search

freeipa / freeipa-letsencrypt

A quick hack allowing to use Let's Encrypt certificates for FreeIPA web interface.
140 stars 71 forks source link

Altnames and Renewal Window #24

Closed allenconevilla closed 3 years ago

allenconevilla commented 3 years ago

First of all, thank you for taking the time to write and share this with the community. This script is extremely helpful. I do have a couple of questions:

  1. I see reference to subject alternative names in the ipa-httpd.cnf file. Is it possible to add altnames, and if so, what is the correct syntax for doing so?

  2. The standard 2-day check in the renewal script: If I want to change this to a longer value, say 7 days, would I just [ "$diff" -lt "2" ] to [ "$diff" -lt "7" ]?

Thanks again.

rcritten commented 3 years ago
  1. See x509v3_config(5) for details on subjectaltname config. For multiple entries you need to do something like:
subjectAltName = @alt_names

[alt_names]
DNS.1 = ipa.example.com
DNS.2 = wwwl.example.com
  1. Yes but don't confuse this with an expiration check. It requires that the cert be at least two days old before trying to renew.
allenconevilla commented 3 years ago

Got it. I had indeed misunderstood the experation check. Thanks!