freeipa

#9701 Allow choosing subCA for ACME operations
Opened by abbra. Modified

Open
Close Issue

With https://github.com/dogtagpki/pki/pull/4903 merged, Dogtag PKI will allow specifying CA authority ID or DN to configure ACME issuer.

Add support for that in IPA. In order to configure ID of the CA to issue ACME certificates one can use pki-server acme-issuer-mod --type pki "-Dauthority-id=${caid}" where caid is the CA ID obtained with ipa ca-show <CA name>.

Also, ACME clients like certbot have switched to use ECC algorithm by default. Probably makes sense to investigate if ACME profile can be switched to use ECC as well by default.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.