freeipa/install/share/pki-acme-engine.conf.template

# VERSION 2 - DO NOT REMOVE THIS LINE
# Parameters read by ACMEEngineConfigFileSource, i.e. these are
# expected to be in the file pointed to by the 'filename' directive
# above.
#
# IPA only sets the values it uses.
#
# Whether to enable the ACME service:
enabled=false

# Whether to accept wildcard DNS identifiers:
policy.wildcard=false

baseURL=https://$FQDN/acme
Add versions to the ACME config templates and update on upgrade Put the ACME config files under normal IPA versioning so we can more seamlessly do updates to them. Signed-off-by: Rob Crittenden <rcritten@redhat.com> https://pagure.io/freeipa/issue/8712 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> 2021-02-10 13:54:56 -06:00			`# VERSION 2 - DO NOT REMOVE THIS LINE`
Centralize enable/disable of the ACME service The initial implementation of ACME in dogtag and IPA required that ACME be manually enabled on each CA. dogtag added a REST API that can be access directly or through the `pki acme` CLI tool to enable or disable the service. It also abstracted the database connection and introduced the concept of a realm which defines the DIT for ACME users and groups, the URL and the identity. This is configured in realm.conf. A new group was created, Enterprise ACME Administrators, that controls the users allowed to modify ACME configuration. The IPA RA is added to this group for the ipa-acme-manage tool to authenticate to the API to enable/disable ACME. Related dogtag installation documentation: https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Database.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Realm.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Installing_PKI_ACME_Responder.md ACME REST API: https://github.com/dogtagpki/pki/wiki/PKI-ACME-Enable-REST-API https://pagure.io/freeipa/issue/8524 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Mohammad Rizwan <myusuf@redhat.com> 2020-10-06 14:17:15 -05:00			`# Parameters read by ACMEEngineConfigFileSource, i.e. these are`
			`# expected to be in the file pointed to by the 'filename' directive`
			`# above.`
			`#`
			`# IPA only sets the values it uses.`
			`#`
			`# Whether to enable the ACME service:`
acme: configure engine.conf and disable by default When deploying ACME set up configsources.conf to retrieve engine configuration from engine.conf. In the initial configuration, the ACME service is disabled (i.e. it will refuse to service requests). A subsequent commit will add command(s) for flipping the ACME service on or off (on a per-server basis). Later we will move to LDAP configuration so that management of the ACME service is deployment-wide. The default configuration also disables issuance of wildcard certificates. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com> 2020-05-27 23:45:44 -05:00			`enabled=false`
Centralize enable/disable of the ACME service The initial implementation of ACME in dogtag and IPA required that ACME be manually enabled on each CA. dogtag added a REST API that can be access directly or through the `pki acme` CLI tool to enable or disable the service. It also abstracted the database connection and introduced the concept of a realm which defines the DIT for ACME users and groups, the URL and the identity. This is configured in realm.conf. A new group was created, Enterprise ACME Administrators, that controls the users allowed to modify ACME configuration. The IPA RA is added to this group for the ipa-acme-manage tool to authenticate to the API to enable/disable ACME. Related dogtag installation documentation: https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Database.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Realm.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Installing_PKI_ACME_Responder.md ACME REST API: https://github.com/dogtagpki/pki/wiki/PKI-ACME-Enable-REST-API https://pagure.io/freeipa/issue/8524 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Mohammad Rizwan <myusuf@redhat.com> 2020-10-06 14:17:15 -05:00
			`# Whether to accept wildcard DNS identifiers:`
			`policy.wildcard=false`
Set the ACME baseURL in order to pin a client to a single IPA server ACME uses nonce values to prevent replay attacks. Since the ipa-ca name can go to any of the IPA servers in order to verify the nonce the servers need to know the value that was set which relies on replication. Sometimes the client is faster than replication so a request can fail. This change returns the baseURL to the client as the name of the ACME server during discovery which should pin all requests to this one IPA server and alleviate the replication issue. Signed-off-by: Rob Crittenden <rcritten@redhat.com> https://pagure.io/freeipa/issue/8712 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> 2021-01-28 13:06:52 -06:00
			`baseURL=https://$FQDN/acme`