Hi, first i would like to thank you all for your great work on FreeIPA!
I'm having problem with how FreeIPA (installed with external CA) is creating
CA chain in wrong order (if I'm not wrong) according to RFC 5280 section
6.1. [1]. When I try to use /etc/ipa/ca.crt in 3th party web app the app
wont start until i fix the chain order.
So my questing is how to fix this wrong chain order gerenrated from ipa-
certupdate.
PS: I created test instance and made self sign CA and then intermediated CAs
to show how will FreeIPA construct the chain. And for this chain:
ROOTCA <- INTERCA-B <- INTERCA-C <- INTERCA-D <- INTERCA-E <- INTERCA-IPA
FreeIPA ipa-certupdate create this chain:
0: subject=CN = INTERCA-B
issuer=CN = ROOTCA
1: subject=CN = INTERCA-C
issuer=CN = INTERCA-B
2: subject=CN = INTERCA-D
issuer=CN = INTERCA-C
3: subject=CN = INTERCA-E
issuer=CN = INTERCA-D
4: subject=CN = ROOTCA
issuer=CN = ROOTCA
5: subject=CN = INTERCA-IPA
issuer=CN = INTERCA-E
Right order should be:
0: subject=CN = INTERCA-IPA
issuer=CN = INTERCA-E
1: subject=CN = INTERCA-E
issuer=CN = INTERCA-D
2: subject=CN = INTERCA-D
issuer=CN = INTERCA-C
3: subject=CN = INTERCA-C
issuer=CN = INTERCA-B
4: subject=CN = INTERCA-B
issuer=CN = ROOTCA
5: subject=CN = ROOTCA
issuer=CN = ROOTCA
Is there anything what I can do to fix this situation. Right now I'm
handling this situation with ipa-getcert request --after-command.
[1] -
https://datatracker.ietf.org/doc/html/rfc5280#section-6.1
--
sodd(a)email.cz