From 4d5b5a9024c1237cb128688c7c4ac796135d50d5 Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Mon, 3 Feb 2020 11:13:32 +1100 Subject: [PATCH] httpinstance: add ipa-ca.$DOMAIN alias in initial request For detailed discussion on the purpose of this change and the design decisions made, see `git log -1 $THIS_COMMIT~2`. For new server/replica installation, issue the HTTP server certificate with the 'ipa-ca.$DOMAIN' SAN dNSName. This is accomplished by adding the name to the Certmonger tracking request. Part of: https://pagure.io/freeipa/issue/8186 Reviewed-By: Rob Crittenden --- ipaserver/install/httpinstance.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py index 6c7365d9b..9cc5c920f 100644 --- a/ipaserver/install/httpinstance.py +++ b/ipaserver/install/httpinstance.py @@ -381,7 +381,7 @@ class HTTPInstance(service.Service): subject=str(DN(('CN', self.fqdn), self.subject_base)), ca='IPA', profile=dogtag.DEFAULT_PROFILE, - dns=[self.fqdn], + dns=[self.fqdn, f'{IPA_CA_RECORD}.{api.env.domain}'], post_command='restart_httpd', storage='FILE', passwd_fname=key_passwd_file,