Hello, the offline root CA you mention. Do you have any CA on your mind or do you want FreeIPA to be the offline root CA?

If any, then it depends on the CA you use. E.g. dogtag can be used:
* https://floblanc.wordpress.com/2016/09/02/dogtag-installation/
* https://floblanc.wordpress.com/2016/09/02/using-a-dogtag-instance-as-external-ca-for-free-ipa-installation/

If FreeIPA as the offline CA, then this scenario is not tested and therefore I'd not recommend it.

No, what I was looking for was how to use a fully offline PKI (e.g. openssl) on an airgapped computer to generate a root CA and then sign the FreeIPA CSR, keeping the root CA separated form the server where FreeIPA is installed.

If your question is: "How do I safely get a certificate from an online machine I want to install FreeIPA on to an offline machine to sign it and back?" then your company need to consult a security specialist. "Secure" is a very relative term and it varies.

You may want to have your CA dug 2km under ground and have it sign CSRs only for your other CA all details of which you know completely and which, too, is offline but at least more accessible and may be used at every end of a week to sign CSRs you bring to it on an encrypted hard-drive only one person is able to access. And I am not even mentioning CRLs here.

Or maybe you just want to grab a USB stick and carry a CSR/signed certificate between two machines.

@stlaz Uhm... no, that's not the issue here, of course we use USB sticks :smile:
But, since we already have a root CA for other stuff, I wanted to add the FreeIPA ca as a Sub-CA to the main one.
I was looking for the "canonical" way to sign it, since an official how-to on using an external CA with OpenSSL doesn't seem to be available.
Would something like this be acceptable?

Ah, I see! Thanks for clearing that out.

Yes, I think it can be signed as described in the link, although I am afraid that the described extensions will still be ignored (although the CA basic constraint and SKI should be coming in FreeIPA 4.6).

Note that FreeIPA will fail should you provide it with a certificate that's insufficient for it so it should be safe to fiddle with the installation a bit.

Let me also point you to the freeipa-users mailing list which is the place to ask questions about using FreeIPA. I should hope that that mailing list answers questions in a more steady pace :smile:

Note that FreeIPA will fail should you provide it with a certificate that's insufficient for it so it should be safe to fiddle with the installation a bit.

Ah, I see. I may have run into this problem when I was testing. Does the error just say that the certificate can't be found like below?

ERROR: IPA CA certificate not found in ,

Yes. In this case, though, it seems like the IPA CA certificate was not found in your files at all.

Hmm... interesting, the certificate was actually present. It's a but off topic in this ticket, though. I will do more tests, and open another if I still can't figure it out. In the mean time, I guess this can be closed.