Home / server / Questions / 480543
Accepted
Kendrick
Asked: 2013-02-20 20:29:51 +0800 CST

ipa root certificate signing

  • 772

I am trying to get my ipa certificate signed by openca and its getting rejected due to hostname.

The following hostnames were rejected because the system couldn't link them to your 
account, if they are valid please verify the domains against your account.
Rejected: Certificate Authority

does any one know how to either generate the certificates manually so all the information can be included or if there is some setting I am missing that is causing this error on the initial install of the ipa server.

host is centos 6.3 I have installed ipa-server with dns

certificate-authority

1 Answers

  1. Best Answer

    Currently, there are 3 types how FreeIPA can blend in a existent certificate environment:

    1. No blending - FreeIPA is simply installed with own PKI and self-signed CA certificate
    2. External CA - FreeIPA is installed with own PKI, but it's CA certificate is signed with external certificate authority. This requires the external CA to allow sub CAs, which is not so common. I think this is the root cause of your problem.
    3. CA-less installation - FreeIPA does not configure own CA, but uses signed host certificates from external CA. This should work in your case. This feature was introduced in FreeIPA 3.2.0.

    Thus, my advise would be to try CA-less installation with certs signed by openca.

    • 1