You were right, The file CA key was not necessary I just concatenated the
host and CA public key and used the host private key to generate the
Keystore correctly.
I did the question due some documents mentioning commands like this one
where a the ca-key file is required.
1.
1. Sign the certificate with the CA: openssl x509 -req -CA ca-cert -CAkey
ca-key -in cert-file -out cert-signed -days <validity>
-CAcreateserial -passin pass:<ca-password>.
thanks
--
Hernán Fernández
+56994752172
On Sat, Nov 23, 2019 at 4:32 PM Rob Crittenden <[email protected]> wrote:
> Hernán Fernández via FreeIPA-users wrote:
> > Hello,
> >
> > I have a FreeIPA server and about 7 nodes, each node has a certificate
> > and a key.
> >
> > I got those host certificates with:
> > ipa-getcert request -v -f /etc/security/certificates/host.crt -k
> > /etc/security/certificates/host.key
> >
> >
> > I can see the CA certificate it's located at /etc/ipa/ca.crt. Where is
> > the CAKey file?. I need to create a Keystore for the host.
>
> You should never need the CA private key.
>
> Maybe it's a matter of terminology. What kind of keystore are you trying
> to create? Are you working from some documentation?
>
> rob
>
>
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
