Goal To generate ssl certificates with SAN DNS and IPs for hosts (not users) using certmonger
Issue SSl certificate is generated with the requested SAN DNS and IPs and another type name "othername:<unsupported>" twice.
what I tried I changed contraints in the certificate profile as follow:
policyset.serverCertSet.11.constraint.class_id=noConstraintImpl policyset.serverCertSet.11.constraint.name=No Constraint policyset.serverCertSet.11.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.11.default.name=Copy Common Name to Subject
and I also tried with
policyset.serverCertSet.11.constraint.class_id=noConstraintImpl policyset.serverCertSet.11.constraint.name=No Constraint policyset.serverCertSet.11.default.class_id=userExtensionDefaultImpl policyset.serverCertSet.11.default.name=User supplied extension in CSR policyset.serverCertSet.11.default.params.userExtOID=2.5.29.17
Both of them did not work.
Here is the cert-request command I'm using:
ipa-getcert request -g 4096 -k /data/client.key -f /data/client.pem -N "cn=client.ipa.test" -K host/client.ipa.test -I my_cert_profile -D device -D machine -r
The SAN values must be read from the csr and not the certificate profile. That's why I didn't manually entered the desired DNS values in the certificate params: .params.subjAltExtType, params.subjAltExtGNEnable and params.subjAltExtPattern
I decided to use certmonger because it ouputs the pem and key files. I'm trying to avoid certutil or openssl because certmonger is the easiest.
IPA version: VERSION: 4.9.10, API_VERSION: 2.248 Docker container image: freeipa-server:centos-8-stream <img alt="Capture.PNG" src="/freeipa/issue/raw/files/6d22662d68f9bb87f188f0c5feb9f7902204cb546824c58a80e592f76c07b1d2-Capture.PNG" />
This issue tracker is for issues in FreeIPA, not for resolving administrative issues in your deployments. Please post your questions to freeipa-users@ mailing list instead.
However, the 'issue' you describe is not an issue at all. At worst, it is misunderstanding of an output you get. OpenSSL command-line tool does not understand certain SAN types and thus prints them with <unsupported> marker.
<unsupported>
If you'd use gnutls-utils' certtool utility, you'll see that SAN entry without any issue:
gnutls-utils
certtool
# certtool -i --infile /etc/pki/tls/certs/some-host.crt|grep -A3 'Subject Alternative Name' Subject Alternative Name (not critical): DNSname: some.host.name User Principal Name: host/some.host.name@EXAMPLE.TEST KRB5Principal: host/some.host.name@EXAMPLE.TEST
Metadata Update from @abbra: - Issue close_status updated to: invalid - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.