On 03/15/2016 08:39 AM, Alessandro De Maria wrote:
I would like to have authenticated users to upload a csr request and
have their certificate automatically signed. Their certificate would
expire in x days.
Given the short life of the certificate, I would then like them to be
able to easily download the certificate.
Any suggestion on how to do it?
I would prefer the shell script approach but also having it self
serviced on the web ui would be great.
Alessandro De Maria
for FreeIPA 4.2+ you can use the following links as a guide to set up a
custom profile and CA ACL rules so that users can request certificates
The user then can generate CSR request e.g. using OpenSSL and use 'ipa
cert-request' to send it to IPA CA. If you specify 'store=True' when
adding the custom certificate profile, the certificate will be added to
the user entry as 'usercertificate;binary' attribute which he can view
from CLI/WebUI as PEM and save it to a file by copy-pasting it (The
functionality to save the certificate directly to a file is under
It should be possible to modify the certificate profile to restrict the
maximum validity of the issued certificate but I have no knowledge about
that. I have CC'ed Fraser Tweedale (the blog post author), he may help
you with this.
Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project