PKI Certificates - dogtagpki/freeipa GitHub Wiki

PKI Server Certificates

In IPA environment PKI server certificates are stored in an NSS database at /etc/pki/pki-tomcat/alias and the password for the NSS database is stored at /etc/pki/pki-tomcat/alias/pwdfile.txt.

The CA certificates are also stored at /root/cacert.p12. The KRA certificates are also stored at /root/kracert.p12.

To display PKI server certificates:

$ pki-server cert-find
  Cert ID: ca_signing
  Nickname: caSigningCert cert-pki-ca
  Token: internal
  Serial Number: 0x1
  Subject DN: CN=Certificate Authority,O=EXAMPLE.COM
  Issuer DN: CN=Certificate Authority,O=EXAMPLE.COM
  Not Valid Before: Tue Jun 14 18:26:28 2022
  Not Valid After: Sat Jun 14 18:26:28 2042
  Trust Flags: CTu,Cu,Cu

  Cert ID: ca_ocsp_signing
  Nickname: ocspSigningCert cert-pki-ca
  Token: internal
  Serial Number: 0x2
  Subject DN: CN=OCSP Subsystem,O=EXAMPLE.COM
  Issuer DN: CN=Certificate Authority,O=EXAMPLE.COM
  Not Valid Before: Tue Jun 14 18:26:33 2022
  Not Valid After: Mon Jun 03 18:26:33 2024
  Trust Flags: u,u,u

  Cert ID: sslserver
  Nickname: Server-Cert cert-pki-ca
  Token: internal
  Serial Number: 0x3
  Subject DN: CN=ipa.example.com,O=EXAMPLE.COM
  Issuer DN: CN=Certificate Authority,O=EXAMPLE.COM
  Not Valid Before: Tue Jun 14 18:26:38 2022
  Not Valid After: Mon Jun 03 18:26:38 2024
  Trust Flags: u,u,u

  Cert ID: subsystem
  Nickname: subsystemCert cert-pki-ca
  Token: internal
  Serial Number: 0x4
  Subject DN: CN=CA Subsystem,O=EXAMPLE.COM
  Issuer DN: CN=Certificate Authority,O=EXAMPLE.COM
  Not Valid Before: Tue Jun 14 18:26:43 2022
  Not Valid After: Mon Jun 03 18:26:43 2024
  Trust Flags: u,u,u

  Cert ID: ca_audit_signing
  Nickname: auditSigningCert cert-pki-ca
  Token: internal
  Serial Number: 0x5
  Subject DN: CN=CA Audit,O=EXAMPLE.COM
  Issuer DN: CN=Certificate Authority,O=EXAMPLE.COM
  Not Valid Before: Tue Jun 14 18:26:49 2022
  Not Valid After: Mon Jun 03 18:26:49 2024
  Trust Flags: u,u,Pu

CA Admin Certificate

In IPA environment the CA admin certificate is stored in /root/.dogtag/pki-tomcat/ca_admin.cert. The certificate and key are also stored at /root/ca-agent.p12.

To display the CA admin certificate:

