Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Documentation Request for setup with existing Certificate Authority #645

Open
gezegituser1 opened this issue Dec 16, 2024 · 6 comments · May be fixed by #647
Open

Documentation Request for setup with existing Certificate Authority #645

gezegituser1 opened this issue Dec 16, 2024 · 6 comments · May be fixed by #647

Comments

@gezegituser1
Copy link

Good afternoon,

I noticed there seems to be a lack of in-depth documentation with this container set up and how it interacts with an existing certificate authority on initial setup. I found very little information on this tops, but what little I was able to find simply states that the setup is a two-step process. Once you run the initial startup by passing the --external-ca flag it states to do it once again and this time to pass the --external-cert-file flag. However, this does not yield successful results. In fact, I found it was easier to run the installation with no CA related paramters and add them to the setup later, which at this time, (with the lack of documentation in this project's current state) should be the default advice. Could you please provide this information as it would help many enterprise users. Thank you.

@abbra
Copy link
Contributor

abbra commented Dec 16, 2024

@adelton
Copy link
Collaborator

adelton commented Dec 16, 2024

However, this does not yield successful results.

Interesting, it yields expected results in our CI, for years. For an example see today's workflow run: https://github.com/freeipa/freeipa-container/actions/runs/12346008632/job/34451034113. You might want to describe in more detail what exactly you do, what exactly you get, and where your expectations start to diverge from reality.

Besides the links that @abbra has provided, you are of course free to follow the installation without the CA per https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/installing_identity_management/installing-an-ipa-server-without-a-ca_installing-identity-management#installing-an-ipa-server-without-a-ca_installing-identity-management but you will have to provide the needed certificates manually. Our note about --external-ca is really just to help users with the differences that the containerized setup brings for that use-case.

@gezegituser1
Copy link
Author

Thanks for the quick response.
I don't mean to offend. I just didn't realize your documention is kept in other locations. My mistake.

@abbra
Copy link
Contributor

abbra commented Dec 16, 2024

Yes, this is all stated on https://www.freeipa.org/page/Documentation.html

@cob-web-corner
Copy link

@gezegituser1
https://www.freeipa.org/page/Certificate_Authority#use-a-different-ca-to-sign-the-ipa-ca-certificate

ipa-server-install --external_cert_file=/root/ipa.crt --external_ca_file=/root/existing_ca.crt

@adelton adelton linked a pull request Dec 27, 2024 that will close this issue
@adelton
Copy link
Collaborator

adelton commented Dec 27, 2024

Please check https://github.com/freeipa/freeipa-container/pull/647/files to see of this pointer to the FreeIPA Documentation page would be sufficient.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants