Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com ), so withholding your domain name here does not increase secr…

Cannot issue for “certificate authority” Your CSR literally contains the domain name "certificate authority". Something is wrong with the way FreeIPA has generated it. It should contain your domain name instead.

For anyone who runs into the same issue I had here are my circumstances and how it got resolved. Installing FreeIPA server with an external CA is a 2 step process. The first part does some of the installation and then it creates a CSR that is to be retrieved and signed by, in this case, LetsEncrypt…

Trying to get a freeipa CSR signed by LetsEncrypt

Help

elsporko July 23, 2020, 10:48pm 3

Thank you. I found that suspicious but trusted that the installer did the right thing out of the box. Now I have to see what can be done to properly influence the CSR creation during installation.

Topic		Replies	Views
HTML CSR page fails at Step 3 with "Error: Account registration failed. Please start back at Step 1. { "type": "urn:acme:error:malformed", "detail": "JWS verification error", "status": 400 }" Help	25	8799	September 24, 2016
Unable to Renew? Help	3	925	June 1, 2018
Unable to issue new certificate Help	2	1093	November 23, 2017
Not able to create a certificate Help	15	3493	April 6, 2018
An unexpected error occurred: Certification Authority Authorization (CAA) records forbid the CA from issuing a certificate :: Error finalizing order :: Rechecking CAA for <my domain> and 1 more identifiers failed. Refer to sub-problems Help	1	2034	January 13, 2022

Trying to get a freeipa CSR signed by LetsEncrypt

Related topics