$ openssl x509 -text -noout -in /root/.dogtag/pki-tomcat/ca_admin.cert
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6 (0x6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = EXAMPLE.COM, CN = Certificate Authority
        Validity
            Not Before: Jun 13 21:11:38 2022 GMT
            Not After : Jun  2 21:11:38 2024 GMT
        Subject: O = EXAMPLE.COM, CN = ipa-ca-agent
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a1:a8:7c:3a:16:85:66:6b:ca:67:98:36:6e:c0:
                    a1:0a:56:77:a8:e1:1f:e0:16:04:f2:a3:24:0a:dd:
                    4c:a6:a7:3e:6a:ef:4b:41:0c:b9:91:e7:2f:5a:93:
                    15:0e:96:c9:cc:21:2d:40:d4:c7:9b:21:0c:04:2b:
                    5c:ba:b0:b7:d3:5c:27:25:ce:fc:88:53:88:08:16:
                    6d:ae:83:a2:98:91:6f:01:80:27:78:9d:90:4a:dc:
                    20:23:be:4d:b7:60:f9:9e:93:42:94:31:b8:e6:cc:
                    07:95:50:d7:44:c0:0d:2c:bd:67:2e:24:59:24:58:
                    97:e3:fa:37:7c:71:12:91:db:a7:24:8f:17:e8:5f:
                    90:f5:e3:39:25:75:71:c5:97:ac:27:1a:c0:16:4c:
                    71:69:a4:bf:bf:f7:d9:23:13:df:9b:97:40:85:e1:
                    2a:0f:ff:bb:8a:2a:9e:9e:2c:da:4d:c2:17:01:e5:
                    d1:82:1e:f5:49:90:ab:cd:dd:03:df:10:c8:50:0e:
                    49:28:a3:13:fa:50:a6:ac:0f:ed:f7:14:c6:4b:d5:
                    03:53:3e:42:eb:49:05:65:1d:17:0a:c4:39:1d:7f:
                    7f:d5:7f:b1:90:b0:0d:fb:1a:9a:94:cc:f2:74:79:
                    0b:38:b1:1b:9b:82:bf:d6:96:62:ca:7d:b7:75:9d:
                    43:7b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B9:A2:91:05:0B:E5:DD:00:2E:1A:64:DD:26:DC:D3:A1:43:DA:8C:C3
            Authority Information Access:
                OCSP - URI:http://ipa-ca.example.com/ca/ocsp
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        84:8c:9a:b2:a2:35:3e:0a:13:c3:e5:60:b4:94:bf:67:2a:6e:
        12:f3:65:1b:f3:4e:a9:3c:83:80:5a:e2:17:b9:22:f2:4d:67:
        c4:ce:95:26:19:ef:00:b2:05:33:d3:ae:f7:d3:88:9d:d2:ea:
        30:28:67:fa:a5:0d:4c:15:df:f0:73:6f:34:d6:92:64:2c:e9:
        6b:27:2d:31:cd:18:d4:34:be:13:24:73:a6:0a:d9:dc:f8:3d:
        72:9f:87:e7:5f:cf:60:a1:a1:48:74:a0:68:b8:33:7f:81:28:
        37:42:f1:55:85:44:3e:e1:f1:bf:3a:3b:91:c8:03:01:9b:46:
        50:18:33:d1:0a:92:18:85:90:99:7d:ed:c7:ac:a1:07:e4:31:
        4a:77:09:d6:0c:b7:4d:14:6c:2d:77:f1:15:f6:39:3e:7d:c4:
        8e:62:d2:a8:46:9a:4c:a6:e9:c2:53:0d:81:8c:ba:be:ac:66:
        c6:a1:8f:94:33:09:c8:40:a9:f0:78:ae:14:17:c7:0b:76:47:
        b0:df:90:fa:60:d2:b0:d1:27:6a:9b:f3:c8:62:87:c0:92:f9:
        75:c2:70:23:61:44:48:e6:a3:ea:f5:e0:c8:ce:e3:b7:1b:17:
        22:b7:22:ec:c3:ac:59:d1:93:ef:67:fa:ae:b6:a7:02:5a:d7:
        f3:7f:10:0a:d3:7b:aa:6c:fc:80:50:c4:d0:b8:d7:08:94:98:
        f6:07:c1:6a:02:c4:18:77:2a:2a:37:0d:0c:5b:ad:9d:04:be:
        1c:44:79:cd:92:0e:35:08:53:ab:e7:63:cc:d0:98:6b:ed:fa:
        8a:4e:c8:6e:71:23:e4:6e:44:61:e9:94:f3:2d:12:3c:60:29:
        9b:b3:6f:e8:62:0d:1f:ab:e9:62:67:c5:fc:e3:5c:31:73:51:
        80:35:01:19:a6:b0:9b:9a:9c:d9:0e:19:89:ec:de:c5:6b:12:
        7c:cf:c0:c4:ce:23:5a:6e:a9:77:5b:2c:5f:d9:1f:7f:da:fe:
        1b:0c:0b:ca:48:a4

RA Agent Certificate

In IPA environment the RA agent certificate is stored at /var/lib/ipa/ra-agent.pem and the key are stored at /var/lib/ipa/ra-agent.key.

