On 09/09/2019 01:07, Fraser Tweedale wrote:
On Fri, Sep 06, 2019 at 12:01:23PM +0100, lejeczek via FreeIPA-users
wrote:
> hi guys,
>
> how to manage those?
>
> Why are these missing in "standard" IPA installations and how to get
> them in?
>
> many thanks, L.
>
Do you mean in the IPA CA certificate, or in the end-entity
certificates?
If the CA certificate, use the --ca-subject option to specify the
full subject DN you desire. Note that you can only do this upon
installation; there is no way to change the subject of the CA after
installation.
For end-entity certificates, upon installation you can use the
--subject-base option to specify the desired "subject base DN", to
which the Common Name (CN) will be appended. For existing
installations you can use the 'ipa certprofile-*' commands to import
or modify profile configurations. You will want to tweak the
configuration of the 'subjectNameDefaultImpl' component to put
include the desired attributes.
Cheers,
Fraser
Does the exactness of the 'subject' matter and if so then to whom?
I got a request signed by an external authority but renewal fails with:
$ IPA CA certificate with subject 'C=GB,......' was not found in ./file.crt
$ The ipa-cacert-manage command failed.
and when I glanced at request and the cert I can see that their subjects
differ in such way that order (what do you call it?) is reversed:
request - Subject: CN=CCN O=University, L=Some, ST=Something, C=GB
cert - C=GB, ST=Something, L=Some, O=University, CN=CCN
If this is the problem indeed then how to resolve such problem? Else,
what is the problem?
many thanks, L.