[Freeipa-users] Re: Replacing externally signed CA long before expiry

2018-01-10 Thread Steve Dainard via FreeIPA-users
edhat.com> > wrote: > >> On 12/19/2017 06:59 PM, Steve Dainard via FreeIPA-users wrote: >> >>> Hi Flo, >>> >>> >>> On Tue, Dec 19, 2017 at 8:17 AM, Florence Blanc-Renaud <f...@redhat.com >>> <mailto:f...@redhat.com>> wrote:

[Freeipa-users] Re: Replacing externally signed CA long before expiry

2017-12-20 Thread Steve Dainard via FreeIPA-users
On Wed, Dec 20, 2017 at 12:53 AM, Florence Blanc-Renaud <f...@redhat.com> wrote: > On 12/19/2017 06:59 PM, Steve Dainard via FreeIPA-users wrote: > >> Hi Flo, >> >> >> On Tue, Dec 19, 2017 at 8:17 AM, Florence Blanc-Renaud <f...@redhat.com >> <ma

[Freeipa-users] Re: Replacing externally signed CA long before expiry

2017-12-19 Thread Steve Dainard via FreeIPA-users
Hi Flo, On Tue, Dec 19, 2017 at 8:17 AM, Florence Blanc-Renaud <f...@redhat.com> wrote: > On 12/18/2017 08:54 PM, Steve Dainard via FreeIPA-users wrote: > >> Hello, >> >> Using freeipa 4.5. >> >> I've replaced an external root CA that had a very short

[Freeipa-users] Replacing externally signed CA long before expiry

2017-12-18 Thread Steve Dainard via FreeIPA-users
Hello, Using freeipa 4.5. I've replaced an external root CA that had a very short key, and have gone through the process of resigning the ipa intermediate-CA. I've used ipa-cacert-manage to generate a new csr and have signed it with my new external CA. The cert was successfully imported. I

[Freeipa-users] Re: cross-forest trust, client system cannot id AD users.

2017-10-24 Thread Steve Dainard via FreeIPA-users
t; /etc/group defines 'wheel' by default, but not 'employees'. > > > > Once we get IPA into production I'll pull the wheel group out of AD and > > keep it defined in IPA only. > > > > Thanks, > > Steve > > > > On Thu, Oct 19, 2017 at 11:37 AM, Ju

[Freeipa-users] IPA CA allow CSR SAN names in external domains

2017-10-20 Thread Steve Dainard via FreeIPA-users
Hello I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be able to add SAN's for a different dns domain than exists in the IPA realm. The dns for 'otherdomain.com' is handled by active directory which my IPA server has a cross-forest trust with. ie: host: client1.ipadomain.com

[Freeipa-users] Re: cross-forest trust, client system cannot id AD users.

2017-10-19 Thread Steve Dainard via FreeIPA-users
, 2017 at 11:37 AM, Justin Stephenson via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote: > On 10/19/2017 02:14 PM, Jakub Hrozek via FreeIPA-users wrote: > >> On Tue, Oct 17, 2017 at 02:21:07PM -0700, Steve Dainard via FreeIPA-users >> wrote: >> >>