On to, 20 kesä 2019, lejeczek via FreeIPA-users wrote:
hi guys,
I'm starting to look more thoroughly into CA and something I'm not sure
is possible, and hoping you could shed more light onto, is - having IPA
deployed with own CA is it possible to then, at a later point,
move/migrate/change IPA to subordinate type of CA with AD's CA as root?
Is such a change a SOP or rather something undocumented-unsupported but
possible & risky?
It is possible and is a routine action.
[1]
https://frasertweedale.github.io/blog-redhat/posts/2018-11-20-ca-renewal-master.html
[2] https://frasertweedale.github.io/blog-redhat/posts/2017-08-14-ad-cs.html
[3]
https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordinate-ca.html
See also
https://pagure.io/freeipa/blob/master/f/ipatests/test_integration/test_external_ca.py
-- these are our tests of this feature which run for every pull request.
Look at TestSelfExternalSelf suite, it should be more or less
self-explanatory.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
