ipa-ca-install(1)

💖 NAME 💖

ipa-ca-install — bestie, it installs a CA on a server. that's it, that's the whole thing ✨

---

✨ SYNOPSIS ✨

ipa-ca-install [OPTION]...

---

🌸 DESCRIPTION 🌸

okay so here's the tea: this bad boy adds a CA as an IPA-managed service. but — and this is important — it requires that the IPA server is already installed and configured. no server, no CA, no slay. 🙈

ipa-ca-install can also be used to upgrade from CA-less to CA-full, or to install the CA service on a replica. glow-up energy fr fr 💅

⚠️ Domain level 0 is not supported anymore. like, at all. periodt. 💀

---

🎀 OPTIONS 🎀

• -d, --debug — turn on debug logging when you need more verbose output (aka when you're nosy and want the receipts 🕵️♀️)
• -p DM_PASSWORD, --password=DM_PASSWORD — the Directory Manager (existing master) password
• -w ADMIN_PASSWORD, --admin-password=ADMIN_PASSWORD — the Admin user Kerberos password, used for the connection check
• --external-ca — generate a CSR so the IPA CA certificate gets signed by an external CA
• --external-ca-type=TYPE — the type of the external CA. Possible values are "generic" and "ms-cs". Default value is "generic". use "ms-cs" to include the template name that Microsoft Certificate Services (MS CS) needs in the generated CSR (peep --external-ca-profile for the full deets)
• --external-ca-profile=PROFILE_SPEC — specify the certificate profile or template to use at the external CA.

when --external-ca-type is "ms-cs", these specifiers are available to you:

• <oid>:<majorVersion>[:<minorVersion>] — specify a certificate template by OID and major version, and optionally also specify the minor version.
• <name> — specify a certificate template by name. The name cannot contain any : characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence, no cap).
• default — if no template is specified, the template name "SubCA" is used.

• --external-cert-file=FILE — a file containing the IPA CA certificate and the external CA certificate chain. accepted in PEM and DER certificate formats and PKCS#7 certificate chain formats. this option may be used multiple times 👑
• --ca-subject=SUBJECT — the CA certificate subject DN (default CN=Certificate Authority,O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
• --subject-base=SUBJECT — the subject base for certificates issued by IPA (default O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
• --pki-config-override=FILE — a file containing overrides for CA installation
• --ca-signing-algorithm=ALGORITHM — the signing algorithm of the IPA CA certificate. Possible values are SHA1withRSA, SHA256withRSA, SHA384withRSA, SHA512withRSA. Default value is SHA256withRSA. use this option with --external-ca if the external CA doesn't support the default signing algorithm
• --no-host-dns — don't use DNS for hostname lookup during installation
• --random-serial-numbers — enable Random Serial Numbers (RSN) and certificate pruning. this option is enabled by default if the system is installed with a 389-ds version that supports LMDB, or if another CA in the topology is configured with Random Serial Numbers. it remains present to avoid issues with automation. in mixed environments where existing CA servers are configured with sequential numbers, it is recommended to replace the sequential servers as soon as reasonably possible.
• --token-name=TOKEN_NAME — the PKCS#11 token name, if you're using an HSM to store and generate private keys 🔐
• --token-library-path=TOKEN_LIBRARY_PATH — the full path to the PKCS#11 shared library needed to access the HSM device
• --token-password=TOKEN_PASSWORD — the PKCS#11 token password for the HSM
• --token-password-file=TOKEN_PASSWORD_FILE — the full path to a file containing the PKCS#11 token password
• --skip-conncheck — skip the connection check to the remote master
• --skip-schema-check — skip the check for updated CA DS schema on the remote master
• -U, --unattended — an unattended installation that will never prompt for user input. she's independent, she doesn't need you 🦋

---

💅 EXIT STATUS 💅

• 0 — if the command was successful 🎉 (ate, no crumbs)
• 1 — if an error occurred 😭 (it's giving not slay)

---

okay bestie, that's the whole page, and honestly? iconic. this manual is from the IPA manual collection, dated Mar 30 2017, and it lives under the name ipa-ca-install(1). go forth and install that CA. i believe in you. mwah 💖✨🎀🦋🌸