如何查找 FreeIPA 默认安装的.crt 文件？

Question

Use this guide installed FreeIPA with SSL: https://www.howtoforge.com/how-to-install-freeipa-server-on-centos-7/

yum install ipa-server bind-dyndb-ldap ipa-server-dns -y
ipa-server-install --setup-dns

After finish it, it can be accessed by https://ipa.hakase-labs.io/ .

There are two files generated on the /root/ path:

• ca-agent.p12
• cacert.p12

If use a self-prepared CA file, we can know where the.crt file is. And set it to a client server in order to connect to the LDAP(FreeIPA) server.

But where is it by the default way?

Answer 1

I don't see how this question is related to programming, maybe move it to ServerFault.

And it's not clear what you want to do exactly. You don't want to install an embedded CA within the IPA Server, but it's unclear if you're going to use an external CA or no CA at all. In the first case this means the IPA Server would still automatically update the certificates, while the second case means you would update yourself when it is necessary.

The best entry point is the Linux Domain Identity, Authentication, and Policy Guide

If you're not going to use any CA at all, see section 2.3.6:

# ipa-server-install \
    --http-cert-file /tmp/server.crt \
    --http-cert-file /tmp/server.key \
    --http-pin secret \
    --dirsrv-cert-file /tmp/server.crt \
    --dirsrv-cert-file /tmp/server.key \
    --dirsrv-pin secret \
    --ca-cert-file ca.crt