94 lines
3.9 KiB
Groff
94 lines
3.9 KiB
Groff
.\" A man page for ipa-ca-install
|
|
.\" Copyright (C) 2011-2017 Red Hat, Inc.
|
|
.\"
|
|
.\" This program is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the GNU General Public License as published by
|
|
.\" the Free Software Foundation, either version 3 of the License, or
|
|
.\" (at your option) any later version.
|
|
.\"
|
|
.\" This program is distributed in the hope that it will be useful, but
|
|
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
.\" General Public License for more details.
|
|
.\"
|
|
.\" You should have received a copy of the GNU General Public License
|
|
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
.\"
|
|
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
|
.\"
|
|
.TH "ipa-ca-install" "1" "Mar 30 2017" "FreeIPA" "FreeIPA Manual Pages"
|
|
.SH "NAME"
|
|
ipa\-ca\-install \- Install a CA on a server
|
|
.SH "SYNOPSIS"
|
|
.TP
|
|
ipa\-ca\-install [\fIOPTION\fR]...
|
|
.SH "DESCRIPTION"
|
|
Adds a CA as an IPA\-managed service. This requires that the IPA server is already installed and configured.
|
|
|
|
ipa\-ca\-install can be used to upgrade from CA-less to CA-full or to install the CA service on a replica.
|
|
|
|
Domain level 0 is not supported anymore.
|
|
|
|
.SH "OPTIONS"
|
|
\fB\-d\fR, \fB\-\-debug\fR
|
|
Enable debug logging when more verbose output is needed
|
|
.TP
|
|
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
|
|
Directory Manager (existing master) password
|
|
.TP
|
|
\fB\-w\fR \fIADMIN_PASSWORD\fR, \fB\-\-admin\-password\fR=\fIADMIN_PASSWORD\fR
|
|
Admin user Kerberos password used for connection check
|
|
.TP
|
|
\fB\-\-external\-ca\fR
|
|
Generate a CSR for the IPA CA certificate to be signed by an external CA.
|
|
.TP
|
|
\fB\-\-external\-ca\-type\fR=\fITYPE\fR
|
|
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include the template name required by Microsoft Certificate Services (MS CS) in the generated CSR (see \fB\-\-external\-ca\-profile\fR for full details).
|
|
|
|
.TP
|
|
\fB\-\-external\-ca\-profile\fR=\fIPROFILE_SPEC\fR
|
|
Specify the certificate profile or template to use at the external CA.
|
|
|
|
When \fB\-\-external\-ca\-type\fR is "ms-cs" the following specifiers may be used:
|
|
|
|
.RS
|
|
.TP
|
|
\fB<oid>:<majorVersion>[:<minorVersion>]\fR
|
|
Specify a certificate template by OID and major version, optionally also specifying minor version.
|
|
.TP
|
|
\fB<name>\fR
|
|
Specify a certificate template by name. The name cannot contain any \fI:\fR characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence).
|
|
.TP
|
|
\fBdefault\fR
|
|
If no template is specified, the template name "SubCA" is used.
|
|
.RE
|
|
|
|
.TP
|
|
\fB\-\-external\-cert\-file\fR=\fIFILE\fR
|
|
File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
|
|
.TP
|
|
\fB\-\-ca\-subject\fR=\fISUBJECT\fR
|
|
The CA certificate subject DN (default CN=Certificate Authority,O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
|
|
.TP
|
|
\fB\-\-subject\-base\fR=\fISUBJECT\fR
|
|
The subject base for certificates issued by IPA (default O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
|
|
.TP
|
|
\fB\-\-ca\-signing\-algorithm\fR=\fIALGORITHM\fR
|
|
Signing algorithm of the IPA CA certificate. Possible values are SHA1withRSA, SHA256withRSA, SHA512withRSA. Default value is SHA256withRSA. Use this option with --external-ca if the external CA does not support the default signing algorithm.
|
|
.TP
|
|
\fB\-\-no\-host\-dns\fR
|
|
Do not use DNS for hostname lookup during installation
|
|
.TP
|
|
\fB\-\-skip\-conncheck\fR
|
|
Skip connection check to remote master
|
|
.TP
|
|
\fB\-\-skip\-schema\-check\fR
|
|
Skip check for updated CA DS schema on the remote master
|
|
.TP
|
|
\fB\-U\fR, \fB\-\-unattended\fR
|
|
An unattended installation that will never prompt for user input
|
|
.SH "EXIT STATUS"
|
|
0 if the command was successful
|
|
|
|
1 if an error occurred
|