The --subject argument of ipa-server-install takes RDN in LDAP order ('OU=freeipa, C=US'), not in X.509 order as used by browsers ('C=US, OU=freeipa'). The unexpected order can cause some confusion and break an installation. ipa-server-install --help should mention the order:
--subject
ipa-server-install
ipa-server-install --help
The certificate subject base (default O=<realm-name>). RDNs are in LDAP order (e.g. 'O=REALM, OU=freeipa, C=US').
Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=828866 (Red Hat Enterprise Linux 7)
A commit to resolve this is part of pull request: https://github.com/freeipa/freeipa/pull/245
master:
Metadata Update from @cheimes: - Issue assigned to ftweedal - Issue set to the milestone: FreeIPA 4.5
Login to comment on this ticket.