Chapter 12. Managing externally-signed CA certificates Identity Management (IdM) provides different types of certificate authority (CA) configurations. You can chose to install IdM with an integrated CA or with an external CA. You must specify the type of CA you are using during the installation. However, once installed you can move from an externally-signed CA to a self-signed CA and vice versa. Additionally, while a self-signed CA is automatically renewed, you must ensure that you renew your externally-signed CA certificate. Refer to the relevant sections as required to manage your externally-signed CA certificates. Installing IdM with an externally-signed CA: Installing an IdM server with integrated DNS and with an external CA as the root CA. Installing an IdM server without integrated DNS and with an external CA as the root CA. Switching from an externally-signed CA to a self-signed CA. Switching from a self-signed CA to an externally-signed CA. Renewing the externally-signed CA certificate. 12.1. Switching from an externally-signed to a self-signed CA in IdM Complete this procedure to switch from an externally-signed to a self-signed certificate of the Identity Management (IdM) certificate authority (CA). With a self-signed CA, the renewal of the CA certificate is managed automatically: a system administrator does not need to submit a certificate signing request (CSR) to an external authority. Switching from an externally-signed to a self-signed CA replaces only the CA certificate. The certificates signed by the CA are still valid and still in use. For example, the certificate chain for the LDAP certificate remains unchanged even after you have moved to a self-signed CA: Prerequisites You have root access to the IdM CA renewal server and all IdM clients and servers. Procedure On the IdM CA renewal server, renew the CA certificate as self-signed: SSH to all the remaining IdM servers and clients as root . For example: On the IdM client, update the local IdM certificate databases with the certificates from the server: Verification To check if your update has been successful and the new CA certificate has been added to the /etc/ipa/ca.crt file: The output shows that the update has been successful as the new CA certificate is listed with the older CA certificates. 12.2. Switching from a self-signed to an externally-signed CA in IdM You can switch from a self-signed CA to an externally-signed CA in IdM. Once you switch to an externally-signed CA in IdM, your IdM CA server becomes a subCA of the external CA. Also, the renewal of the CA certificate is not managed automatically and a system administrator must submit a certificate signing request (CSR) to the external authority. To switch to an externally-signed CA, a CSR must be signed by the external CA. Follow the steps in Renewing the IdM CA renewal server certificate using an external CA to switch to a self-signed CA in IdM. 12.3. Renewing the IdM CA renewal server certificate using an external CA Follow this procedure to renew the Identity Management (IdM) certificate authority (CA) certificate using an external CA to sign the certificate signing request (CSR). In this configuration, your IdM CA server is a subCA of the external CA. The external CA can, but does not have to, be an Active Directory Certificate Server (AD CS). If the external certificate authority is AD CS, you can specify the template you want for the IdM CA certificate in the CSR. A certificate template defines the policies and rules that a CA uses when a certificate request is received. Certificate templates in AD correspond to certificate profiles in IdM. You can define a specific AD CS template by its Object Identifier (OID). OIDs are unique numeric values issued by various issuing authorities to uniquely identify data elements, syntaxes, and other parts of distributed applications. Alternatively, you can define a specific AD CS template by its name. For example, the name of the default profile used in a CSR submitted by an IdM CA to an AD CS is subCA . To define a profile by specifying its OID or name in the CSR, use the external-ca-profile option. For details, see the ipa-cacert-manage man page on your system. Apart from using a ready-made certificate template, you can also create a custom certificate template in the AD CS, and use it in the CSR. Prerequisites You have root access to the IdM CA renewal server. Procedure Complete this procedure to renew the certificate of the IdM CA with external signing, regardless of whether current CA certificate is self-signed or externally-signed. Create a CSR to be submitted to the external CA: If the external CA is an AD CS, use the --external-ca-type=ms-cs option. If you want a different template than the default subCA template, specify it using the --external-ca-profile option: If the external CA is not an AD CS: The output shows that a CSR has been created and is stored in the /var/lib/ipa/ca.csr file. Submit the CSR located in /var/lib/ipa/ca.csr to the external CA. The process differs depending on the service to be used as the external CA. Retrieve the issued certificate and the CA certificate chain for the issuing CA in a base 64-encoded blob, which is: A PEM file if the external CA is not an AD CS. A Base_64 certificate if the external CA is an AD CS. The process differs for every certificate service. Usually, a download link on a web page or in the notification email allows the administrator to download all the required certificates. If the external CA is an AD CS and you have submitted the CSR with a known template through the Microsoft Windows Certification Authority management window, the AD CS issues the certificate immediately and the Save Certificate dialog appears in the AD CS web interface, asking where to save the issued certificate. Run the ipa-cacert-manage renew command again, adding all the CA certificate files required to supply a full certificate chain. Specify as many files as you need, using the --external-cert-file option multiple times: On all the IdM servers and clients, update the local IdM certificate databases with the certificates from the server: Verification To check if your update has been successful and the new CA certificate has been added to the /etc/ipa/ca.crt file: The output shows that the update has been successful as the new CA certificate is listed with the older CA certificates.

Commands:
external_CA certificate > IdM CA certificate > LDAP certificate
ipa-cacert-manage renew --self-signed Renewing CA certificate, please wait CA certificate successfully renewed The ipa-cacert-manage command was successful
ssh root@idmclient01.idm.example.com
ipa-certupdate Systemwide CA database updated. Systemwide CA database updated. The ipa-certupdate command was successful
[idmclient01 ~]USD openssl crl2pkcs7 -nocrl -certfile /etc/ipa/ca.crt | openssl pkcs7 -print_certs -text -noout [...] Certificate: Data: Version: 3 (0x2) Serial Number: 39 (0x27) Signature Algorithm: sha256WithRSAEncryption Issuer: O=IDM.EXAMPLE.COM, CN=Certificate Authority Validity Not Before: Jul 1 16:32:45 2019 GMT Not After : Jul 1 16:32:45 2039 GMT Subject: O=IDM.EXAMPLE.COM, CN=Certificate Authority [...]
~]# ipa-cacert-manage renew --external-ca --external-ca-type=ms-cs [--external-ca-profile=PROFILE] Exporting CA certificate signing request, please wait The next step is to get /var/lib/ipa/ca.csr signed by your CA and re-run ipa-cacert-manage as: ipa-cacert-manage renew --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate The ipa-cacert-manage command was successful
~]# ipa-cacert-manage renew --external-ca Exporting CA certificate signing request, please wait The next step is to get /var/lib/ipa/ca.csr signed by your CA and re-run ipa-cacert-manage as: ipa-cacert-manage renew --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate The ipa-cacert-manage command was successful
~]# ipa-cacert-manage renew --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate_1 --external-cert-file=/path/to/external_ca_certificate_2
[client ~]USD ipa-certupdate Systemwide CA database updated. Systemwide CA database updated. The ipa-certupdate command was successful
[client ~]USD openssl crl2pkcs7 -nocrl -certfile /etc/ipa/ca.crt | openssl pkcs7 -print_certs -text -noout [...] Certificate: Data: Version: 3 (0x2) Serial Number: 39 (0x27) Signature Algorithm: sha256WithRSAEncryption Issuer: O=IDM.EXAMPLE.COM, CN=Certificate Authority Validity Not Before: Jul 1 16:32:45 2019 GMT Not After : Jul 1 16:32:45 2039 GMT Subject: O=IDM.EXAMPLE.COM, CN=Certificate Authority [...]