Chapter 64. Managing externally signed certificates for IdM users, hosts, and services This chapter describes how to use the Identity Management (IdM) command-line interface (CLI) and the IdM Web UI to add or remove user, host, or service certificates that were issued by an external certificate authority (CA). 64.1. Adding a certificate issued by an external CA to an IdM user, host, or service by using the IdM CLI As an Identity Management (IdM) administrator, you can add an externally signed certificate to the account of an IdM user, host, or service by using the Identity Management (IdM) CLI. Prerequisites You have obtained the ticket-granting ticket of an administrative user. Procedure To add a certificate to an IdM user, enter: The command requires you to specify the following information: The name of the user The Base64-encoded DER certificate Note Instead of copying and pasting the certificate contents into the command line, you can convert the certificate to the DER format and then re-encode it to Base64. For example, to add the user_cert.pem certificate to user , enter: You can run the ipa user-add-cert command interactively by executing it without adding any options. To add a certificate to an IdM host, enter: ipa host-add-cert To add a certificate to an IdM service, enter: ipa service-add-cert Additional resources Managing certificates for users, hosts, and services using the integrated IdM CA 64.2. Adding a certificate issued by an external CA to an IdM user, host, or service by using the IdM Web UI As an Identity Management (IdM) administrator, you can add an externally signed certificate to the account of an IdM user, host, or service by using the Identity Management (IdM) Web UI. Prerequisites You are logged in to the Identity Management (IdM) Web UI as an administrative user. Procedure Open the Identity tab, and select the Users , Hosts , or Services subtab. Click the name of the user, host, or service to open its configuration page. Click Add to the Certificates entry. Figure 64.1. Adding a certificate to a user account Paste the certificate in Base64 or PEM encoded format into the text field, and click Add . Click Save to store the changes. 64.3. Removing a certificate issued by an external CA from an IdM user, host, or service account by using the IdM CLI As an Identity Management (IdM) administrator, you can remove an externally signed certificate from the account of an IdM user, host, or service by using the Identity Management (IdM) CLI . Prerequisites You have obtained the ticket-granting ticket of an administrative user. Procedure To remove a certificate from an IdM user, enter: The command requires you to specify the following information: The name of the user The Base64-encoded DER certificate Note Instead of copying and pasting the certificate contents into the command line, you can convert the certificate to the DER format and then re-encode it to Base64. For example, to remove the user_cert.pem certificate from user , enter: You can run the ipa user-remove-cert command interactively by executing it without adding any options. To remove a certificate from an IdM host, enter: ipa host-remove-cert To remove a certificate from an IdM service, enter: ipa service-remove-cert Additional resources Managing certificates for users, hosts, and services using the integrated IdM CA 64.4. Removing a certificate issued by an external CA from an IdM user, host, or service account by using the IdM Web UI As an Identity Management (IdM) administrator, you can remove an externally signed certificate from the account of an IdM user, host, or service by using the Identity Management (IdM) Web UI. Prerequisites You are logged in to the Identity Management (IdM) Web UI as an administrative user. Procedure Open the Identity tab, and select the Users , Hosts , or Services subtab. Click the name of the user, host, or service to open its configuration page. Click the Actions to the certificate to delete, and select Delete . Click Save to store the changes. 64.5. Additional resources Ensuring the presence of an externally signed certificate in an IdM service entry using an Ansible playbook

Commands:
ipa user-add-cert user --certificate= MIQTPrajQAwg
ipa user-add-cert user --certificate="USD(openssl x509 -outform der -in user_cert.pem | base64 -w 0)"
ipa user-remove-cert user --certificate= MIQTPrajQAwg
ipa user-remove-cert user --certificate="USD(openssl x509 -outform der -in user_cert.pem | base64 -w 0)"