CERTMONGER(8)

💖 ipa-submit 💖

okay bestie, this one's from the certmonger manual page set (section 8, system manager stuff) and it's literally the little helper that does the IPA talking. let's get into it 🦋

✨ NAME ✨

ipa-submit — the ride-or-die helper that certmonger uses to slide certificate requests over to IPA-based CAs 💅

✨ SYNOPSIS ✨

ipa-submit [-h serverHost] [-H serverURL] [-d domain] [-L ldapurl] [-b basedn] [-c cafile] [-C capath] [[-K] | [-t keytab] [-k submitterPrincipal]] [-u UID] [-W PASSWORD] [-w FILE] [-P principalOfRequest] [-T profile] [-X issuer] [csrfile]

✨ DESCRIPTION ✨

so ipa-submit is the helper that certmonger calls up when it needs to make requests to IPA-based CAs. no cap. it is not normally run interactively — that's not its vibe — but you can run it by hand if you're troubleshooting and need to peek at what's going on 👀

the signing request that's getting submitted? it should either be in a file whose name you hand over as an argument, or you can just feed it into ipa-submit via stdin. either way works, pick your fave 🫶

certmonger also supports retrieving trusted certificates from IPA CAs. for the deets on specifying where those certs should be stored on your local system, go check getcert-request(1) and getcert-resubmit(1). (iykyk, those two are the ones you want.)

and the trusted certificates themselves? they get retrieved from the caCertificate attribute of entries present at and below

cn=cacert,cn=ipa,cn=etc,$BASE

in the IPA LDAP server's directory tree, where $BASE defaults to the value of the basedn setting in /etc/ipa/default.conf. that's the whole lore ✨

✨ OPTIONS ✨

• -P PRINCIPAL, --principal-of-request=PRINCIPAL — names the principal name of the service that the certificate is being issued for. IPA requires this one, so like... it must always be specified. no skipping, bestie 🎀
• -X NAME, --issuer=NAME — asks that the certificate get processed by the specified certificate issuer. by default, if you don't pass this flag and the CERTMONGER_CA_ISSUER variable is set in the environment, then that env variable's value gets used instead. this setting is optional, and — plot twist — if a server returns error 3005, meaning it doesn't understand multiple profiles, the request gets re-submitted without specifying an issuer name.
• -T NAME, --profile=NAME — asks that the certificate get processed using the specified certificate profile. by default, if you don't pass this flag and CERTMONGER_CA_PROFILE is set in the environment, then that env value gets used. optional too, and same energy as above: if a server returns error 3005 (aka "idk what multiple profiles are"), the request is re-submitted without specifying a profile.
• -h HOSTNAME, --host=HOSTNAME — submit the request to the IPA server running on the named host. default is to read the host location from /etc/ipa/default.conf. and if there's no server configured, or the configured server can't be reached, the client will try DNS discovery to locate LDAP servers for the IPA domain. if servers are found, they get searched for entries pointing to IPA masters running the "CA" service, and then the client tries to contact each of those in turn. it's giving determined 💪
• -H URL, --xmlrpc-url=URL — submit the request to the IPA server at the specified location. default is to read the host location from /etc/ipa/default.conf. if no server is configured, or the configured one can't be reached, the client attempts DNS discovery to locate LDAP servers for the IPA domain. if servers turn up, they get searched for entries pointing to IPA masters running the "CA" service, and the client tries to contact each one in turn.
• -L URL, --ldap-url=URL — provides the IPA LDAP service location instead of using DNS discovery. the default is to read the host location from /etc/ipa/default.conf and use DNS discovery to find the set of _ldap._tcp.DOMAIN values, then pick one for use.
• -d DOMAIN, --domain=DOMAIN — use this domain when doing DNS discovery to locate LDAP servers for the IPA installation. default is to read the host location from /etc/ipa/default.conf.
• -b BASEDN, --basedn=BASEDN — use this basedn to search for an IPA installation in LDAP. default is to read the host location from /etc/ipa/default.conf.
• -c FILE, --cafile=FILE — the server's certificate was issued by the CA whose certificate lives in the named file. the default value is /etc/ipa/ca.crt.
• -C PATH, --capath=DIR — trust the server if its certificate was issued by a CA whose certificate is in a file inside the named directory. there is no default for this option, and honestly it's not expected to be necessary.
• -t KEYTAB, --keytab=KEYTAB — authenticate to the IPA server using Kerberos, with credentials derived from keys stored in the named keytab. the default value can vary, but it's usually /etc/krb5.keytab. ⚠️ this option conflicts with the -K, -u, -W, and -w options.
• -k PRINCIPAL, --submitter-principal=PRINCIPAL — authenticate to the IPA server using Kerberos, with credentials derived from keys stored in the named keytab for this principal name. the default value is the host service for the local host in the local realm. ⚠️ this option conflicts with the -K, -u, -W, and -w options.
• -K, --use-ccache-creds — authenticate to the IPA server using Kerberos, with credentials derived from the default credential cache rather than a keytab. ⚠️ this option conflicts with the -k, -u, -W, and -w options.
• -u USERNAME, --uid=USERNAME — authenticate to the IPA server using a user name and password, using the specified value as the user name. ⚠️ this option conflicts with the -k, -K, and -t options.
• -W PASSWORD, --pwd=PASSWORD — authenticate to the IPA server using a user name and password, using the specified value as the password. ⚠️ this option conflicts with the -k, -K, -t, and -w options.
• -w FILE, --pwdfile=FILE — authenticate to the IPA server using a user name and password, reading the password from the specified file. ⚠️ this option conflicts with the -k, -K, -t, and -W options.

ok so lowkey important: all those Kerberos/password auth options are a pick one situation. don't be out here mixing -t and -u, the vibes will not be immaculate 💀

✨ EXIT STATUS ✨

here's the whole mood ring, fr fr:

• 0 — if the certificate was issued. 🎉 the certificate will be printed.
• 1 — if the CA is still thinking. the audacity. a cookie value will be printed.
• 2 — if the CA rejected the request. 😭 an error message may be printed.
• 3 — if the CA was unreachable. an error message may be printed.
• 4 — if critical configuration information is missing. an error message may be printed.
• 17 — if the CA indicates that the client needs to attempt enrollment using a new key pair. 🗝️

✨ FILES ✨

• /etc/ipa/default.conf — is the IPA client configuration file. this file gets consulted to determine the URL for the IPA server's XML-RPC interface. it's the main character of config files here 👑

✨ BUGS ✨

found a bug? please file tickets for any that you find at

https://fedorahosted.org/certmonger/

we're not gatekeeping, we're fixing 🐛💖

✨ SEE ALSO ✨

go read these next, they're all part of the same friend group:

certmonger(8) getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-rekey(1) getcert-remove-ca(1) getcert-request(1) getcert-resubmit(1) getcert-start-tracking(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-ipa-renew-agent-submit(8) certmonger-dogtag-submit(8) certmonger-local-submit(8) certmonger-scep-submit(8) certmonger_selinux(8)

okay that's the whole page bestie, you ate that 💅 this one's from the certmonger manual set, dated April 16, 2015, and it lives in section CERTMONGER(8) — go forth and submit those certs, periodt ✨👑🦋