Hi
I have some SonicWall firewalls on my network, which has a web based management GUI, for which I have generated certificates so everything is nice and proper.
The firewall is created in FreeIPA as a host, but not enrolled, obviously, as there is no need, and also no FreeIPA client for this OS.
Until now, I have just manually re-created the certificates every two years when they expire.
This time, however, I get an error in the FreeIPA web gui:
IPA Error 4035: HTTPRequestError
Request failed with status 500: Non-2xx response from CA REST API: 500. Unable to create enrollment request: Invalid Request
The CSR in question, decoded and redacted:
Certificate Request:
Data:
Version: 1 (0x0)
Subject: CN=fw.company.local
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
blahblah
Exponent: 65537 (0x10001)
Attributes:
Requested Extensions:
X509v3 Subject Alternative Name:
DNS:fw.company.local
Signature Algorithm: sha1WithRSAEncryption
Signature Value:
blahblah
I suspect the CSR is missing a "realm". In the FreeIPA web gui it says: "Create a CSR with subject CN=<hostname>,O=<realm>" Unfortunately, for the CSR generation, I am at the mercy of the software running on the firewall.
SonicOS 7.2.0-7015
IPA, version: 4.9.13