freeipa

#4751 Implement ACME certificate enrolment
Closed: fixed by rcritten. Opened by ftweedal.

Closed: fixed
Reopen Issue

The Automatic Certificate Management Environment (ACME) protocol has been
proposed by the letsencrypt initiative as a standard protocol for domain
validation and certificate issuance. The overview from the spec[1]:

ACME allows a client to request certificate management actions using
a set of JSON messages carried over HTTPS. It is a prerequisite for
this process that the client be configured with the HTTPS URI for the
server. ACME messages MUST NOT be carried over "plain" HTTP, without
HTTPS semantics.

[1] https://raw.githubusercontent.com/letsencrypt/acme-spec/master/draft-barnes-acme.txt

If this initiative gains traction, FreeIPA (and/or Dogtag) should provide an
ACME server for certificate issuance. Which challenge types it makes sense
to support will need to be investigated.

This initiative already gained huge traction and is entering public beta today. The first thing I was checking for is if there's FreeIPA support. Will help with testing.

Related to #5431

Replying to [comment:3 rmarko]:

This initiative already gained huge traction and is entering public beta today. The first thing I was checking for is if there's FreeIPA support. Will help with testing.

rmarko: this ticket for implementing ACME enrolment to the IPA CA, not enrolment under Let's Encrypt CA.
Please outline your expectations for getting certificates from Let's Encrypt CA in #5431.

Metadata Update from @ftweedal:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5 backlog

Metadata Update from @ftweedal:
- Issue assigned to ftweedal (was: someone)
- Issue close_status updated to: None
- Issue set to the milestone: None (was: FreeIPA 4.5 backlog)

Metadata Update from @ftweedal:
- Issue marked as depending on: #8186

Created and linked ticket https://pagure.io/freeipa/issue/8186 for the "add ipa-ca.$DOMAIN dnsname to IPA server HTTP certs" part.

master:

  • 0711c4a0d45f9e28459596552ca751890b13c265 certmonger: avoid mutable default argument
  • e0fb3816f656dc4b324fc02c8d4506dadcfe544e certmonger: move 'criteria' description to module docstring
  • 18ebd1116d706d9f2a3a9c2dca16681a4f138362 certmonger: support dnsname as request search criterion
  • 4cf9c8689fc4a791eee17e0cfcb38e837a53b3f0 httpinstance: add fqdn and ipa-ca alias to Certmonger request
  • f7c45641fe356364175899399b51b07987b44a1b cert-request: allow ipa-ca.$DOMAIN dNSName for IPA servers
  • 4d5b5a9024c1237cb128688c7c4ac796135d50d5 httpinstance: add ipa-ca.$DOMAIN alias in initial request
  • cf4c2c64b0bb1e4555a48bc5079aeff101fd9894 upgrade: add ipa-ca.$DOMAIN alias to HTTP certificate
  • 45b5384b6ef83aaf742bf7906d846e07db874ef8 (HEAD) ipatests: check HTTP certificate contains ipa-ca.$DOMAIN dnsname

ipa-4-8:

  • 0e9b7773fb613889eacaa95504f1c40f21628c0f certmonger: avoid mutable default argument
  • ff7d0661a71ff2c9a66c8c9a1a48837d041f9099 certmonger: move 'criteria' description to module docstring
  • b127bad8a93967c09c24edadd31d7d6e5b812186 certmonger: support dnsname as request search criterion
  • 52873581e7ab1de8c02a4d80cdeeb9bf27b2f168 httpinstance: add fqdn and ipa-ca alias to Certmonger request
  • 4b24129f9e1ceb322c5477f9a0869f7a6b521f09 cert-request: allow ipa-ca.$DOMAIN dNSName for IPA servers
  • 5275342b691b2f74b365cb3422459779544be16a httpinstance: add ipa-ca.$DOMAIN alias in initial request
  • c445cefacf7713746f0bb0399d33b3f4008b71b4 upgrade: add ipa-ca.$DOMAIN alias to HTTP certificate
  • 8e92190db866e7eb05aaaf41609b442f201d5c08 ipatests: check HTTP certificate contains ipa-ca.$DOMAIN dnsname

