freeipa/install/share/pki-acme-issuer.conf.template

class=org.dogtagpki.acme.issuer.PKIIssuer
url=https://$FQDN:8443
profile=acmeIPAServerCert
username=$USER
password=$PASSWORD
acme: set up ACME service when configuring CA When configuring the CA, create, configure and deploy the PKI ACME service instance. This includes creation (if necessary) of the LDAP container object heirarchy in which ACME-related objects will be stored. Dogtag ACME RA account management will be added in a subsequent commit, removing the use of the 'uid=admin' account (which as of this commit just has a bogus password). Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com> 2020-02-25 01:56:51 -06:00			`class=org.dogtagpki.acme.issuer.PKIIssuer`
			`url=https://$FQDN:8443`
Centralize enable/disable of the ACME service The initial implementation of ACME in dogtag and IPA required that ACME be manually enabled on each CA. dogtag added a REST API that can be access directly or through the `pki acme` CLI tool to enable or disable the service. It also abstracted the database connection and introduced the concept of a realm which defines the DIT for ACME users and groups, the URL and the identity. This is configured in realm.conf. A new group was created, Enterprise ACME Administrators, that controls the users allowed to modify ACME configuration. The IPA RA is added to this group for the ipa-acme-manage tool to authenticate to the API to enable/disable ACME. Related dogtag installation documentation: https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Database.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Realm.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Installing_PKI_ACME_Responder.md ACME REST API: https://github.com/dogtagpki/pki/wiki/PKI-ACME-Enable-REST-API https://pagure.io/freeipa/issue/8524 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Mohammad Rizwan <myusuf@redhat.com> 2020-10-06 14:17:15 -05:00			`profile=acmeIPAServerCert`
acme: create ACME RA account The ACME certificate profile will require the (Dogtag) user interacting with the CA to be a member of the (Dogtag) "ACME Agents" group. Therefore for each CA server, as part of the ACME setup routine create a dedicated ACME agent account and make it a member of this group. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com> 2020-05-26 22:32:45 -05:00			`username=$USER`
			`password=$PASSWORD`