[Freeipa-users] Options for existing CA/DNS infrastructure

[Rob Foehl]

I'm looking at deploying FreeIPA in a few environments with substantial
DNS and/or CA infrastructure, and have some choices to make...

How much trouble will I have if FreeIPA is delegated a zone like
ipa.example.com with all clients in example.com or other children? (No
overlap with AD-managed zones, but in at least one case autodiscovery
won't be possible due to mixed clients in the parent zone.)

What's the best way to play nice with existing PKI -- generate a CA CSR at
installation time and sign that? Is there any provision for automatically
renewing these certs, say if the external CA were to be subsumed by a
dedicated Dogtag instance?

Advice and experience appreciated, before I paint myself into a corner
somewhere... Thanks!

-Rob

[Rob Foehl]

Post by Rob Foehl
What's the best way to play nice with existing PKI -- generate a CA CSR at
installation time and sign that? Is there any provision for automatically
renewing these certs, say if the external CA were to be subsumed by a
dedicated Dogtag instance?

I'm guessing the complete lack of a response does not bode well for this
idea...

Ideally, I'd rather not manage an external CA at all; existing use cases
are service certificates and a handful of user or device-specific client
certs. I've been digging into the sub-CA support a bit more, and it might
be possible to cover everything within FreeIPA, possibly adding
otherwise-unused principals as needed.

The lingering question, then: what to do with the existing CA?

I've found a few threads suggesting it may be possible to wedge an
existing cert/key into a new IPA instance at install time, but they're all
light on specifics. Any other ideas for a smooth transition from this CA
to one entirely owned by FreeIPA, maybe within 3 years or so? ;)

-Rob

[David Kupka]

I'm looking at deploying FreeIPA in a few environments with substantial DNS
and/or CA infrastructure, and have some choices to make...
How much trouble will I have if FreeIPA is delegated a zone like
ipa.example.com with all clients in example.com or other children? (No
overlap with AD-managed zones, but in at least one case autodiscovery won't
be possible due to mixed clients in the parent zone.)
What's the best way to play nice with existing PKI -- generate a CA CSR at
installation time and sign that? Is there any provision for automatically
renewing these certs, say if the external CA were to be subsumed by a
dedicated Dogtag instance?
Advice and experience appreciated, before I paint myself into a corner
somewhere... Thanks!
-Rob
--
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Hello Rob,
FreeIPA can be deployed in environment with existing DNS and/or CA server.
IIRC you have following options:
- regarding DNS:
-- Delegate DNS zone for FreeIPA. It will then manage the zone and add records
there. Obviously, it will not add records for clients in other zones.

-- Don't setup DNS in FreeIPA and keep managing all records in your current DNS
server. There's plan to integrate with external DNS servers [1] but nothing was
done yet.

- regarding CA:
-- install CA-less FreeIPA - you need to issue certificates for HTTPD and 389-DS
with your certificate server and provide those when installing FreeIPA server

-- install FreeIPA with CA certificate signed with external CA. Use
--external-ca option. The installation will be interupted to let you sign
generated CSR. FreeIPA will then issue all needed certificates.

-- install FreeIPA with self-signed CA certificate. This is default but then
you need to distribute the certificate to all clients.

Certmonger [2] is configured during ipa-server-install to track and renew
certificates.

[1] https://www.freeipa.org/page/V4/External_DNS_integration_with_installer
[2] https://pagure.io/certmonger

[Rob Foehl]

Post by David Kupka
FreeIPA can be deployed in environment with existing DNS and/or CA server.

None of the documentation I've managed to find thus far addresses the
general question of which option(s) to choose, and why; in particular, the
"Deployment Recommendations" page just presents the options without
actually recommending one over another. What's missing is how they behave
in the real world, and which tradeoffs cause the least trouble.

Maybe that question is too general... Here's a few specifics that fell
out of a bunch of experimentation:

Is there any utility in installing DNS and delegating a zone to FreeIPA if
none of the clients will live in that zone?

Is there any current or planned method for absorbing an existing CA cert
into a (newly) FreeIPA-installed Dogtag instance that'd allow for
continued issuance of a variety of client and service certs from FreeIPA,
without having to manage an external CA?

-Rob