MachinePrivateCertWithEL7

From T2B Wiki
Jump to navigation Jump to search

What has changed with EL7

With EL7 comes the new ipa client tools release 4, that brings the following changes :

  • the path of nssdb is /etc/ipa/nssdb (and not /etc/pki/nssdb);
  • unless explicitly asked for, the certificate generation and installation is not done anymore.

Enrollment

Don't forget to add the '--request-cert' option in the 'ipa-client-install' command, otherwise certificate won't be generated.

How to retrieve the cert and the key

  • To retrieve the hostcert :
certutil -L -d /etc/ipa/nssdb/ -a -n 'Local IPA host'
Retrieved from ‘https://t2bwiki.iihe.ac.be/index.php?title=MachinePrivateCertWithEL7&oldid=805’