MachinePrivateCertWithEL7 - Revision history

STEPHANE GERARD stgerard@vub.ac.be: /* How to retrieve the cert and the key */

2017-03-01T12:34:11Z

How to retrieve the cert and the key

← Older revision		Revision as of 12:34, 1 March 2017
Line 7:		Line 7:
	Don't forget to add the '--request-cert' option in the 'ipa-client-install' command, otherwise certificate won't be generated.		Don't forget to add the '--request-cert' option in the 'ipa-client-install' command, otherwise certificate won't be generated.

	== How to retrieve the cert and the ~~key~~ ==		== How to retrieve the CA cert, the hostcert and the hostkey ==
			* To get the CA cert :
			<pre>
			certutil -L -d /etc/ipa/nssdb -a -n 'WN.IIHE.AC.BE IPA CA' > ca.pem
			</pre>
	* To get the hostcert :		* To get the hostcert :
	<pre>		<pre>

STEPHANE GERARD stgerard@vub.ac.be: /* How to retrieve the cert and the key */

2017-03-01T12:28:53Z

How to retrieve the cert and the key

← Older revision		Revision as of 12:28, 1 March 2017
Line 8:		Line 8:

	== How to retrieve the cert and the key ==		== How to retrieve the cert and the key ==
	* To ~~retrieve~~ the hostcert :		* To get the hostcert :
	<pre>		<pre>
	certutil -L -d /etc/ipa/nssdb/ -a -n 'Local IPA host'		certutil -L -d /etc/ipa/nssdb/ -a -n 'Local IPA host' > hostcert.pem
			</pre>
			* To get the private key :
			<pre>
			pk12util -o keys.p12 -n 'Local IPA host' -d /etc/ipa/nssdb -W '' -k /etc/ipa/nssdb/pwdfile.txt
			openssl pkcs12 -in keys.p12 -out hostkey.pem -nodes -password pass:''
	</pre>		</pre>

STEPHANE GERARD stgerard@vub.ac.be at 12:26, 1 March 2017

2017-03-01T12:26:16Z

@@ Line 1: / Line 1: @@
 == What has changed with EL7 ==
 With EL7 comes the new ipa client tools release 4, that brings the following changes :
 * the path of nssdb is /etc/ipa/nssdb (and not /etc/pki/nssdb);
-* unless explicitly asked for, the certificate generation and installation is not done anymore
+* unless explicitly asked for, the certificate generation and installation is not done anymore.

STEPHANE GERARD stgerard@vub.ac.be: Created page with "== What do I mean by "machine private certificate" ? == == Why would I still need a machine certificate ? == == What has changed with EL7 == With EL7 comes the new ipa client..."

2017-03-01T11:12:54Z

Created page with "== What do I mean by "machine private certificate" ? == == Why would I still need a machine certificate ? == == What has changed with EL7 == With EL7 comes the new ipa client..."

New page

== What do I mean by "machine private certificate" ? ==
== Why would I still need a machine certificate ? ==

== What has changed with EL7 ==
With EL7 comes the new ipa client tools release 4, that brings the following changes :
* the path of nssdb is /etc/ipa/nssdb (and not /etc/pki/nssdb);
* unless explicitly asked for, the certificate generation and installation is not done anymore