Metadata Update from @ftweedal:
- Custom field design adjusted to https://www.freeipa.org/page/V4/ACME
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/4723 (was: 0)
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1851835 (was: todo)

Documentation available at:

https://frasertweedale.github.io/blog-redhat/posts/2020-05-06-ipa-acme-intro.html
https://frasertweedale.github.io/blog-redhat/posts/2020-05-07-ipa-acme-mod_md.html
https://frasertweedale.github.io/blog-redhat/posts/2020-05-13-ipa-acme-dns.html

master:

  • 2b6faa362f3ee2a63e3597f8734867d8e9d4df7d acme: ipa-pki-proxy: proxy /acme to Dogtag
  • dd301a453521a177d9f34df25d3e6d203c9507ea acme: set up ACME service when configuring CA
  • 5883cff0b7b62da3fcb3dfb7920a9f993cbcb568 dogtaginstance: extract user creation to subroutine.
  • a21823da7fcce521838764df5280295ccbdb8157 dogtaginstance: add ensure_group method
  • b3565290fefb6e14583b50d3c411a8861a4fa844 acme: create ACME RA account
  • c309d4a4d0c19df80808b2ce9352ce2af2a30a3c acme: add Dogtag ACL to allow ACME agents to revoke certs
  • 3c8352f9a7f977bc994e4b5b558fb3c7db20f40e acme: add certificate profile
  • d15000bed6bc5262a80aadeb5f85a476ed44799f acme: configure ACME service on upgrade
  • 00a84464eae31150714f667df67774ebe34b8514 acme: configure engine.conf and disable by default
  • 083c6aedc6d8046c19f637ec34723812f292a0e9 acme: add ipa-acme-manage command
  • 7b00035764197c0aff0c7d2de638dc174abacf9f acme: add integration test
  • ab7226dcef8c8390fc9a1e939680ba9f4f5121bd acme: add integration test to nightly CI
  • bb6d84903967bc6176d8a0817b602ba314129417 acme: add integration tests to gating
  • 85d0272053dbafab19c1f98cacc5ce6e1a828667 acme: add mod_md integration test
  • f9f3b3b118ccb0c4052d15387d128886ec293463 acme: handle alternative schema ldif location
  • e976dde8e1429ee023a76ddbe0e6b16a495a1ef2 acme: add revocation test
  • a83eaa8b6da8e5937a7f42a90310f69b8f66e6d4 acme: add certbot dns script
  • 678b8e682b37daa5217c0098cd6ce42c324b3955 acme: add certbot dns-01 test
  • 525b946b75760a1ef90e1aae8e5052124fb0075c acme: enable mod_md tests on Fedora
  • 1f720560273e16ca6c5e646a1f4bf0a7ec354aa5 acme: delete ACME RA account on server uninstall

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Created a separate ticket for deployment-wide (replicated) configuration of ACME service: https://pagure.io/freeipa/issue/8410 .

master:

  • 9dccf17a6c6ce023661a33fdb1f65314ef6a053f External-CA scenarios for ACME service
  • cbbfcd9b1e9bbcce864957423085d362e6d44c72 PEP8 fixes for test_acme.py
  • c4a6b0e5662f539b8438cdbc593eb713ea8c6da2 Move acme client installation part to classmethod

Metadata Update from @rcritten:
- Custom field changelog adjusted to Configure the Automatic Certificate Management Environment (ACME) protocol support provided by the dogtag CA.

master:

  • d2ca7915498cd1bdf5483af4b155296766f6e718 ipatests: Test if ACME renews the issued cert with cerbot

ipa-4-9:

  • a7ff4089437ee20bbce7fc55d43a7702dd7540a7 ipatests: Test if ACME renews the issued cert with cerbot
Metadata
None
None
None
Normal
enhancement
Certificate management
https://github.com/freeipa/freeipa/pull/4723
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.