mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
867f7691e9
Modify the default IPA CA certificate profile to include CRL and OCSP extensions which will add URIs to IPA CRL&OCSP to published certificates. Both CRL and OCSP extensions have 2 URIs, one pointing directly to the IPA CA which published the certificate and one to a new CNAME ipa-ca.$DOMAIN which was introduced as a general CNAME pointing to all IPA replicas which have CA configured. The new CNAME is added either during new IPA server/replica/CA installation or during upgrade. https://fedorahosted.org/freeipa/ticket/3074 https://fedorahosted.org/freeipa/ticket/1431
30 lines
649 B
Plaintext
30 lines
649 B
Plaintext
$$ORIGIN $DOMAIN.
|
|
$$TTL 86400
|
|
@ IN SOA $DOMAIN. $ZONEMGR. (
|
|
01 ; serial
|
|
3H ; refresh
|
|
15M ; retry
|
|
1W ; expiry
|
|
1D ) ; minimum
|
|
|
|
IN NS $HOST
|
|
$HOST IN A $IP
|
|
;
|
|
; ldap servers
|
|
_ldap._tcp IN SRV 0 100 389 $HOST
|
|
|
|
;kerberos realm
|
|
_kerberos IN TXT $REALM
|
|
|
|
; kerberos servers
|
|
_kerberos._tcp IN SRV 0 100 88 $HOST
|
|
_kerberos._udp IN SRV 0 100 88 $HOST
|
|
_kerberos-master._tcp IN SRV 0 100 88 $HOST
|
|
_kerberos-master._udp IN SRV 0 100 88 $HOST
|
|
_kpasswd._tcp IN SRV 0 100 464 $HOST
|
|
_kpasswd._udp IN SRV 0 100 464 $HOST
|
|
$OPTIONAL_NTP
|
|
|
|
; CNAME for IPA CA replicas (used for CRL, OCSP)
|
|
$IPA_CA_CNAME IN CNAME $HOST
|