2:41 a.m.
Hi All,
We are trying to install externally signed certificate for WebUI / HTTPS service on our
RHEL IdM servers (primary and replica both).
As the first step, we are trying to install the CA certificate chain of the issuer of the
3rd party certificate to IPA using "ipa-cacert-manage install”
Step:1 ipa-cacert-manage install idm-app-pilot-file.pem
We have put the certificate issued by intermediate CA for the CSR generated at
"/var/lib/ipa/ca.csr" from "ipa-cacert-manage renew --external-ca".
command excepts the certificate as expected.
Step2: ipa-certupdate
We ran this command on both primary & replica and also the clients registered to the
Step3: ipa-cacert-manage renew --external-cert-file=idm-app-pilot-file.pem
--external-cert-file=ca_chain_cert.pem
In this step, we are running the "ipa-cacert-manage renew" command with renewed
CA certificate and the external CA certificate chain. "ca_chain_cert.pem" has
intermediate and root cert of the signing CA.
Step3 command fails:
[root@ldmserver01 certs]# ipa-cacert-manage renew
--external-cert-file=idm-app-pilot-file.pem --external-cert-file=ca_chain_cert.pem
Importing the renewed CA certificate, please wait
CA certificate CN=ABC Root CA,ST=California,OU=ABC_CA_Authority,O=ABCInc,L=PaloAlto,C=US
in idm-app-pilot-file.pem, ca_chain_cert.pem is not valid: not a CA certificate
The ipa-cacert-manage command failed.
We have validated our certs using openssl verify -trusted as pasted below:
[root@ldmserver01 certs]# openssl verify -trusted ca_chain_cert.pem
idm-app-pilot-file.pem
idm-app-pilot-file.pem: OK
Could someone please help us with what step we are doing it wrong.
What should be the content expected by IdM server for ca_chain_cert.pem in terms of the
order of root and intermediate section. We have even tried with ca_cert chain appending to
idm-app-pilot-file.pem, but no luck.
Thanks in advance.
Regards,
Saurabh Garg