26.9. Replacing the Web Server's and LDAP Server's Certificate
26.9. Replacing the Web Server's and LDAP Server's Certificate To replace the service certificates for the web server and LDAP server: Request a new certificate. You can do this using: the integrated CA: see Section 24.1.1, "Requesting New Certificates for a User, Host, or Service" for details. an external CA: generate a private key and certificate signing request (CSR). For example, using OpenSSL: Submit the CSR to the external CA. The process differs depending on the service to be used as the external CA. Replace the Apache web server's private key and certificate: Replace the LDAP server's private key and certificate:
openssl req -new -newkey rsa:2048 -days 365 -nodes -keyout new.key -out new.csr -subj '/CN= idmserver.idm.example.com ,O= IDM.EXAMPLE.COM ' ipa-server-certinstall -w --pin= password new.key new.crt ipa-server-certinstall -d --pin= password new.key new.cert