|This article is Out of date. |
Please update this article and remove this template!
Lack of a UI for user x.509 PKI
Despite the fact that FreeIPA includes a CA - and does natively handle certificates for hosts, it unfortunately doesn't handle it for users, natively.
This is kind of a pain, seeing that solutions like OpenVPN depend on x.509 PKI for authentication.
This feature is road mapped for FreeIPA, but doesn't appear to currently exist.
As a workaround, it should be possible to talk to Dogtag directly, generate a cert, and store it in the proper attribute within 389-DS. Hopefully, the FreeIPA team does what seems obvious, and this will work after they finally implement it. :-)