> On Oct 24, 2016, at 5:51 AM, David Kupka <dku...@redhat.com> wrote:
> On 22/10/16 00:15, Gilbert Wilson wrote:
>> We have a lot of FreeBSD systems that I would like to streamline certificate 
>> issuance and renewal. Ideally, we could leverage our FreeIPA system's CA to 
>> do this. But, certmonger doesn't run on FreeBSD (or does it?). What other 
>> means have other people tried, or would you recommend investigating, to 
>> enable automated certificate issuance and renewal for FreeBSD FreeIPA 
>> clients?
>> Any pointers are appreciated!
>> Gil
> Hello Gil!
> I've very limited experiences with *BSD systems so the question may be 
> completely off.
> Have you tried to install and run certmonger using FreeBSD's Linux Binary 
> Compatibility [1]? Though I don't know what are the limitations or possible 
> issues it could be a way.
> [1] http://www.freebsd.cz/doc/handbook/linuxemu.html
> -- 
> David Kupka

You know… I haven’t ever tried LBC! I suppose it’s worth a sacrificial virtual 
machine to see if it works. It also occurred to me that FreeIPA might have some 
sort of API given the web interface, and sure enough that made the Google-fu 
turn up more useful results.

* https://vda.li/en/posts/2015/05/28/talking-to-freeipa-api-with-sessions/
* https://adam.younglogic.com/2010/07/talking-to-freeipa-json-web-api-via-curl/
* http://www.admin-magazine.com/Archive/2016/34/A-REST-interface-for-FreeIPA

There doesn’t appear to be a manual for the API but those examples seem to 
“show the way”. My initial thought is to create a script that uses kinit with a 
keytab to authenticate against FreeIPA and then create/renew permissible 
certificates for the system before they expire. This seems reasonable since the 
certificate creation/renewal is the scope of what I’m interested in doing. Do 
you see any reason not to do it this way or have any other alternative 
suggestions? Another way to think about it, perhaps, is what would you do on a 
Linux system if you didn’t have access to the FreeIPA client or certmonger?

Thanks for the pointer/reminder about LBC!


Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to