freeipa

#3757 [RFE] Allow IPA to use either mod_ssl or mod_nss
Closed: fixed Opened by dpal.

Closed: fixed
Reopen Issue

For the new installs we should be able to choose which we will be using mod_nss or mod_ssl. That would allow us to coexist with other applications on the same host. While it is discouraged in production it is very important for POC and pilot deployments to be able to coexist with other applications on the same host.

The issues may be:

  • Where the RA agent cert is stored. It is currently in the mod_nss NSS db? It may be ok to leave it there.
  • Will we allow people to switch back and forth?
  • What config changes are needed in mod_ssl?
  • Knowing which module is being used to tell certmonger what to track.

Metadata Update from @dpal:
- Issue assigned to someone
- Issue set to the milestone: Tickets Deferred

master:

  • 805aea2443c902cd7c5525102701f116b43da575 Use mod_ssl instead of mod_nss for Apache TLS for new installs
  • a0407f75f9b25c265008e907c7f97e2e4b0fa6e8 Remove main function from the certmonger library
  • 5c64e28512be88f597cec0536576dbaba8b92878 Convert ipa-pki-proxy.conf to use mod_ssl directives
  • 4596674481dbbeb9026f0ff793699479e1cfb09d Enable upgrades from a mod_nss-installed master to mod_ssl
  • 5531c9f26b1910ec9f852d5ae0da7ddf078ec8fc Don't backup nss.conf on upgrade with the switch to mod_ssl
  • 4d2c7a4a75a35d19a1ce069b45d3ac2d5ad80376 Add value in set_directive after a commented-out version
  • fa135e6ef123c1ec48463d3389d01363395e2d8e Update smart_card_auth advise script for mod_ssl
  • 7dc923cc4c2ec7c01156589f8314c78439dbc857 mod_ssl migration: fix upload_cacrt.py plugin
  • 205675239a7ecd66ae77b01e90158b5a559b840e httpinstance: handle supplied PKCS#12 files in installation
  • 8789afa18af968032e3f2159a48a6493f6755f47 x509: Remove unused argument of load_certificate_from_file()
  • 60aa2c3b38e1f95c465821484f86657fa696e02b x509: Fix docstring of write_certificate()
  • c85bf376f06cda17305a8723755f3635a3da275a certupdate: don't update HTTPD NSS db
  • 9a7c3159841c10e353861519a1b25bd9b0ef773d Make ipa-server-certinstall store HTTPD cert in a file
  • 92d91ed58be62e50aadeac5396602429a02f711e fixup: add ipa-rewrite.conf to ssl.conf on upgrade
  • 0c388d1e8f9bdadf83c20ee4186470f0eee593a9 service: rename import_ca_certs_ to export_
  • dde62ff883dbd6f13763f789521d37fca125ea6d httpinstance: backup mod_nss conf instead of just removing it
  • 8ea04ab3e3eef431d529c0d99e9d1ea5a65933e1 httpinstance: verify priv key belongs to certificate
  • ee49947b6c258a7cff6fa126f06905f297a3e07b httpinstance: fix publishing of CA cert
  • 1ca68ea7300daa125eb2fec9aa2de2122b3fd95e httpinstance fixup: remove commented-out lines
  • b21941360cdfbcce9fc891befc160103b4678eec Move HTTPD cert/key pair to /var/lib/ipa/certs
  • 75845733f86df5ddeba81d8ce5312be0eb511262 Backup ssl.conf when migrating from mod_nss

Metadata Update from @stlaz:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.7 (was: Tickets Deferred)

master:

  • 3650e3b95560d78b86d863eb759dab815193d527 upgrade: remove fix_trust_flags procedure

master:

  • 7960352f1c3a0982ac87d061b9bef8418c2dae48 Backup HTTPD's mod_ssl config and cert-key pair
Metadata
None
None
None
Normal
enhancement
IPA
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.