Installing FreeIPA with an externally signed CA
Chaining the FreeIPA CA to a corporate root or Microsoft AD Certificate Services: the two-step --external-ca install, ms-cs CSR type, delivering the certificate chain, and common failures.
FreeIPA certificate authority and PKI
Running the Dogtag certificate authority inside FreeIPA: install options, renewal, profiles, sub-CAs, service certificates, revocation and recovery from expired certificates.
Renewing an externally signed FreeIPA CA certificate
Renewing the FreeIPA CA certificate when an external CA signed it: why it cannot renew automatically, ipa-cacert-manage renew with a CSR, installing the new certificate, and running ipa-certupdate everywhere.
Running FreeIPA without a CA
Operating a CA-less FreeIPA deployment with third-party certificates: what you must supply for LDAP, HTTP and PKINIT, the self-signed restriction, and the renewal work you take on.
FreeIPA certificate profiles
Controlling what FreeIPA issues with certificate profiles: the default caIPAserviceCert profile, creating custom profiles such as S/MIME, validity and extension settings, and testing changes.
FreeIPA lightweight sub-CAs
Issuing VPN, Wi-Fi or device certificates from a FreeIPA sub-CA subordinate to the ipa CA, limiting what each sub-CA can sign, and disabling a sub-CA to invalidate a group of certificates.
FreeIPA CA ACLs for certificate issuance
Deciding who may get which certificate from FreeIPA with CA ACLs: profiles, principals and issuing CAs, the admin bypass permission, and reviewing ACLs during audits.
Issuing and renewing service certificates with certmonger
Getting TLS certificates for services from FreeIPA: generating CSRs on the service host, ipa cert-request, certmonger tracking and automatic renewal, and the Ansible ipacert module.
Recovering FreeIPA from expired certificates with ipa-cert-fix
What to do when expired certificates stop FreeIPA services: when ipa-cert-fix applies, backups first, shared certificates and the renewal master, and what it cannot fix.
Revoking FreeIPA certificates and certificate hold
Revoking certificates issued by FreeIPA: revocation reasons, certificate hold as the only reversible state, CRL publication, and processes for lost devices and departed staff.
Replacing FreeIPA web and LDAP certificates with third-party certificates
Serving the FreeIPA Web UI and LDAP with certificates from a public or corporate CA: adding the issuing CA with ipa-cacert-manage install, ipa-server-certinstall, and updating every machine.
