freeipa/install/share/profiles
Fraser Tweedale 3c8352f9a7 acme: add certificate profile
Add a default certificate profile to be used with the ACME service.

The profile requires the (Dogtag) user interacting with the CA to be
a member of the (Dogtag) "ACME Agents" group.  For each CA server we
create a dedicated ACME agent account, make it a member of this
group, and configure the ACME issuer component to use that account.

Part of: https://pagure.io/freeipa/issue/4751

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-07-10 08:33:22 -04:00
..
acmeServerCert.cfg acme: add certificate profile 2020-07-10 08:33:22 -04:00
caIPAserviceCert.cfg Add CommonNameToSANDefault to default cert profile 2017-06-27 14:25:58 +00:00
caIPAserviceCert.UPGRADE.cfg Restore old version of caIPAserviceCert for upgrade only 2017-08-14 19:25:59 +02:00
IECUserRoles.cfg Add profile for DNP3 / IEC 62351-8 certificates 2015-08-11 14:57:41 +02:00
KDCs_PKINIT_Certs.cfg Configure Anonymous PKINIT on server install 2016-12-12 13:39:44 +01:00
Makefile.am acme: add certificate profile 2020-07-10 08:33:22 -04:00
README Add a README to certificate profile templates directory 2017-06-15 13:55:09 +02:00

This directory contains profile TEMPLATES for certificate profiles
included in FreeIPA.  Do not import these files or modifications
thereof - it is likely that Dogtag will accept the configuration,
but certificate issuance will fail with the updated configuration.
At best, it will not give you the certificates you want.

If you want to modify a profile configuration or create a new
profile based on an existing profile configuration, you should
export the current profile configuration with the command:

    ipa certprofile-show --out FILENAME PROFILE_NAME

After modifying the configuration, update the profile configuration:

    ipa certprofile-mod --file FILENAME PROFILE_NAME

Or if you are creating a new profile:

    ipa certprofile-import --desc DESC --store 1 \
        --file FILENAME NEW_PROFILE_NAME