Rob Crittenden
beaa0562dc
Dogtag has implemented a new random serial number scheme they are calling RSNv3. https://github.com/dogtagpki/pki/wiki/Random-Certificate-Serial-Numbers-v3 Given the known issues reported this will be supported in IPA for new installations only. There is no mixing of random servers and non-random servers allowed. Instructions for installing a CA: https://github.com/dogtagpki/pki/blob/master/docs/installation/ca/Installing-CA-with-Random-Serial-Numbers-v3.adoc Instructions for installing a KRA: https://github.com/dogtagpki/pki/blob/master/docs/installation/kra/Installig-KRA-with-Random-Serial-Numbers-v3.adoc The version of random serial numbers is stored within the CA entry of the server. It is stored as a version to allow for future upgrades. If a CA has RSN enabled then any KRA installed will also have it enabled for its identifiers. A new attribute, ipaCaRandomSerialNumberVersion, is added to the IPA CA entry to track the version number in case PKI has future major revisions. This can also be used to determine if RSN is enabled or not. Fixes: https://pagure.io/freeipa/issue/2016 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
100 lines
4.1 KiB
Groff
100 lines
4.1 KiB
Groff
.\" A man page for ipa-ca-install
|
|
.\" Copyright (C) 2011-2017 Red Hat, Inc.
|
|
.\"
|
|
.\" This program is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the GNU General Public License as published by
|
|
.\" the Free Software Foundation, either version 3 of the License, or
|
|
.\" (at your option) any later version.
|
|
.\"
|
|
.\" This program is distributed in the hope that it will be useful, but
|
|
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
.\" General Public License for more details.
|
|
.\"
|
|
.\" You should have received a copy of the GNU General Public License
|
|
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
.\"
|
|
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
|
.\"
|
|
.TH "ipa-ca-install" "1" "Mar 30 2017" "IPA" "IPA Manual Pages"
|
|
.SH "NAME"
|
|
ipa\-ca\-install \- Install a CA on a server
|
|
.SH "SYNOPSIS"
|
|
.TP
|
|
ipa\-ca\-install [\fIOPTION\fR]...
|
|
.SH "DESCRIPTION"
|
|
Adds a CA as an IPA\-managed service. This requires that the IPA server is already installed and configured.
|
|
|
|
ipa\-ca\-install can be used to upgrade from CA-less to CA-full or to install the CA service on a replica.
|
|
|
|
Domain level 0 is not supported anymore.
|
|
|
|
.SH "OPTIONS"
|
|
\fB\-d\fR, \fB\-\-debug\fR
|
|
Enable debug logging when more verbose output is needed
|
|
.TP
|
|
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
|
|
Directory Manager (existing master) password
|
|
.TP
|
|
\fB\-w\fR \fIADMIN_PASSWORD\fR, \fB\-\-admin\-password\fR=\fIADMIN_PASSWORD\fR
|
|
Admin user Kerberos password used for connection check
|
|
.TP
|
|
\fB\-\-external\-ca\fR
|
|
Generate a CSR for the IPA CA certificate to be signed by an external CA.
|
|
.TP
|
|
\fB\-\-external\-ca\-type\fR=\fITYPE\fR
|
|
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include the template name required by Microsoft Certificate Services (MS CS) in the generated CSR (see \fB\-\-external\-ca\-profile\fR for full details).
|
|
|
|
.TP
|
|
\fB\-\-external\-ca\-profile\fR=\fIPROFILE_SPEC\fR
|
|
Specify the certificate profile or template to use at the external CA.
|
|
|
|
When \fB\-\-external\-ca\-type\fR is "ms-cs" the following specifiers may be used:
|
|
|
|
.RS
|
|
.TP
|
|
\fB<oid>:<majorVersion>[:<minorVersion>]\fR
|
|
Specify a certificate template by OID and major version, optionally also specifying minor version.
|
|
.TP
|
|
\fB<name>\fR
|
|
Specify a certificate template by name. The name cannot contain any \fI:\fR characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence).
|
|
.TP
|
|
\fBdefault\fR
|
|
If no template is specified, the template name "SubCA" is used.
|
|
.RE
|
|
|
|
.TP
|
|
\fB\-\-external\-cert\-file\fR=\fIFILE\fR
|
|
File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
|
|
.TP
|
|
\fB\-\-ca\-subject\fR=\fISUBJECT\fR
|
|
The CA certificate subject DN (default CN=Certificate Authority,O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
|
|
.TP
|
|
\fB\-\-subject\-base\fR=\fISUBJECT\fR
|
|
The subject base for certificates issued by IPA (default O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
|
|
.TP
|
|
\fB\-\-pki\-config\-override\fR=\fIFILE\fR
|
|
File containing overrides for CA installation.
|
|
.TP
|
|
\fB\-\-ca\-signing\-algorithm\fR=\fIALGORITHM\fR
|
|
Signing algorithm of the IPA CA certificate. Possible values are SHA1withRSA, SHA256withRSA, SHA384withRSA, SHA512withRSA. Default value is SHA256withRSA. Use this option with --external-ca if the external CA does not support the default signing algorithm.
|
|
.TP
|
|
\fB\-\-no\-host\-dns\fR
|
|
Do not use DNS for hostname lookup during installation
|
|
.TP
|
|
\fB\-\-random\-serial\-numbers\fR
|
|
Enable Random Serial Numbers. Random serial numbers cannot be used in a mixed environment. Either all CA's have it enabled or none do.
|
|
.TP
|
|
\fB\-\-skip\-conncheck\fR
|
|
Skip connection check to remote master
|
|
.TP
|
|
\fB\-\-skip\-schema\-check\fR
|
|
Skip check for updated CA DS schema on the remote master
|
|
.TP
|
|
\fB\-U\fR, \fB\-\-unattended\fR
|
|
An unattended installation that will never prompt for user input
|
|
.SH "EXIT STATUS"
|
|
0 if the command was successful
|
|
|
|
1 if an error occurred
|