[Freeipa-users] Client Certificate

[Rob Crittenden]

Walid A. Shaari wrote:
> Hi,
> 
> we are going to have a use case of diskless HPC clients that will use
> the IPA for lookups, I was wondering if i can get rid of the
> state-fulness of the client configuration as much as possible as it is
> more of a cattle than pets use case. that is i do not need to know that
> the client is part of the domain, no need to enroll a node with a
> certificate. and services will be mostly hpc mpi and ssh, not required
> to have an SSL certificate for secure communication. is it possible to
> get rid of the client certificate and the requirements for clients to
> enroll? or there are other uses for the certificate that i am not aware of ?

Yes, you don't need to obtain a machine certificate. In fact we have
stopped doing this upstream.

rob