[Freeipa-users] Re: How to grant CSR from command line

[Bret Wortman]

I should have realized that. We'll just stick with FQDNs from now on.

I adjusted my wrapper and now it runs to completion and does what we expect. Thanks, Rob!

Bret Wortman
Founder, Damascus Products, LLC

855-644-2783 (tel:[phone]) | [e-mail] (https://link.getmailspring.com/link/41D794C0-A0A5-4DCC-A9D8-78BCB4A71C60@get...)

http://wrapbuddies.co/ (https://link.getmailspring.com/link/41D794C0-A0A5-4DCC-A9D8-78BCB4A71C60@get...)

70 Main St. Suite 23 Warrenton, VA 20186

On Apr 11 2019, at 1:47 pm, Rob Crittenden  wrote:
> Bret Wortman via FreeIPA-users wrote:
> > Thanks, Rob. I'm a lot closer now.
> >
> > What I'm getting now looks like:
> > # KRB5_CLIENT_KTNAME=/etc/krb5.keytab ipa cert-request --add
> > --principal=HTTP/$HOST $DB/$HOST.csr
> > IPA: error: tHE SERVICE PRINCIPAL FOR SUBJECT ALT NAME myhost in
> > certificate request does not exist
> >
> > What we've done before is set up each system with its FQDN and just its
> > hostname (and some have other aliases as well). Is that what's causing a
> > problem?
> >
> > I've looked for documentation on the ipa cert-request command but can't
> > seem to find anything.
>
> IPA requires that every hostname in a cert exist in IPA (so you don't
> request a SAN for a host you don't own). In this case it is looking for
> HTTP/<shortname> which I presume doesn't exist.
>
> You can try forcing the creation with:
> $ ipa service-add HTTP/<shortname> --force
> rob
> > photo
> > *Bret Wortman*
> > Founder, Damascus Products, LLC
> >
> > 855-644-2783 tel:[phone] | [e-mail]
> > https://link.getmailspring.com/link/[e-mail]/0?redirect=mailto%3Abret%40wrapbuddies.co&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn
> >
> > http://wrapbuddies.co/
> > https://link.getmailspring.com/link/[e-mail]/1?redirect=http%3A%2F%2Fwrapbuddies.co%2F&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn
> >
> > 70 Main St. Suite 23 Warrenton, VA 20186
> > https://link.getmailspring.com/link/[e-mail]/2?redirect=http%3A%2F%2Ffacebook.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn
> > https://link.getmailspring.com/link/[e-mail]/3?redirect=http%3A%2F%2Fwww.linkedin.com%2Fin%2Fbretwortman&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn https://link.getmailspring.com/link/[e-mail]/4?redirect=http%3A%2F%2Ftwitter.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn https://link.getmailspring.com/link/[e-mail]/5?redirect=http%3A%2F%2Finstagram.com%2Fwrapbuddies&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn
> >
> > On Apr 11 2019, at 11:31 am, Rob Crittenden  wrote:
> > Bret Wortman via FreeIPA-users wrote:
> > I know I can paste a CSR from one of our servers into the GUI and
> > generate a new cert, but how can I do this from a command line?
> >
> > I've been working with this:
> > # ipa cert-request --principal=HTTP/$HOST $DB/$HOST.csr
> >
> > Add the --add option to create the principal if it doesn't already exist
> > (assuming your kerberos principal has rights to add one).
> >
> > You can make this all automatic with something like:
> > # KRB5_CLIENT_KTNAME=/etc/krb5.keytab ipa cert-request --add
> > --principal=HTTP/$HOST $DB/$HOST.csr
> >
> > No kinit needed.
> > But that's giving me an error that the principal doesn't exist. Then
> > (admittedly, I picked up this command from a discussion I found):
> >
> > # ipa cert-show $SERIAL_NUMBER --out=$DB/sslcert.pem
> > How do I get the serial number?
> > Basically, I'm trying to wrap and automate the process of
> > granting a new
> > cert to a server.
> >
> > The serial number will be in the output from the cert-request command,
> > twice actually: one decimal, one hex.
> >
> > You can do it hackily via something like:
> > SERIAL_NUMBER=$(KRB5_CLIENT_KTNAME=/etc/krb5.keytab ipa cert-request
> > --principal bar/`hostname` /tmp/csr --add 2>&1 | grep "Serial number:
> > " | cut -d: -f2)
> >
> > Though that won't catch errors. You can also do a service-show
> > HTTP/$HOST to get the serial number.
> >
> > rob
> > Sent from Mailspring
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...