freeipa

#9307 PKI Serial Number Configuration on freeipa 4.9.10
Closed: duplicate by rcritten. Opened by ogonzales.

Closed: duplicate
Reopen Issue

Goal
As IPA CA admin, I need to configure the serial number attribute in the SSL certificate so that it can be randomly generated within a range.

Issue:
Serial number in SSL cannot be randomly generated within a specified range

After installation of IPA-server, I changed the following parameters in etc/sysconfig/pki/tomcat/pki-tomcat/ca/default.cfg and etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg files:

pki_serial_number_range_end=1000000
pki_serial_number_range_start =1000
pki_ca_signing_serial_number=True

but these change don't take effect. I re-initiated a new interactive shell after changes

Also I tried to install the ipa-server with a cfg file that has the above parameters with the desired values using the flag --pki-config-override but i got the below error

ipa-server-install: error: option --pki-config-override: '/path/my_filee.cfg' overrides immutable options: pki_ca_signing_serial_number, pki_serial_number_range_end, pki_serial_number_range_start
The ipa-server-install command failed.

System details
My FreeIPA's version is: VERSION: 4.9.10, API_VERSION: 2.248
I'm using a docker container with the image freeipa-server:centos-8-stream

Capture.PNG

Closing as a duplicate of https://pagure.io/freeipa/issue/2016

Even if the override allowed the values it would still not generate random serial numbers. The CA would still iterate from the starting value, at best.

With IPA v4.10.0 real random serial numbers are supported on new installations. This relies on a PKi version that is not available in RHEL-8 (and clones).

Metadata Update from @rcritten:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)

Got it. Is there a way to configure the CA to generate the serial number within a range (start and end values)?
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.