instIpaStp1.sh

#!/bin/bash

sudo ipa-server-install -U \
        -n ${IPA_DOMAIN,,} \
        -r ${IPA_DOMAIN^^} \
        -a `pass ipa/admin` \
        -p `pass ipa/dm` \
        --ca-subject="${IPA_COMMON_NAME}" \
        --setup-dns \
        --no-forwarders --auto-reverse --allow-zone-overlap \
        --pki-config-override=/etc/ipa/override.ini \
        --external-ca

instIpaStp2.sh

#!/bin/bash


sudo ipa-server-install -U \
        -n ${IPA_DOMAIN,,} \
        -r ${IPA_DOMAIN^^} \
        -a `pass ipa/admin` \
        -p `pass ipa/dm` \
        --ca-subject="${IPA_COMMON_NAME}" \
        --setup-dns \
        --no-forwarders --auto-reverse --allow-zone-overlap \
        --pki-config-override=/etc/ipa/override.ini \
        --external-cert-file=/root/ipa.pem

override.ini

#/etc/ipa/override.ini
[DEFAULT]
ipa_key_algorithm=SHA256withEC
ipa_key_size=nistp384
ipa_key_type=ecc
ipa_signing_algorithm=SHA256withEC

[CA]
pki_ca_signing_key_size=nistp384