PKINIT questions

[alexey safonov]

Hi, I've a FreeIPA setup 4.10.1 (that's a long-living setup that was
upgraded many times). It is CA-less setup (Inititally we had CA, but
than it  was removed). So now 4 of my servers are saying that PKINIT
is enabled and one server is saying "disabled".

I tried to re-install replica, but it says CA-less mode can't issue a
certificate, so I tried with kdc-cert-file, but than it says cert is
not valid (where it's definitly works for web and ldap).

Anything I can do here and enable pkinit on that replica?

Alex

[Rob Crittenden]

alexey safonov via FreeIPA-users wrote:
> Hi, I've a FreeIPA setup 4.10.1 (that's a long-living setup that was
> upgraded many times). It is CA-less setup (Inititally we had CA, but
> than it  was removed). So now 4 of my servers are saying that PKINIT
> is enabled and one server is saying "disabled".
>
> I tried to re-install replica, but it says CA-less mode can't issue a
> certificate, so I tried with kdc-cert-file, but than it says cert is
> not valid (where it's definitly works for web and ldap).
>
> Anything I can do here and enable pkinit on that replica?

A KDC cert has some extensions not typically found in a server
certificate. This page outlines the requirements:
https://web.mit.edu/kerberos/krb5-1.12/doc/admin/pkinit.html

rob

[alexey safonov]

I'm just surprised than, how other replicas has PKINIT?

пт, 16 июн. 2023 г. в 23:07, Rob Crittenden :
> alexey safonov via FreeIPA-users wrote:
> > Hi, I've a FreeIPA setup 4.10.1 (that's a long-living setup that was
> > upgraded many times). It is CA-less setup (Inititally we had CA, but
> > than it  was removed). So now 4 of my servers are saying that PKINIT
> > is enabled and one server is saying "disabled".
> >
> > I tried to re-install replica, but it says CA-less mode can't issue a
> > certificate, so I tried with kdc-cert-file, but than it says cert is
> > not valid (where it's definitly works for web and ldap).
> >
> > Anything I can do here and enable pkinit on that replica?
>
> A KDC cert has some extensions not typically found in a server
> certificate. This page outlines the requirements:
> https://web.mit.edu/kerberos/krb5-1.12/doc/admin/pkinit.html
>
> rob

[Florence Blanc-Renaud]

Hi,

On Sun, Jun 18, 2023 at 3:47 AM alexey safonov via FreeIPA-users <
[e-mail]> wrote:
> I'm just surprised than, how other replicas has PKINIT?

in your first email you mentioned that the topology used to have a CA. If a
replica was installed at that time then IPA CA issued a KDC certificate for
this replica, with the required extensions. But be aware that when it
reaches it expiration date, it won't be automatically renewed, and you will
have to get a new KDC cert outside of IPA, then install it using
ipa-server-certinstall with the --kdc option.

flo
> пт, 16 июн. 2023 г. в 23:07, Rob Crittenden :
> > alexey safonov via FreeIPA-users wrote:
> > > Hi, I've a FreeIPA setup 4.10.1 (that's a long-living setup that was
> > > upgraded many times). It is CA-less setup (Inititally we had CA, but
> > > than it  was removed). So now 4 of my servers are saying that PKINIT
> > > is enabled and one server is saying "disabled".
> > >
> > > I tried to re-install replica, but it says CA-less mode can't issue a
> > > certificate, so I tried with kdc-cert-file, but than it says cert is
> > > not valid (where it's definitly works for web and ldap).
> > >
> > > Anything I can do here and enable pkinit on that replica?
> >
> > A KDC cert has some extensions not typically found in a server
> > certificate. This page outlines the requirements:
> > https://web.mit.edu/kerberos/krb5-1.12/doc/admin/pkinit.html
> >
> > rob
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue

[alexey safonov]

Got it. thanks. Would it be possible to use for KDS self-signed
certificate, while for dirsrv/http normal certificate signed by public
CA?

