On to, 20 kesä 2019, lejeczek via FreeIPA-users wrote:
hi guys,
I'm starting to look more thoroughly into CA and something I'm not sure
is possible, and hoping you could shed more light onto, is - having IPA
deployed with own CA is it possible to then, at a later point,
move/migrate/change IPA to subordinate type of CA with AD's CA as root?
Is such a change a SOP or rather something undocumented-unsupported but
possible & risky?
It is possible and is a routine action.
[1]
https://frasertweedale.github.io/blog-redhat/posts/2018-11-20-ca-renewal-...
[2]
https://frasertweedale.github.io/blog-redhat/posts/2017-08-14-ad-cs.html
[3]
https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordi...
See also
https://pagure.io/freeipa/blob/master/f/ipatests/test_integration/test_ex...
-- these are our tests of this feature which run for every pull request.
Look at TestSelfExternalSelf suite, it should be more or less
self-explanatory.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland