On Thu, Jul 12, 2018 at 09:26:09AM -0000, vitenbergd--- via FreeIPA-users wrote:
Hello, everyone
I've got problem similar to:
https://serverfault.com/questions/253960/adding-subject-alternate-names-s...
So, there is a HP crypto device for which i should issue certificate (via FreeIPA CA), it
allows you to generate CSR, and there is no access to private key/or some kind of cmdline
interface.
But internal divice's CSR generation mechanism allows you to add only CommonName and
there is no support for SAN. And i want to ask if there is a way to add SAN attributes
during certificate issue process on FreeIPA. Several thoughts from serverfault answers:
1) Edit existing CSR, add SAN hostnames (cause CSR was signed by private key, it will be
now invalid), force FreeIPA not to check signature.
2) Extract FreeIPA private key and maybe use some 3rd party tools to issue certificate
with edited CSR (p. #1)
3) Edit FreeIPA CA/PKI subsystem options to add SAN attributes (somehow?) at sign time
The Dogtag CA as of IPA v4.5 (IIRC) provides the
CommonNameToSANDefault profile component. If you include it on the
relevant profile, the Subject DN CN attribute, if it looks like a
DNS name, will be automatically copied to the SAN extension on the
final certificate.
See my blog post[1] for more details:
[1]
https://frasertweedale.github.io/blog-redhat/posts/2017-07-11-cn-deprecat...
HTH,
Fraser
> Have a good day!
>
> D. Vitenberg
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...