URL:
https://github.com/freeipa/freeipa/pull/2548
Author: frasertweedale
Title: #2548: certdb: ensure non-empty Subject Key Identifier
Action: opened
PR body:
"""
Installation or IPA CA renewal with externally-signed CA accepts an
IPA CA certificate with empty Subject Key Identifier. This is
technically legal in X.509, but is an operational issue.
Furthermore, due to an extant bug in Dogtag
(
https://pagure.io/dogtagpki/issue/3079) it will cause Dogtag
startup failure.
Reject CA certificates with empty Subject Key Identifier.
Fixes:
https://pagure.io/freeipa/issue/7762
"""
To pull the PR as Git branch:
git remote add ghfreeipa
https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2548/head:pr2548
git checkout pr2548