freeipa

Clone
Source Code
GIT

#3494 [RFE] Drop --selfsign server functionality
Closed: Fixed None Opened 11 years ago by mkosek.

Closed: Fixed
Reopen Issue

In a future, we would like to support 2 flavors of certificate management in IPA:

  • IPA with pki-ca (dogtag) with either a self-signed certificate or with a certificate signed by external CA (--external-ca option)
  • IPA with no pki-ca installed with certificates signed and provided by an external CA:
    • Uses options like --dirsrv_pkcs12 or --http_pkcs12

Installation with --selfsign (selfsigned certificate managed in local NSS database on server) is rather troublesome and not even supported - it should be dropped.

Related ticket: #3363 (fixing --http_pkcs12 & friends). We should fix both at the same time.

Related ticket: #3360. We should make sure we cover it as well.

This also involves:

  • converting self-sign masters to CA-less on upgrade
  • documenting how to manually issue self-signed certificates (for new replicas and rotation of expired certs)

I've opened ticket https://fedorahosted.org/freeipa/ticket/3534 for removing the --selfsign option, making it impossible to install new selfsign masters. This one will track the converting and removal of functionality.

master:[[br]]
e736e75[[br]]
006ab23[[br]]
4e3c105[[br]]

Metadata Update from @mkosek:
- Issue assigned to pviktori
- Issue set to the milestone: FreeIPA 3.2 - 2013/04 (Beta)
7 years ago

Login to comment on this ticket.

Metadata
None
None
None
low
None
None
None
None
enhancement
None
None
Certificate management
None
1
None
None
None
None
0
None
FreeIPA selfsign feature was dropped in favor of CA-less installation, i.e. an an installation where user provides own certificates used in FreeIPA core services.
http://freeipa.org/page/V3/Drop_selfsign_functionality
Powered by Pagure 5.13.3
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.