freeipa

#8186 Add ipa-ca.$DOMAIN alias to IPA server HTTP certificates
Closed: fixed by ftweedal. Opened by ftweedal.

Closed: fixed
Reopen Issue

Request for enhancement

For ACME support, and for consistent and straightforward client experience, the ACME service
should be reachable via the ipa-ca.$DOMAIN DNS name. ACME requires TLS. Therefore we need to add the ipa-ca.$DOMAIN DNS name to IPA servers' HTTP certificates.

(Part of ACME effort https://pagure.io/freeipa/issue/4751 )

How do you plan to implement the feature?

The cert plugin verifies SAN names and only permits SAN entries for the current host and hosts that are managed by the current host. The ipa-ca.$DOMAIN DNS entry has no host principal entry. That means it is not possible to make ipa-ca managed by server.

Metadata Update from @cheimes:
- Custom field blocking adjusted to 4751

@cheimes there's already a pull request: https://github.com/freeipa/freeipa/pull/4193

The commit that deals with the specific issue you raised is https://github.com/freeipa/freeipa/pull/4193/commits/7faf29f9d0c3300218cbde1460d13752bb937e7b. Check out the diff and we can continue the discussion either here or in the PR.

Metadata Update from @ftweedal:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/4193

master:

  • 0711c4a0d45f9e28459596552ca751890b13c265 certmonger: avoid mutable default argument
  • e0fb3816f656dc4b324fc02c8d4506dadcfe544e certmonger: move 'criteria' description to module docstring
  • 18ebd1116d706d9f2a3a9c2dca16681a4f138362 certmonger: support dnsname as request search criterion
  • 4cf9c8689fc4a791eee17e0cfcb38e837a53b3f0 httpinstance: add fqdn and ipa-ca alias to Certmonger request
  • f7c45641fe356364175899399b51b07987b44a1b cert-request: allow ipa-ca.$DOMAIN dNSName for IPA servers
  • 4d5b5a9024c1237cb128688c7c4ac796135d50d5 httpinstance: add ipa-ca.$DOMAIN alias in initial request
  • cf4c2c64b0bb1e4555a48bc5079aeff101fd9894 upgrade: add ipa-ca.$DOMAIN alias to HTTP certificate
  • 45b5384b6ef83aaf742bf7906d846e07db874ef8 (HEAD) ipatests: check HTTP certificate contains ipa-ca.$DOMAIN dnsname

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-8:

  • 0e9b7773fb613889eacaa95504f1c40f21628c0f certmonger: avoid mutable default argument
  • ff7d0661a71ff2c9a66c8c9a1a48837d041f9099 certmonger: move 'criteria' description to module docstring
  • b127bad8a93967c09c24edadd31d7d6e5b812186 certmonger: support dnsname as request search criterion
  • 52873581e7ab1de8c02a4d80cdeeb9bf27b2f168 httpinstance: add fqdn and ipa-ca alias to Certmonger request
  • 4b24129f9e1ceb322c5477f9a0869f7a6b521f09 cert-request: allow ipa-ca.$DOMAIN dNSName for IPA servers
  • 5275342b691b2f74b365cb3422459779544be16a httpinstance: add ipa-ca.$DOMAIN alias in initial request
  • c445cefacf7713746f0bb0399d33b3f4008b71b4 upgrade: add ipa-ca.$DOMAIN alias to HTTP certificate
  • 8e92190db866e7eb05aaaf41609b442f201d5c08 ipatests: check HTTP certificate contains ipa-ca.$DOMAIN dnsname

master:

  • 9d9012f682a2dcff7676580fbc622771b427fcef httpinstance: retry request without ipa-ca.$DOMAIN dnsName on failure
  • e6fda6f0fbcc7dee4deb0093bf46c2fadc3068ee (HEAD) upgrade: avoid stopping certmonger when fixing requests

ipa-4-8:

  • 00dd80b77e115734e6f8942339cd2e0d3cc7fbdc httpinstance: retry request without ipa-ca.$DOMAIN dnsName on failure
  • f1564cd228068d54b949277f7bdc00203b5da81a upgrade: avoid stopping certmonger when fixing requests
Metadata
None
None
None
None
4751
https://github.com/freeipa/freeipa/pull/4193
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.