Re: Installing CA certificate isuue

Hi 
I just wanted to say thank you to this list and especially to Rob Crittenden..
I could not log in to freeipa-users, there may be a problem in logging in with social network accounts. So I am sending this as an email..
Firstly My issue was freeIpa was refusing to install my comodo certificate with a signature algorithm complain.
I am writing how I solved this issue with a complete CLI
#recommended by Rob and significant milestone in solving my problemupdate-crypto-policies --set DEFAULT:SHA1#I received ca-bundle from my CA with my CRT file sudo ipa-cacert-manage  -t C,, install my-domain.ca-bundle  sudo ipa-certupdate #pem file incudes all the certificate authority chain.. sudo ipa-server-certinstall --http --dirsrv mydomain.key mydomain.pem

I have only one questionWhy didIı need to add this ca file to my freeIPA server? I mean it is already sgined with a public CA? web servers can easily see and do not throw any error when I install this certificate. but same is not true when I install this certificate in IDM or in anyting other than a web server.. so why do they not know my CA automaticaly?
is it because this is especially designed for HTTPS connections? Do I need to request something different or from another vendor, such as verisgn?

Thanks again..

Installing CA certificate isuue

[Rob Crittenden]

mskaraca--- via FreeIPA-users wrote:
> Hi
>
> I just wanted to say thank you to this list and especially to Rob
> Crittenden..
>
> I could not log in to freeipa-users, there may be a problem in logging
> in with social network accounts. So I am sending this as an email..
>
> Firstly My issue was freeIpa was refusing to install my comodo
> certificate with a signature algorithm complain.
>
> I am writing how I solved this issue with a complete CLI
>
> #recommended by Rob and significant milestone in solving my problem
> update-crypto-policies --set DEFAULT:SHA1
> #I received ca-bundle from my CA with my CRT file
>  sudo ipa-cacert-manage  -t C,, install my-domain.ca-bundle 
>  sudo ipa-certupdate 
> #pem file incudes all the certificate authority chain..
>  sudo ipa-server-certinstall --http --dirsrv mydomain.key mydomain.pem
>
> I have only one question
> Why didIı need to add this ca file to my freeIPA server? I mean it is
> already sgined with a public CA? web servers can easily see and do not
> throw any error when I install this certificate. but same is not true
> when I install this certificate in IDM or in anyting other than a web
> server.. so why do they not know my CA automaticaly?
>
> is it because this is especially designed for HTTPS connections? Do I
> need to request something different or from another vendor, such as verisgn?

Not every public CA chain is present on all machines.

The chain is installed on the server using ipa-cacert-manage so it can
be distributed to clients with ipa-certupdate.

Your certificate is probably fine, though SHA-1 is deprecated. For more
details see https://en.wikipedia.org/wiki/SHA-1

rob