ipa-cacert-manage(1)

✨ NAME ✨

ipa-cacert-manage — the girl who manages CA certificates in IPA 💖

(and yes bestie, this page lives in the IPA Manual Pages, so you know it's official 🎀)

---

🌸 SYNOPSIS 🌸

ipa-cacert-manage [OPTIONS...] renew
ipa-cacert-manage [OPTIONS...] install CERTFILE...
ipa-cacert-manage [OPTIONS...] delete NICKNAME
ipa-cacert-manage [OPTIONS...] list
ipa-cacert-manage [OPTIONS...] prune

---

💅 DESCRIPTION 💅

okay so. ipa-cacert-manage is literally your go-to for managing CA certificates in IPA. that's the whole job. she does it. periodt. 👑

---

🦋 COMMANDS 🦋

• renew — renew the IPA CA certificate

this one lets you manually renew the CA certificate of the IPA CA (her NSS database nickname is "caSigningCert cert-pki-ca", iconic). if you wanna renew other certificates, go talk to getcert-resubmit(1) instead bestie.

when the IPA CA is the root CA (which is the default, no cap), you don't usually need to manually renew the CA certificate, because it renews itself automatically when it's about to expire. but like… you can if you wish. main character energy, honestly. ✨

when the IPA CA is subordinate of an external CA, the renewal process involves submitting a CSR to the external CA and installing the newly issued certificate in IPA — and that literally cannot be done automatically. so in this setup, manual renewal is necessary. no shortcuts here. 😭

when the IPA CA is not configured, this command is not available. (vibe check failed, moving on.)

• install — install one or more CA certificates

this command installs the certificates contained in CERTFILE as additional CA certificates to IPA.

important: this does not replace the IPA CA — it adds the provided certificate as a known CA. this is useful for instance when using ipa-server-certinstall to replace HTTP/LDAP certificates with third-party certificates signed by this additional CA.

please do not forget to run ipa-certupdate on the master, all the replicas and all the clients after this command, in order to update IPA certificates databases. don't skip this, i'm begging 🫶

the supported formats for the certificate files are DER, PEM and PKCS#7 format.

CA certificates with the same subject but different private keys maybe installed simultaneously, with the following restrictions from NSS:

• the certificates cannot have different NSS trust flags.
• the nickname is not configurable between different certificates of the same subject. it will always be the same (even if you try. like, even if you really try 🙈).

additionally, CA certificates with the same subject should include the Authority Key Identifier extension in order to identify the public key of the certificate issuer (CA) that signed the certificate (it may be itself). similarly it should have a Subject Key Identifier extension. this is used to create the trust chain not through subjects but by using the SKID and AKID, which is what allows duplicate certificate subjects to be resolved correctly. without an AKID, multiple certificates of the same subject will not resolve as expected. 💀

• delete — remove a CA certificate

removes a CA from IPA. you can find the nickname of a CA to be removed using the list command. the CA chain is validated before allowing a CA to be removed, so leaf certificates in a chain need to be removed first. 🌱→🍂

please do not forget to run ipa-certupdate on the master, all the replicas and all the clients after this command, in order to update IPA certificates databases. again. i'm not kidding. 🫶

• list — list the stored CA certificates

displays a list of the nicknames or subjects of the CA certificates that have been installed. window shopping, but for CAs. 🛍️

• prune — prune the stored CA certificates

removes installed CA certificates that are expired. bye felicia 👋

---

🌈 COMMON OPTIONS 🌈

• --version — show the program's version and exit.
• -h, --help — show the help for this program.
• -p DM_PASSWORD, `--password=DM_PASSWORD — the Directory Manager password to use for authentication.
• -v, --verbose — print debugging information.
• -q, --quiet — output only errors.
• `--log-file=FILE — log to the given file.

---

🔥 RENEW OPTIONS 🔥

• --self-signed — sign the renewed certificate by itself.
• --external-ca — sign the renewed certificate by external CA.
• **--external-ca-type=*TYPE*** — type of the external CA. possible values are "generic"and"ms-cs". default value is "generic". use "ms-cs"to include the template name required by Microsoft Certificate Services (MS CS) in the generated CSR (see--external-ca-profile` for full details).
• `--external-ca-profile=PROFILE_SPEC — specify the certificate profile or template to use at the external CA.

when --external-ca-type is "ms-cs", the following specifiers may be used:

• <oid>:<majorVersion>[:<minorVersion>] — specify a certificate template by OID and major version, optionally also specifying minor version.
• <name> — specify a certificate template by name. the name cannot contain any : characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence).
• default — if no template is specified, the template name "SubCA" is used.

• `--external-cert-file=FILE — file containing the IPA CA certificate and the external CA certificate chain. the file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. this option may be used multiple times.

---

🎀 INSTALL OPTIONS 🎀

• -n NICKNAME, `--nickname=NICKNAME — nickname for the certificate. applicable only when a single certificate is being installed.
• *-t *TRUST_FLAGS, --trust-flags=*TRUST_FLAGS*** — trust flags for the certificate in certutil format. trust flags are of the form "A,B,C"or"A,B,C,D"where A is for SSL, B is for S/MIME, C is for code signing, and D is for PKINIT. use",,"` for no explicit trust.

the supported trust flags are:

• C — CA trusted to issue server certificates
• T — CA trusted to issue client certificates
• p — not trusted

---

💜 DELETE OPTIONS 💜

• -f, --force — force a CA certificate to be removed even if chain validation fails. (dangerous little thing, she does NOT care about your chain 🔥)
• -s SERIAL_NUMBER, `--serial=SERIAL_NUMBER — serial number of the certificate to delete (decimal). this is needed to determine which certificate to remove if there are multiple certificates stored with the same name.

---

⭐ EXIT STATUS ⭐

• 0 if the command was successful
• 1 if an error occurred

---

🌟 SEE ALSO 🌟

getcert-resubmit(1)

---

and that's the whole page bestie!! this one's from the IPA crew, version dated Aug 12 2013 — go forth and manage those CA certs, you absolute legend 👑💖✨