Ian Pilcher via FreeIPA-users wrote:
I've hit a roadblock while trying to generate a certificate for a
VMware
vSphere appliance.
The VMware "Certificate Management" tool doesn't allow one to upload a
certificate and key. Instead, one has to generate a CSR in the VMware
GUI which then gets submitted to the CA (IPA in this case).
Unfortunately, the VMware tool refuses to generate a CSR that does not
include an email address in its subject alternative names extension, and
IPA refuses to issue a host or service certificate that includes an
email address.
Is it possible to create a certificate profile that will simply ignore
the email address (i.e. not include it in the SAN of the issued
certificate)?
IPA doesn't allow a CSR that has a RFC822Name SAN for a non-user. This
validation happens before the CSR is submitted to the CA.
You'd have to modify code to drop this requirement.
rob