To display the RA agent certificate:

$ openssl x509 -text -noout -in /var/lib/ipa/ra-agent.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7 (0x7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = EXAMPLE.COM, CN = Certificate Authority
        Validity
            Not Before: Jun 13 21:12:42 2022 GMT
            Not After : Jun  2 21:12:42 2024 GMT
        Subject: O = EXAMPLE.COM, CN = IPA RA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c4:94:2e:e7:1b:81:5b:aa:58:47:df:c3:27:14:
                    99:7f:61:6e:74:72:33:39:52:d3:15:d5:1d:83:6e:
                    99:79:c1:f9:ef:d5:a6:99:0d:e7:f8:aa:60:a0:8a:
                    39:19:f0:d9:c5:cd:87:fb:96:a9:15:9e:fe:1f:07:
                    51:e0:d3:0b:76:bc:0c:05:02:6b:16:27:e6:fb:67:
                    9b:7f:07:02:94:16:26:20:b3:ac:c3:e0:9c:3e:09:
                    a5:d8:c3:e2:8e:e5:9d:e7:5a:aa:cd:e8:fd:b3:b7:
                    3f:9c:50:52:76:c4:b7:01:22:31:aa:5e:fc:0c:a0:
                    db:90:74:21:db:b8:cb:a0:9a:44:a6:f2:71:bc:76:
                    d3:b6:85:dc:32:9e:3d:27:34:e6:88:ce:d5:b2:77:
                    c6:05:1e:9c:02:43:98:c0:e7:93:84:b1:43:37:54:
                    20:ac:cf:4e:67:2b:23:10:36:41:11:de:05:8b:f3:
                    b3:fa:ed:a6:33:fd:d6:0d:f3:f8:bf:56:ea:87:14:
                    65:ea:9f:26:d9:54:85:f2:67:4c:29:71:e4:4c:e2:
                    86:90:aa:92:16:79:d3:72:f0:be:76:29:e2:d8:a5:
                    e8:6d:3f:59:28:04:79:f3:81:dd:ba:98:bc:13:fb:
                    8a:36:c9:a6:e0:ea:a9:5d:be:3b:e2:c6:82:da:84:
                    14:b7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B9:A2:91:05:0B:E5:DD:00:2E:1A:64:DD:26:DC:D3:A1:43:DA:8C:C3
            Authority Information Access:
                OCSP - URI:http
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Data Encipherment
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        5d:35:b5:97:fb:8d:fc:b0:e9:2e:63:52:ec:39:b3:13:65:e3:
        53:c0:c9:b8:1a:f3:7d:6f:ed:9f:dc:e5:3c:2a:bd:b9:fd:45:
        ea:5d:98:15:42:87:f5:e3:f9:73:e3:61:52:4c:12:08:22:b8:
        2d:1f:8e:a0:7a:82:09:ea:16:ac:90:6f:d7:ae:ec:c7:dd:11:
        45:9c:5a:80:5c:2f:d1:43:26:ba:95:db:22:0d:8b:f9:8d:ae:
        a8:ba:34:d9:40:bb:55:3c:2c:28:49:86:cb:75:dd:c3:89:6a:
        0b:87:0d:d5:9f:bf:b8:c7:9c:9c:ae:9f:ad:d1:f0:e2:34:36:
        d0:5a:ec:71:cf:57:82:0f:62:1d:a9:1b:bc:06:91:a5:6a:e8:
        c9:0e:50:4a:15:17:2d:d7:5e:12:18:b7:55:b3:eb:ca:71:1f:
        9a:4d:f6:73:09:f1:eb:8d:6c:64:d0:93:b7:4d:f4:e4:86:6c:
        6a:4d:b2:b4:22:41:63:66:e9:14:e0:1c:dd:d0:e6:6c:ed:79:
        82:9f:73:a7:d5:fe:a9:5b:37:c1:88:f0:d9:5a:8b:d7:02:cd:
        9f:02:85:75:a4:45:c7:15:17:dc:02:6a:c3:99:cd:9a:a3:a5:
        b6:af:92:eb:81:f8:65:03:e3:3b:86:80:07:a4:07:16:29:2e:
        0a:3f:e4:48:75:2f:7b:1e:af:90:6d:2d:f1:9a:89:25:f6:91:
        de:bc:85:2e:99:23:9b:b6:a4:fa:32:bc:10:ed:10:04:ee:24:
        f3:7c:7d:eb:cf:ef:c6:bd:c6:6e:fe:5f:be:20:d9:25:cd:5e:
        c3:60:51:0b:3b:80:66:ab:a6:33:f5:8d:bc:15:df:d8:f0:1c:
        b8:4b:58:38:d3:96:9d:24:c3:d9:eb:13:27:6e:c8:9f:73:a9:
        1e:48:01:1c:e8:ef:2c:5a:49:f0:35:15:96:3b:4c:02:38:63:
        4d:c8:64:37:18:c4:3a:1b:59:40:78:ea:4b:eb:fe:ba:dc:6f:
        63:64:b6:b2:08:6f
⚠️ **GitHub.com Fallback** ⚠️