Bug 1146143
| Summary: | RFE: allow to override Subject line from .csr when issuing a certificate | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | David Jaša <djasa> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED DEFERRED | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | djasa, dpal, mkosek, pasik, pvoborni, rcritten |
| Target Milestone: | pre-dev-freeze | Keywords: | FutureFeature |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Enhancement | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-03-13 20:50:46 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
David Jaša
2014-09-24 14:39:54 UTC
Created attachment 940793 [details]
example .csr
A server certificate with just the local part of the hostname in common name will fail validation on clients, unless it has a Subject Alternative Name extension with a DNSName of the FQDN. Is the hostname on the remote management console configured correctly to the FQDN? Can the remote management console be configured to include the SAN in the CSR it generates? This could be solved on IPA side by allowing one to override the subject name when issuing a certificate, would that be OK for your use case? (In reply to Jan Cholasta from comment #2) > A server certificate with just the local part of the hostname in common name > will fail validation on clients, unless it has a Subject Alternative Name > extension with a DNSName of the FQDN. Yes, this is the reason why I reported the bug. :) > Is the hostname on the remote management console configured correctly to the > FQDN? It seems so: the domain name is entered there (host name doesn't allow periods) > > Can the remote management console be configured to include the SAN in the > CSR it generates? > It doesn't seem so, there are no more knobs to tune in the ILO. > This could be solved on IPA side by allowing one to override the subject > name when issuing a certificate, would that be OK for your use case? I think so. There might be an issue though if the console validates that the certificate parameters are equal to .csr parameters - but this might or might not be the case. Upstream ticket: https://fedorahosted.org/freeipa/ticket/4572 This Bugzilla is a feature request and as such will not make it to RHEL-6 where IdM server is only being stabilized and new functionality is not being added. I am thus moving the Bugzilla to RHEL-7.x series. When/if the RFE is implemented, please clone a Bugzilla to RHEL-6 and provide business justification so that we can re-consider backporting to RHEL-6. The bugzilla doesn't have high enough priority in comparison to other bugs/RFEs for 7.4. Moving to next release. Without sufficient justification it can be moved again later. Hello, The issues is partially addressed: You can do it with Kerberos principal aliases. If you want to issue a cert for principal host/shortname.example.com with CN=shortname, just add a Kerberos principal alias: ipa host-add-principal shortname.example.com 'host/shortname' Then the certificate request will be allowed. But this does not result in overriding the shortname with the FQDN in the issued cert. It does not seem that this use case is popular and thus worth pursuing. The upstream ticket is still open but this BZ will be closed for now. If you have any feedback or additional requirements please do not hesitate to provide. Thank you Dmitri |