On Tue, Oct 01, 2019 at 09:09:52AM +0100, lejeczek wrote: > On 01/10/2019 02:21, Fraser Tweedale wrote: > > On Mon, Sep 30, 2019 at 02:04:15PM +0100, lejeczek via FreeIPA-users wrote: > >> On 09/09/2019 01:07, Fraser Tweedale wrote: > >>> On Fri, Sep 06, 2019 at 12:01:23PM +0100, lejeczek via FreeIPA-users > >>> wrote: > >>>> hi guys, > >>>> > >>>> how to manage those? > >>>> > >>>> Why are these missing in "standard" IPA installations and how to get > >>>> them in? > >>>> > >>>> many thanks, L. > >>>> > >>> Do you mean in the IPA CA certificate, or in the end-entity > >>> certificates? > >>> > >>> If the CA certificate, use the --ca-subject option to specify the > >>> full subject DN you desire. Note that you can only do this upon > >>> installation; there is no way to change the subject of the CA after > >>> installation. > >>> > >>> For end-entity certificates, upon installation you can use the > >>> --subject-base option to specify the desired "subject base DN", to > >>> which the Common Name (CN) will be appended. For existing > >>> installations you can use the 'ipa certprofile-*' commands to import > >>> or modify profile configurations. You will want to tweak the > >>> configuration of the 'subjectNameDefaultImpl' component to put > >>> include the desired attributes. > >>> > >>> Cheers, > >>> Fraser > >> Does the exactness of the 'subject' matter and if so then to whom? > >> > > It does matter. It is *critical* when renewing a CA certificate > > that the subject not change. On first installation it is not so > > critical, but receiving a certificate with different subject DN from > > the CSR usually indicates a mistake or a likelihood of problems down > > the track, when you need to renew it. So we reject it. > > > >> I got a request signed by an external authority but renewal fails with: > >> > >> $ IPA CA certificate with subject 'C=GB,......' was not found in ./file.crt > >> > >> $ The ipa-cacert-manage command failed. > >> > >> and when I glanced at request and the cert I can see that their subjects > >> differ in such way that order (what do you call it?) is reversed: > >> > >> request - Subject: CN=CCN O=University, L=Some, ST=Something, C=GB > >> > >> cert - C=GB, ST=Something, L=Some, O=University, CN=CCN > >> > >> If this is the problem indeed then how to resolve such problem? Else, > >> what is the problem? > >> > > You have to put in the CSR what you expect to get back. If the > > issuer is reversing the Subject DN attributes... you will never get > > back what you want**. So you should work out what is going on in the > > program that is issuing the certificate; work with your CA admins or > > the CA software configuration to resolve this. > > > > ** unless the Subject DN is a palindrome :D > > > > If you give details about the program used to issue the IPA CA > > certificate, we may be able to assist more. > > > > Cheers, > > Fraser > > many thanks Fraser, > > what about cert's extensions, if those are "lost"? If CA extension is > lots? Does that brake stuff badly? (I fear yes) > Yes, if the CA certificate does not have Basic Constraints with CA=true, then it is not a CA certificate. Validation will break. But we do check for this and reject the certificate if it does not have the required extensions.
Cheers, Fraser _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
