[Freeipa-users] Re: How to get certificate containing full chain

2020-05-08 Thread Rob Crittenden via FreeIPA-users
Leusmann, Philipp wrote: > > > CONET Solutions GmbH, Theodor-Heuss-Allee 19, 53773 Hennef. > Geschäftsführer/Managing Director: Dirk Lieder > > Registergericht/Registration Court: Amtsgericht Siegburg (HRB Nr. 9136) > >   > >   > > Daten

[Freeipa-users] Re: How to get certificate containing full chain

2020-05-08 Thread Leusmann, Philipp via FreeIPA-users
CONET Solutions GmbH, Theodor-Heuss-Allee 19, 53773 Hennef. Geschäftsführer/Managing Director: Dirk Lieder Registergericht/Registration Court: Amtsgericht Siegburg (HRB Nr. 9136) Datenschutzhinweise: https://www.conet.de/DE/conet/date

[Freeipa-users] Re: How to get certificate containing full chain

2020-05-08 Thread Rob Crittenden via FreeIPA-users
Leusmann, Philipp via FreeIPA-users wrote: > Rob, > >> What command? The command should be a script or simple command. No pipes >> or redirects. > > I issue ipa-getcert request -I artifactory2 -f server.crt -k fullchain.key -C > 'cat server.crt /etc/ipa/ca.crt > fullchain.crt‘ > I also tried cal

[Freeipa-users] Re: How to get certificate containing full chain

2020-05-08 Thread Leusmann, Philipp via FreeIPA-users
Rob, > What command? The command should be a script or simple command. No pipes > or redirects. I issue ipa-getcert request -I artifactory2 -f server.crt -k fullchain.key -C 'cat server.crt /etc/ipa/ca.crt > fullchain.crt‘ I also tried calling a bash-script instead of the -C argument. Doesn’t he

[Freeipa-users] Re: How to get certificate containing full chain

2020-05-08 Thread Rob Crittenden via FreeIPA-users
Philipp Leusmann via FreeIPA-users wrote: > Hi, > > I need to receive a certificate containing the full CA chain. > Since ipa-getcert doesn't seem to offer a prebuilt option to do so (or does > it?), I was looking at the post-save-command of ipa-getcert to merge the > received certificate and t

[Freeipa-users] How to get certificate containing full chain

2020-05-08 Thread Philipp Leusmann via FreeIPA-users
Hi, I need to receive a certificate containing the full CA chain. Since ipa-getcert doesn't seem to offer a prebuilt option to do so (or does it?), I was looking at the post-save-command of ipa-getcert to merge the received certificate and the chain. Unfortunately the command never gets invoke

[Freeipa-users] Re: where to place the freeipa server in a segmented network

2020-05-08 Thread Alex Corcoles via FreeIPA-users
> > It shows up as hostname.ipadomain in FreeIPA (which doesn't match its name > on the networks) and I've never had any issue- I suspect client hostnames > are not really important. > Sorry, correction. My laptop's hostname *IS* hostname.ipadomain. When it connects to different networks, the DNS

[Freeipa-users] Re: where to place the freeipa server in a segmented network

2020-05-08 Thread Alex Corcoles via FreeIPA-users
Hi, On Fri, May 8, 2020 at 3:18 PM Angus Clarke via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote: > We run out IPA infrastructure globally with VPN connected sites, no issue > there. I don't have experience of road warrior VPN clients though. I'm not > sure how IPA behaves when hos

[Freeipa-users] Re: where to place the freeipa server in a segmented network

2020-05-08 Thread Angus Clarke via FreeIPA-users
Hi At the one end of things you might want to secure your IPA server in your production network however this might not be reachable from other networks (your network policy.) At the other end of things you might want to place it in your most accessible network however then the system is more at

[Freeipa-users] Re: where to place the freeipa server in a segmented network

2020-05-08 Thread Simo Sorce via FreeIPA-users
On Fri, 2020-05-08 at 10:27 +, Rob van Halteren via FreeIPA-users wrote: > Hello, > > I have network consisting out a LAN,WLAN,DMZ and a PRODUCTION network, > separated by a firewall that performs the routing and connections to the > outside world. > I want to introduce Identity management u

[Freeipa-users] where to place the freeipa server in a segmented network

2020-05-08 Thread Rob van Halteren via FreeIPA-users
Hello, I have network consisting out a LAN,WLAN,DMZ and a PRODUCTION network, separated by a firewall that performs the routing and connections to the outside world. I want to introduce Identity management using a FreeIPA server for my network. Most client machines will be on the LAN network, b