5:41 a.m.
Hi,
I've deployed FreeIPA and now am trying to use ipa-getcert.
FreeIPA has been deployed with external CA, and the root CA cert has been deployed to all
servers.
FreeIPA is acting as an intermediate ssl authority.
So, when I run ipa-getcert request .... I generate ssl key (server.key) and receive vaild
ssl cert (server.cert).
However the certificate in not quite valid, since it's missing the intermediate
certificate in the server.cert bundle.
Is there a way (e.g. flag or a feature) to include intermediate.cert to server.cert?
Or better yet: how did you envision the whole PKI with FreeIPA as intermediate
certificate?
12:47 p.m.
Jo Domsic via FreeIPA-users wrote:
Hi,
I've deployed FreeIPA and now am trying to use ipa-getcert.
FreeIPA has been deployed with external CA, and the root CA cert has been deployed to all
servers.
FreeIPA is acting as an intermediate ssl authority.
So, when I run ipa-getcert request .... I generate ssl key (server.key) and receive vaild
ssl cert (server.cert).
However the certificate in not quite valid, since it's missing the intermediate
certificate in the server.cert bundle.
Is there a way (e.g. flag or a feature) to include intermediate.cert to server.cert?
Missing in what bundle?
There is a way, -R, but it is broken for this use case,
https://bugzilla.redhat.com/show_bug.cgi?id=1710632
Or better yet: how did you envision the whole PKI with FreeIPA as
intermediate certificate?
It should still work fine. The whole chain should be trusted system-wide.
rob
3:55 a.m.
Bundle = server.cert + intermediate-ipa.cert.
Currently, I figured to distribute rootCA to all clients, and each server
(e.g. nginx) has to serve a bundle (server.cert + intermediate).
The issue with my work flow is: when ipa-getcert generates a certificate,
it doesn't include intermediate-ipa.cert.
So, I have to manually parse */etc/ipa/ca.crt* for a intermediate and
include it in server.cert.
Am I making any sense?
On Thu, Jun 6, 2019 at 7:48 PM Rob Crittenden <rcritten(a)redhat.com> wrote:
Jo Domsic via FreeIPA-users wrote:
> Hi,
>
> I've deployed FreeIPA and now am trying to use ipa-getcert.
> FreeIPA has been deployed with external CA, and the root CA cert has
been deployed to all servers.
> FreeIPA is acting as an intermediate ssl authority.
>
> So, when I run ipa-getcert request .... I generate ssl key (server.key)
and receive vaild ssl cert (server.cert).
> However the certificate in not quite valid, since it's missing the
intermediate certificate in the server.cert bundle.
> Is there a way (e.g. flag or a feature) to include intermediate.cert to
server.cert?
Missing in what bundle?
There is a way, -R, but it is broken for this use case,
https://bugzilla.redhat.com/show_bug.cgi?id=1710632
> Or better yet: how did you envision the whole PKI with FreeIPA as
intermediate certificate?
It should still work fine. The whole chain should be trusted system-wide.
rob
10:06 a.m.
Josip Domšić via FreeIPA-users wrote:
Bundle = server.cert + intermediate-ipa.cert.
Currently, I figured to distribute rootCA to all clients, and each
server (e.g. nginx) has to serve a bundle (server.cert + intermediate).
The issue with my work flow is: when ipa-getcert generates a
certificate, it doesn't include intermediate-ipa.cert.
So, I have to manually parse */etc/ipa/ca.crt* for a intermediate and
include it in server.cert.
Am I making any sense?
I don't know why nginx requires this but what you could could try is
write a post-install script (-C) that executes when certmonger saves the
updated certificate that will add the intermediate certificate(s) as
required by nginix. You can pull the intermediates out of
/etc/ipa/ca.crt by excluding the root (issuer == subject).
rob
On Thu, Jun 6, 2019 at 7:48 PM Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com>> wrote:
Jo Domsic via FreeIPA-users wrote:
> Hi,
>
> I've deployed FreeIPA and now am trying to use ipa-getcert.
> FreeIPA has been deployed with external CA, and the root CA cert
has been deployed to all servers.
> FreeIPA is acting as an intermediate ssl authority.
>
> So, when I run ipa-getcert request .... I generate ssl key
(server.key) and receive vaild ssl cert (server.cert).
> However the certificate in not quite valid, since it's missing the
intermediate certificate in the server.cert bundle.
> Is there a way (e.g. flag or a feature) to include
intermediate.cert to server.cert?
Missing in what bundle?
There is a way, -R, but it is broken for this use case,
https://bugzilla.redhat.com/show_bug.cgi?id=1710632
> Or better yet: how did you envision the whole PKI with FreeIPA as
intermediate certificate?
It should still work fine. The whole chain should be trusted
system-wide.
rob
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
5:19 a.m.
HI Rob,
Thank, that's what I came up as well, but wanted to make sure there really
isn't a simpler way.
Regarding the nginx example. It's not really a nginx issue, it's how the
whole PKI works.
Let's say we have Root -> Intermediate -> Server cert chain.
Client trusts the root CA, and server sends server CA on each request.
If the client doesn't know about the intermediate (either by having it
saved in trust, or receiving it from client on each request) the chain is
invalid.
So to combat this issue, server should transmit 2 certificates on each
request (e.g. "bundle" them together).
On Fri, Jun 7, 2019 at 5:06 PM Rob Crittenden <rcritten(a)redhat.com> wrote:
Josip Domšić via FreeIPA-users wrote:
> Bundle = server.cert + intermediate-ipa.cert.
>
> Currently, I figured to distribute rootCA to all clients, and each
> server (e.g. nginx) has to serve a bundle (server.cert + intermediate).
> The issue with my work flow is: when ipa-getcert generates a
> certificate, it doesn't include intermediate-ipa.cert.
> So, I have to manually parse */etc/ipa/ca.crt* for a intermediate and
> include it in server.cert.
>
> Am I making any sense?
I don't know why nginx requires this but what you could could try is
write a post-install script (-C) that executes when certmonger saves the
updated certificate that will add the intermediate certificate(s) as
required by nginix. You can pull the intermediates out of
/etc/ipa/ca.crt by excluding the root (issuer == subject).
rob
>
>
> On Thu, Jun 6, 2019 at 7:48 PM Rob Crittenden <rcritten(a)redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
> Jo Domsic via FreeIPA-users wrote:
> > Hi,
> >
> > I've deployed FreeIPA and now am trying to use ipa-getcert.
> > FreeIPA has been deployed with external CA, and the root CA cert
> has been deployed to all servers.
> > FreeIPA is acting as an intermediate ssl authority.
> >
> > So, when I run ipa-getcert request .... I generate ssl key
> (server.key) and receive vaild ssl cert (server.cert).
> > However the certificate in not quite valid, since it's missing the
> intermediate certificate in the server.cert bundle.
> > Is there a way (e.g. flag or a feature) to include
> intermediate.cert to server.cert?
>
> Missing in what bundle?
>
> There is a way, -R, but it is broken for this use case,
> https://bugzilla.redhat.com/show_bug.cgi?id=1710632
>
> > Or better yet: how did you envision the whole PKI with FreeIPA as
> intermediate certificate?
>
> It should still work fine. The whole chain should be trusted
> system-wide.
>
> rob
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
1789
days inactive
1793
days old
freeipa-users@lists.fedorahosted.org
4 comments
3 participants
participants (3)
-
Jo Domsic -
Josip Domšić
-
Rob Crittenden