Title: #891: Add SKI and AKI to CA certs in ca-less integration test
The IPA installer now checks that CA certs include the Subject Key
Identifier extension (which is required by Dogtag and RFC 5280).
But this broke our integration tests, which were not adding the
Update the caless-create-pki script to add these extensions.
The Subject Key Identifier and Authority Key Identifier values are
randomly chosen for each CA, and propagated down to the 'gen_cert()'
subroutine so that profiles have access to them. Each profile can
choose how to use it. For now, only the 'ca' profile uses them, but
for maximum correctness the 'server' profile (i.e. for leaf
certificates) could be updated to add the CA's SKI to the AKI
extension. This is left for a later commit.
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/891/head:pr891
git checkout pr891