On Tue, Oct 01, 2019 at 09:09:52AM +0100, lejeczek wrote:
On 01/10/2019 02:21, Fraser Tweedale wrote:
> On Mon, Sep 30, 2019 at 02:04:15PM +0100, lejeczek via FreeIPA-users wrote:
>> On 09/09/2019 01:07, Fraser Tweedale wrote:
>>> On Fri, Sep 06, 2019 at 12:01:23PM +0100, lejeczek via FreeIPA-users wrote:
>>>> hi guys,
>>>>
>>>> how to manage those?
>>>>
>>>> Why are these missing in "standard" IPA installations and how
to get
>>>> them in?
>>>>
>>>> many thanks, L.
>>>>
>>> Do you mean in the IPA CA certificate, or in the end-entity
>>> certificates?
>>>
>>> If the CA certificate, use the --ca-subject option to specify the
>>> full subject DN you desire. Note that you can only do this upon
>>> installation; there is no way to change the subject of the CA after
>>> installation.
>>>
>>> For end-entity certificates, upon installation you can use the
>>> --subject-base option to specify the desired "subject base DN",
to
>>> which the Common Name (CN) will be appended. For existing
>>> installations you can use the 'ipa certprofile-*' commands to
import
>>> or modify profile configurations. You will want to tweak the
>>> configuration of the 'subjectNameDefaultImpl' component to put
>>> include the desired attributes.
>>>
>>> Cheers,
>>> Fraser
>> Does the exactness of the 'subject' matter and if so then to whom?
>>
> It does matter. It is *critical* when renewing a CA certificate
> that the subject not change. On first installation it is not so
> critical, but receiving a certificate with different subject DN from
> the CSR usually indicates a mistake or a likelihood of problems down
> the track, when you need to renew it. So we reject it.
>
>> I got a request signed by an external authority but renewal fails with:
>>
>> $ IPA CA certificate with subject 'C=GB,......' was not found in
./file.crt
>>
>> $ The ipa-cacert-manage command failed.
>>
>> and when I glanced at request and the cert I can see that their subjects
>> differ in such way that order (what do you call it?) is reversed:
>>
>> request - Subject: CN=CCN O=University, L=Some, ST=Something, C=GB
>>
>> cert - C=GB, ST=Something, L=Some, O=University, CN=CCN
>>
>> If this is the problem indeed then how to resolve such problem? Else,
>> what is the problem?
>>
> You have to put in the CSR what you expect to get back. If the
> issuer is reversing the Subject DN attributes... you will never get
> back what you want**. So you should work out what is going on in the
> program that is issuing the certificate; work with your CA admins or
> the CA software configuration to resolve this.
>
> ** unless the Subject DN is a palindrome :D
>
> If you give details about the program used to issue the IPA CA
> certificate, we may be able to assist more.
>
> Cheers,
> Fraser
many thanks Fraser,
what about cert's extensions, if those are "lost"? If CA extension is
lots? Does that brake stuff badly? (I fear yes)
Yes, if the CA certificate does not have Basic Constraints with
CA=true, then it is not a CA certificate. Validation will break.
But we do check for this and reject the certificate if it does not
have the required extensions.
Cheers,
Fraser