URL:
https://github.com/SSSD/sssd/pull/814
Title: #814: certmap: allow missing KU in OpenSSL version
jhrozek commented:
"""
btw cert without KU:
```
sssctl cert-show $(base64 -w0 /home/jhrozek/certuser2.der)
ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la :
/usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header
sss cert content (format might change):
Issuer: CN=federation test CA,OU=federation test,O=federation
Subject: CN=certuser2,OU=SSSD test,O=SSSD
Key Usage: 4294967295(0xffffffff)
(digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment,keyAgreement,keyCertSign,cRLSign,encipherOnly,decipherOnly)
Extended Key Usage #0: 1.3.6.1.5.5.7.3.1 (serverAuth)
Extended Key Usage #1: 1.3.6.1.5.5.7.3.2 (clientAuth)
```
And with the first patch reverted:
```
sssctl cert-show $(base64 -w0 /home/jhrozek/certuser2.der)
ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la :
/usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header
(Tue May 28 23:21:13:583505 2019) [sssd] [sssctl_cert_show] (0x0010): Failed to parsed
certificate
```
--> ACK
"""
See the full comment at
https://github.com/SSSD/sssd/pull/814#issuecomment-496694708