Historically, only Dogtag PKI has been supported, but an alternative exists: https://forge.fedoraproject.org/freeipa/ipacta > A pure-Python Certificate Authority that replaces Dogtag PKI for FreeIPA deployments. Built on the cryptography library, ipacta provides a compatible REST API, CLI tools, and python3-pki client library that FreeIPA expects, without requiring Java, Tomcat, or the Dogtag stack. However, it's unclear whether it's production-ready or an experiment: ipacta landed in Fedora but not RHEL (yet). In the meantime it's unpredictable which implementation is installed: ``` marked for install (shallow): freeipa-server satisfying Depends: python3-module-pki-base >= 11.8.0 maybe install (a providing target): python3-module-ipacta-pki 0.1.1-alt1:sisyphus+440250.300.3.1@1794117728 maybe install (another providing target): python3-module-dogtag-pki 11.8.0-alt1:sisyphus+403798.1700.14.1@1771005344 target SELECTED: python3-module-ipacta-pki 0.1.1-alt1:sisyphus+440250.300.3.1@1794117728 ``` This is neither expected, wanted, nor supported. If that were ever the case, a separate package would be required, e.g. freeipa-server-ipacta.
Кроме того, кажется разумным - вытащить все части для замещения dogtag в пакете ipacta, в отдельный подпакет.
(In reply to Evgeny Sinelnikov from comment #1) > Кроме того, кажется разумным - вытащить все части для замещения dogtag в > пакете ipacta, в отдельный подпакет. Если это когда-нибудь понадобится.
freeipa-4.13.4-alt6 -> sisyphus: Tue Nov 10 2026 Stanislav Levin <slev@altlinux> 4.13.4-alt6 - Explicitly require Dogtag PKI (closes: #61395).
