ipa-ca-install man page

ipa-ca-install — Install a CA on a server


ipa-ca-install [OPTION]... [replica_file]


Adds a CA as an IPA-managed service. This requires that the IPA server is already installed and configured.

The replica_file is created using the ipa-replica-prepare utility and should be the same one used when originally installing the replica.

Alternatively, you can run ipa-ca-install without replica_file to upgrade from CA-less to CA-full.


-d, --debug
Enable debug logging when more verbose output is needed

Directory Manager (existing master) password


Admin user Kerberos password used for connection check


Generate a CSR for the IPA CA certificate to be signed by an external CA.


Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include template name required by Microsoft Certificate Services (MS CS) in the generated CSR.


File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.


Signing algorithm of the IPA CA certificate. Possible values are SHA1withRSA, SHA256withRSA, SHA512withRSA. Default value is SHA256withRSA. Use this option with --external-ca if the external CA does not support the default signing algorithm.


Do not use DNS for hostname lookup during installation


Skip connection check to remote master


Skip check for updated CA DS schema on the remote master

-U, --unattended

An unattended installation that will never prompt for user input

Exit Status

0 if the command was successful

1 if an error occurred


Jun 17 2011 FreeIPA Manual Pages