Bug 1441884

Unfortunately, description is wrong.

With FreeIPA 4.5 we have added CSR generator into 'ipa cert-request' flow. When no CSR is supplied but private key is provided either in PEM or NSS DB format, 'ipa cert-request' will attempt to fetch specified or default certificate profile and build CSR according to the profile.

If certificate profile allows to specify Kerberos principal, CSR generator would add this information into CSR. Unfortunatey, it does not add it now because CSR generator profile and rules on client side do not have specification for adding Kerberos principal as SAN OtherName.

Thus, the bug is in missing definitions of Kerberos principal in CSR profile/rules code.

Alexander,

Sorry, I misunderstood yesterday.  So the CSR profile you're talking about is not a certificate profile managed by the ipa certprofile commands?

Think I should modify the bug name to match what you send in comment #5?

Thanks,
Scott

Correct. CSR profile/rules/templates are defined in IPA client code: https://pagure.io/freeipa/blob/master/f/ipaclient/csrgen

Upstream ticket:
https://pagure.io/freeipa/issue/6912

This bug is about csrgen component of IPA CLI that doesn't have Kerberos principal component in its own certificate profiles. The profiles here are different from the CA certificate profiles in IPA CA. This functionality is mostly unused because it is not documented and nobody knows about it.

If you look at the help for 'ipa cert-request', you can see that CSR file is optional. The idea was that on the client side, if CSR file was not specified, you can specify private key in NSS database or PEM file.

This is how the code looks in ipaclient/plugins/cert.py:

@register(override=True, no_fail=True)
class cert_request(CertRetrieveOverride):
     takes_options = CertRetrieveOverride.takes_options + (
         Str(
             'database?',
             label=_('Path to NSS database'),
             doc=_('Path to NSS database to use for private key'),
         ),
         Str(
             'private_key?',
             label=_('Path to private key file'),
             doc=_('Path to PEM file containing a private key'),
         ),
         Str(
             'password_file?',
             label=_(
                 'File containing a password for the private key or database'),
         ),
         Str(
             'csr_profile_id?',
             label=_('Name of CSR generation profile (if not the same as'
                     ' profile_id)'),
         ),
     )


However, something is broken and these options are not visible anymore:


$ ipa cert-request --help
Usage: ipa [global-options] cert-request [CSR-FILE] [options]

Submit a certificate signing request.
Options:
   -h, --help            show this help message and exit
   --profile-id=STR      Certificate Profile to use
   --ca=STR              Name of issuing CA
   --principal=PRINCIPAL
                         Principal for this certificate (e.g.
                         HTTP/test.example.com)
   --add                 automatically add the principal if it doesn't exist
                         (service principals only)
   --chain               Include certificate chain in output
   --all                 Retrieve and print all attributes from the server.
                         Affects command output.
   --raw                 Print entries as stored on the server. Only affects
                         output format.
   --certificate-out=FILE
                         Write certificate (chain if --chain used) to file

Not only they aren't visible, they cannot be specified as IPA CLI does not understand them:

$ ipa cert-request --password-file foo
Usage: ipa [global-options] cert-request [CSR-FILE] [options]

ipa: error: no such option: --password-file


This all means the functionality is not usable and not used by anyone in RHEL 7+.

I am closing this bug. For removal of csrgen we can open a different, upstream-only, bug.