On 01/10/2019 02:21, Fraser Tweedale wrote:
On Mon, Sep 30, 2019 at 02:04:15PM +0100, lejeczek via FreeIPA-users
wrote:
> On 09/09/2019 01:07, Fraser Tweedale wrote:
>> On Fri, Sep 06, 2019 at 12:01:23PM +0100, lejeczek via FreeIPA-users wrote:
>>> hi guys,
>>>
>>> how to manage those?
>>>
>>> Why are these missing in "standard" IPA installations and how to
get
>>> them in?
>>>
>>> many thanks, L.
>>>
>> Do you mean in the IPA CA certificate, or in the end-entity
>> certificates?
>>
>> If the CA certificate, use the --ca-subject option to specify the
>> full subject DN you desire. Note that you can only do this upon
>> installation; there is no way to change the subject of the CA after
>> installation.
>>
>> For end-entity certificates, upon installation you can use the
>> --subject-base option to specify the desired "subject base DN", to
>> which the Common Name (CN) will be appended. For existing
>> installations you can use the 'ipa certprofile-*' commands to import
>> or modify profile configurations. You will want to tweak the
>> configuration of the 'subjectNameDefaultImpl' component to put
>> include the desired attributes.
>>
>> Cheers,
>> Fraser
> Does the exactness of the 'subject' matter and if so then to whom?
>
It does matter. It is *critical* when renewing a CA certificate
that the subject not change. On first installation it is not so
critical, but receiving a certificate with different subject DN from
the CSR usually indicates a mistake or a likelihood of problems down
the track, when you need to renew it. So we reject it.
> I got a request signed by an external authority but renewal fails with:
>
> $ IPA CA certificate with subject 'C=GB,......' was not found in ./file.crt
>
> $ The ipa-cacert-manage command failed.
>
> and when I glanced at request and the cert I can see that their subjects
> differ in such way that order (what do you call it?) is reversed:
>
> request - Subject: CN=CCN O=University, L=Some, ST=Something, C=GB
>
> cert - C=GB, ST=Something, L=Some, O=University, CN=CCN
>
> If this is the problem indeed then how to resolve such problem? Else,
> what is the problem?
>
You have to put in the CSR what you expect to get back. If the
issuer is reversing the Subject DN attributes... you will never get
back what you want**. So you should work out what is going on in the
program that is issuing the certificate; work with your CA admins or
the CA software configuration to resolve this.
** unless the Subject DN is a palindrome :D
If you give details about the program used to issue the IPA CA
certificate, we may be able to assist more.
Cheers,
Fraser
many thanks Fraser,
what about cert's extensions, if those are "lost"? If CA extension is
lots? Does that brake stuff badly? (I fear yes)
thanks, L.