Chapter 3. Managing externally signed certificates for IdM users, hosts, and services

This chapter describes how to use the Identity Management (IdM) command-line interface (CLI) and the IdM Web UI to add or remove user, host, or service certificates that were issued by an external certificate authority (CA).

3.1. Adding a certificate issued by an external CA to an IdM user, host, or service by using the IdM CLI

As an Identity Management (IdM) administrator, you can add an externally signed certificate to the account of an IdM user, host, or service by using the Identity Management (IdM) CLI.

Prerequisites

  • You have obtained the ticket-granting ticket of an administrative user.

Procedure

  • To add a certificate to an IdM user, enter:

    $ ipa user-add-cert user --certificate=MIQTPrajQAwg...

    The command requires you to specify the following information:

    • The name of the user
    • The Base64-encoded DER certificate
Note

Instead of copying and pasting the certificate contents into the command line, you can convert the certificate to the DER format and then re-encode it to Base64. For example, to add the user_cert.pem certificate to user, enter:

$ ipa user-add-cert user --certificate="$(openssl x509 -outform der -in user_cert.pem | base64 -w 0)"

You can run the ipa user-add-cert command interactively by executing it without adding any options.

To add a certificate to an IdM host, enter:

  • ipa host-add-cert

To add a certificate to an IdM service, enter:

  • ipa service-add-cert

3.2. Adding a certificate issued by an external CA to an IdM user, host, or service by using the IdM Web UI

As an Identity Management (IdM) administrator, you can add an externally signed certificate to the account of an IdM user, host, or service by using the Identity Management (IdM) Web UI.

Prerequisites

  • You are logged in to the Identity Management (IdM) Web UI as an administrative user.

Procedure

  1. Open the Identity tab, and select the Users, Hosts, or Services subtab.
  2. Click the name of the user, host, or service to open its configuration page.
  3. Click Add next to the Certificates entry.

    Figure 3.1. Adding a certificate to a user account

    user add cert
  4. Paste the certificate in Base64 or PEM encoded format into the text field, and click Add.
  5. Click Save to store the changes.

3.3. Removing a certificate issued by an external CA from an IdM user, host, or service account by using the IdM CLI

As an Identity Management (IdM) administrator, you can remove an externally signed certificate from the account of an IdM user, host, or service by using the Identity Management (IdM) CLI .

Prerequisites

  • You have obtained the ticket-granting ticket of an administrative user.

Procedure

  • To remove a certificate from an IdM user, enter:

    $ ipa user-remove-cert user --certificate=MIQTPrajQAwg...

    The command requires you to specify the following information:

    • The name of the user
    • The Base64-encoded DER certificate
Note

Instead of copying and pasting the certificate contents into the command line, you can convert the certificate to the DER format and then re-encode it to Base64. For example, to remove the user_cert.pem certificate from user, enter:

$ ipa user-remove-cert user --certificate="$(openssl x509 -outform der -in user_cert.pem | base64 -w 0)"

You can run the ipa user-remove-cert command interactively by executing it without adding any options.

To remove a certificate from an IdM host, enter:

  • ipa host-remove-cert

To remove a certificate from an IdM service, enter:

  • ipa service-remove-cert

3.4. Removing a certificate issued by an external CA from an IdM user, host, or service account by using the IdM Web UI

As an Identity Management (IdM) administrator, you can remove an externally signed certificate from the account of an IdM user, host, or service by using the Identity Management (IdM) Web UI.

Prerequisites

  • You are logged in to the Identity Management (IdM) Web UI as an administrative user.

Procedure

  1. Open the Identity tab, and select the Users, Hosts, or Services subtab.
  2. Click the name of the user, host, or service to open its configuration page.
  3. Click the Actions next to the certificate to delete, and select Delete.
  4. Click Save to store the changes.

3.5. Additional resources