This would require creating a server cert during the install.
Can you provide more details on the requirements?
We already issue a server certificate when a host is enrolled. It is installed into /etc/pki/nssdb with the nickname Server-Cert. It is managed by certmonger.
Sumit will provide the writeup of the whole feature. See also ticket https://fedorahosted.org/sssd/ticket/237
The idea is that we should use FAST both for the user authentication and host authentication. For the user authentication the host TGT is uses to establish the channel. For the host authentication the anonymous PKINIT should be used to create TGT to establish the FAST channel. The anonymous PKINIT requires cert. It might all just work out of box. But we need to make sure it does.
Very cool feature. A lot of value but can be deferred...
this is actually a duplicate of #55
Metadata Update from @dpal: - Issue assigned to simo - Issue set to the milestone: Tickets Deferred
Login to comment on this ticket.