[Freeipa-users] Re: ipa-server-certinstall -k

[Charles Hedrick]

the error is

The KDC certificate in cert.pem, privkey.pem is not valid: invalid for a KDC


________________________________
From: Charles Hedrick via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
Sent: Wednesday, June 15, 2022 3:39 PM
To: freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Charles Hedrick <hedrick(a)rutgers.edu&gt;
Subject: [Freeipa-users] ipa-server-certinstall -k

ipa-server-certinstall works fine for http and ldap. But I can't get the -k option to
work.

I've tried cert.pem and privkey.pem with and without chain.pem, as well as
fullchain.pem and privkey.pem (fullchain has both the cert and the chain).

The certs were issued by Internet2, which chains up to addtrust.

kinit -n works fine if I install the pem files manually, so presumably my files are
valid.