[Freeipa-users] Re: 'ipa-ca' DNS record - where used?

On Mon, 02 Sep 2019, Dmitry Perets via FreeIPA-users wrote:

...

Certificates are issued from IPA CA with the OCSP responder URI http://ipa-ca.$DOMAIN/ca/ocsp and CRL distribution point http://ipa-ca.$DOMAIN/ipa/crl/MasterCRL.bin (these are set in the certificate extensions).

flo

Thanks! Does it have to be an IPA server with CA? What if it doesn't have CA component - will it forward the request to one of the IPA servers with CA?

It has to be CA component server. That's why we have ipa-ca -- it is an entry that is managed to have only IP addresses of CA servers. Technically, something else could front it but there are other issues with this approach.

In past we tried to use CNAME to point to CA master but it didn't work for HTTP end-points.