Chapter 2. Managing certificates for users, hosts, and services using the integrated IdM CA To learn more about how to manage certificates in Identity Management (IdM) using the integrated CA, the ipa CA, and its sub-CAs, see the following sections: Requesting new certificates for a user, host, or service using the IdM Web UI . Requesting new certificates for a user, host, or service from the IdM CA using the IdM CLI: Requesting new certificates for a user, host, or service from IdM CA using certutil For a specific example of requesting a new user certificate from the IdM CA using the certutil utility and exporting it to an IdM client, see Requesting a new user certificate and exporting it to the client . Requesting new certificates for a user, host, or service from IdM CA using openssl You can also request new certificates for a service from the IdM CA using the certmonger utility. For more information, see Requesting new certificates for a service from IdM CA using certmonger . Prerequisites Your IdM deployment contains an integrated CA: For information about how to plan your CA services in IdM, see Planning your CA services . For information about how to install an IdM server with integrated DNS and integrated CA as the root CA, see Installing an IdM server: With integrated DNS, with an integrated CA as the root CA For information about how to install an IdM server with integrated DNS and an external CA as the root CA, see Installing an IdM server: With integrated DNS, with an external CA as the root CA For information about how to install an IdM server without integrated DNS and with an integrated CA as the root CA, see Installing an IdM server: Without integrated DNS, with an integrated CA as the root CA . Optional: Your IdM deployment supports users authenticating with a certificate: For information about how to configure your IdM deployment to support user authentication with a certificate stored in the IdM client filesystem, see Configuring authentication with a certificate stored on the desktop of an IdM client . For information about how to configure your IdM deployment to support user authentication with a certificate stored on a smart card inserted into an IdM client, see Configuring Identity Management for smart card authentication . For information about how to configure your IdM deployment to support user authentication with smart cards issued by an Active Directory certificate system, see Configuring certificates issued by ADCS for smart card authentication in IdM . 2.1. Requesting new certificates for a user, host, or service using IdM Web UI Follow this procedure to use the Identity Management (IdM) Web UI to request a new certificate for any IdM entity from the integrated IdM certificate authorities (CAs): the ipa CA or any of its sub-CAs. IdM entities include: Users Hosts Services Important Services typically run on dedicated service nodes on which the private keys are stored. Copying a service's private key to the IdM server is considered insecure. Therefore, when requesting a certificate for a service, create the certificate signing request (CSR) on the service node. Prerequisites Your IdM deployment contains an integrated CA. You are logged into the IdM Web UI as the IdM administrator. Procedure Under the Identity tab, select the Users , Hosts , or Services subtab. Click the name of the user, host, or service to open its configuration page. Figure 2.1. List of Hosts Click Actions New Certificate . Optional: Select the issuing CA and profile ID. Follow the instructions for using the certutil command-line (CLI) utility on the screen. Click Issue . 2.2. Requesting new certificates for a user, host, or service from IdM CA using certutil You can use the certutil utility to request a certificate for an Identity Management (IdM) user, host or service in standard IdM situations. To ensure that a host or service Kerberos alias can use a certificate, use the openssl utility to request a certificate instead. Follow this procedure to request a certificate for an IdM user, host, or service from ipa , the IdM certificate authority (CA), using certutil . Important Services typically run on dedicated service nodes on which the private keys are stored. Copying a service's private key to the IdM server is considered insecure. Therefore, when requesting a certificate for a service, create the certificate signing request (CSR) on the service node. Prerequisites Your IdM deployment contains an integrated CA. You are logged into the IdM command-line interface (CLI) as the IdM administrator. Procedure Create a temporary directory for the certificate database: Create a new temporary certificate database, for example: Create the CSR and redirect the output to a file. For example, to create a CSR for a 4096 bit certificate and to set the subject to CN=server.example.com,O=EXAMPLE.COM : Submit the certificate request file to the CA running on the IdM server. Specify the Kerberos principal to associate with the newly-issued certificate: The ipa cert-request command in IdM uses the following defaults: The caIPAserviceCert certificate profile To select a custom profile, use the --profile-id option. The integrated IdM root CA, ipa To select a sub-CA, use the --ca option. Additional resources See the output of the ipa cert-request --help command. See Creating and managing certificate profiles in Identity Management . 2.3. Requesting new certificates for a user, host, or service from IdM CA using openssl You can use the openssl utility to request a certificate for an Identity Management (IdM) host or service if you want to ensure that the Kerberos alias of the host or service can use the certificate. In standard situations, consider requesting a new certificate using the certutil utility instead. Follow this procedure to request a certificate for an IdM host, or service from ipa , the IdM certificate authority, using openssl . Important Services typically run on dedicated service nodes on which the private keys are stored. Copying a service's private key to the IdM server is considered insecure. Therefore, when requesting a certificate for a service, create the certificate signing request (CSR) on the service node. Prerequisites Your IdM deployment contains an integrated CA. You are logged into the IdM command-line interface (CLI) as the IdM administrator. Procedure Create one or more aliases for your Kerberos principal test/server.example.com . For example, test1/server.example.com and test2/server.example.com . In the CSR, add a subjectAltName for dnsName ( server.example.com ) and otherName ( test2/server.example.com ). To do this, configure the openssl.conf file to include the following line specifying the UPN otherName and subjectAltName: Create a certificate request using openssl : Submit the certificate request file to the CA running on the IdM server. Specify the Kerberos principal to associate with the newly-issued certificate: The ipa cert-request command in IdM uses the following defaults: The caIPAserviceCert certificate profile To select a custom profile, use the --profile-id option. The integrated IdM root CA, ipa To select a sub-CA, use the --ca option. Additional resources See the output of the ipa cert-request --help command. See Creating and managing certificate profiles in Identity Management . 2.4. Additional resources See Revoking certificates with the integrated IdM CAs . See Restoring certificates with the integrated IdM CAs . See Restricting an application to trust only a subset of certificates .

Commands:
mkdir ~/certdb/
certutil -N -d ~/certdb/
certutil -R -d ~/certdb/ -a -g 4096 -s " CN=server.example.com,O=EXAMPLE.COM " -8 server.example.com > certificate_request.csr
ipa cert-request certificate_request.csr --principal= host/server.example.com
otherName= 1.3.6.1.4.1.311.20.2.3 ;UTF8: test2/server.example.com@EXAMPLE.COM DNS.1 = server.example.com
openssl req -new -newkey rsa: 2048 -keyout test2service.key -sha256 -nodes -out certificate_request.csr -config openssl.conf
ipa cert-request certificate_request.csr --principal= host/server.example.com