URL: https://github.com/freeipa/freeipa/pull/1090 Author: stlaz Title: #1090: Don't write p11-kit EKU extension object if no EKU Action: opened

PR body: """ b5732efd introduced a regression because it tries to write EKU that's actually in the CA cert instead of using the LDAP information. However, when no EKU is available, IPACertificate.extended_key_usage_bytes still returned at least EKU_PLACEHOLDER OID to keep the behavior the same as in previous versions. This caused the EKU_PLACEHOLDER to be written in the ipa.p11-kit file which made Firefox report FreeIPA Web UI as improperly configured.

https://pagure.io/freeipa/issue/7119 """

To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1090/head:pr1090 git checkout pr1090