look at TestSelfExternalSelf suite, it should be more or less
self-explanatory.
okey, great, that should help, many! thanks.
I've just thumbed through it - either I missed it or it's not there, to
clearly get the process, as I mentioned earlier, of move/migrate/change
IPA's CA/PKI to Win AD.
Does IPA CA has to be removed, demoted first or clean setup without CA
is required in order to tap into AD's?