FreeIPA capabilities added in recent 4.x releases that change authentication, certificate and DNS design: passkeys, ACME, HSM-backed CAs, LDAP OTP enforcement and encrypted DNS.
Moving Linux logins off passwords with FreeIPA: FIDO2 passkeys stored in IPA and verified by SSSD, smart cards, OTP tokens and external IdPs, SSSD version prerequisites, and the gaps the project lists such as host enrollment and Web UI login.
Issuing internal TLS certificates automatically from the FreeIPA CA with the Dogtag ACME service: enabling it per server, the ipa-ca ACME directory, Certbot and mod_md clients, challenge types, and how this replaces manual certificate requests.
Keeping FreeIPA CA and KRA private keys in an HSM: supported install cases for self-signed and externally signed CAs, replicas sharing HSM keys, the all-or-nothing rule, RSA-only keys, PKCS#11 libraries and the vendor SELinux packages.
Encrypting DNS between clients and IdM DNS servers with FreeIPA 4.13: install options for DoT, upstream DoT forwarders, certificates, strict versus fallback policy, and how this supports zero trust network designs.
Managing subordinate user and group ID ranges centrally in FreeIPA instead of per-host /etc/subuid files, so rootless Podman containers work across many hosts with consistent ranges.
Warning FreeIPA users by email before passwords expire: what the expiring password notification design covers, templates, notification days, and pairing it with password policy changes.
What random serial numbers (RSNv3) change in the FreeIPA CA: 128-bit serials, default on new 4.13 installs, why existing ranged deployments cannot simply switch, and expired certificate pruning.
Running FreeIPA servers that clients never discover, for backups, bulk operations or staged maintenance: what hidden means for DNS SRV records and server roles, certmonger and Kerberos discovery behavior, and when to use one.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.