freeipa

#8719 ipa-getcert -F option does not include subCA certificate
Closed: duplicate by rcritten. Opened by jackermann.

Closed: duplicate
Reopen Issue

Request for enhancement

Please add the full chain including the subCA's certificate to the -F option if the certificate is signed by an subCA.

Issue

If usingipa-getcet request with option -X and -F the IPA CA main chain is included but the subCA certificate is missing.

Steps to Reproduce

  1. Add subCA to IPA
  2. ipa-getcert request -X subCA -k /tmp/`hostname`.private.pem -f /tmp/`hostname`.pem -F /tmp/fullchain.crt
  3. cat /tmp/fullchain.crt

Actual behavior

Only main CA certificate included.

Expected behavior

SubCA certificate should be included as well.

Version/Release/Distribution

ipa-server-4.6.8-5.el7.centos.x86_64
ipa-client-4.6.8-5.el7.centos.x86_64
389-ds-base-1.3.10.2-8.el7_9.x86_64
pki-ca-10.5.18-7.el7.noarch
krb5-server-1.15.1-50.el7.x86_64

Closing as duplicate of https://pagure.io/certmonger/issue/189

Metadata Update from @rcritten:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.