пн, 19 июн. 2023 г. в 14:46, Florence Blanc-Renaud :
> Hi,
>
> On Sun, Jun 18, 2023 at 3:47 AM alexey safonov via FreeIPA-users  wrote:
> > I'm just surprised than, how other replicas has PKINIT?
>
> in your first email you mentioned that the topology used to have a CA. If a replica was installed at that time then IPA CA issued a KDC certificate for this replica, with the required extensions. But be aware that when it reaches it expiration date, it won't be automatically renewed, and you will have to get a new KDC cert outside of IPA, then install it using ipa-server-certinstall with the --kdc option.
>
> flo
> > пт, 16 июн. 2023 г. в 23:07, Rob Crittenden :
> > > alexey safonov via FreeIPA-users wrote:
> > > > Hi, I've a FreeIPA setup 4.10.1 (that's a long-living setup that was
> > > > upgraded many times). It is CA-less setup (Inititally we had CA, but
> > > > than it  was removed). So now 4 of my servers are saying that PKINIT
> > > > is enabled and one server is saying "disabled".
> > > >
> > > > I tried to re-install replica, but it says CA-less mode can't issue a
> > > > certificate, so I tried with kdc-cert-file, but than it says cert is
> > > > not valid (where it's definitly works for web and ldap).
> > > >
> > > > Anything I can do here and enable pkinit on that replica?
> > >
> > > A KDC cert has some extensions not typically found in a server
> > > certificate. This page outlines the requirements:
> > > https://web.mit.edu/kerberos/krb5-1.12/doc/admin/pkinit.html
> > >
> > > rob
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Florence Blanc-Renaud]

Hi,

On Sat, Jul 1, 2023 at 3:48 AM alexey safonov  wrote:
> Got it. thanks. Would it be possible to use for KDS self-signed
> certificate, while for dirsrv/http normal certificate signed by public
> CA?
>
> It is possible to have different certificates for dirsrv/httpd/kdc, and

even different cert chains. For instance ExternalCA1 > dirsrv, ExternalCA2
> http, External CA3 > KDC. Each one can be installed with

ipa-cacert-manage install -t CT,C,C <external CA> followed by
ipa-certupdate and ipa-server-certinstall (with either -d / -w /-k).

If I recall correctly, a self-signed KDC certificate will allow IPA to
function but won't enable PKINIT authentication (see
https://freeipa.org/page/V4/Kerberos_PKINIT). You can generate a CA and
have this CA generate your KDC cert by following instructions from
https://web.mit.edu/kerberos/krb5-1.12/doc/admin/pkinit.html

flo

пн, 19 июн. 2023 г. в 14:46, Florence Blanc-Renaud :
> > Hi,
> >
> > On Sun, Jun 18, 2023 at 3:47 AM alexey safonov via FreeIPA-users <
>
> [e-mail]> wrote:
> > > I'm just surprised than, how other replicas has PKINIT?
> >
> > in your first email you mentioned that the topology used to have a CA.
>
> If a replica was installed at that time then IPA CA issued a KDC
> certificate for this replica, with the required extensions. But be aware
> that when it reaches it expiration date, it won't be automatically renewed,
> and you will have to get a new KDC cert outside of IPA, then install it
> using ipa-server-certinstall with the --kdc option.
> > flo
> > > пт, 16 июн. 2023 г. в 23:07, Rob Crittenden :
> > > > alexey safonov via FreeIPA-users wrote:
> > > > > Hi, I've a FreeIPA setup 4.10.1 (that's a long-living setup that was
> > > > > upgraded many times). It is CA-less setup (Inititally we had CA, but
> > > > > than it  was removed). So now 4 of my servers are saying that PKINIT
> > > > > is enabled and one server is saying "disabled".
> > > > >
> > > > > I tried to re-install replica, but it says CA-less mode can't issue
>
> a
> > > > > certificate, so I tried with kdc-cert-file, but than it says cert is
> > > > > not valid (where it's definitly works for web and ldap).
> > > > >
> > > > > Anything I can do here and enable pkinit on that replica?
> > > >
> > > > A KDC cert has some extensions not typically found in a server
> > > > certificate. This page outlines the requirements:
> > > > https://web.mit.edu/kerberos/krb5-1.12/doc/admin/pkinit.html
> > > >
> > > > rob
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to
>
> [e-mail]
> > > Fedora Code of Conduct:
>
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
>
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > Do not reply to spam, report it:
>
> https://pagure.io/fedora-infrastructure/new_issue