Bug 1450629

Description of problem:

bug 1449084 introduced a new option to the pki utils, '--san', to set the certificate's Subject Alternative Name. engine-setup was also patched by that bug to pass this option. However, these utils are sometimes called directly by end-users, and then do not set a SAN if the option is not used.

These utils should have a default, which IMO should be 'DNS:@CN@', where '@CN@' is the CN part of the Subject (which is mandatory).

Version-Release number of selected component (if applicable):

4.1.2

How reproducible:

Always

Steps to Reproduce:
1. engine-setup
2. /usr/share/ovirt-engine/bin/pki-enroll-pkcs12.sh --name="testname" --password=mypass --subject="$(openssl x509 -in /etc/pki/ovirt-engine/certs/apache.cer -noout -subject | sed 's;subject= \(.*\);\1;')"
3. openssl x509 -in /etc/pki/ovirt-engine/certs/testname.cer -noout -text | grep -i -A1 'subject alt'

Actual results:

No output from last command

Expected results:

Output of last command looks like:

            X509v3 Subject Alternative Name: 
                DNS:some.dns.name

Additional info:

Without current bug, you can replace (2.) with the following command to see that '--san' does work:

/usr/share/ovirt-engine/bin/pki-enroll-pkcs12.sh --name="testname" --password=mypass --subject="$(openssl x509 -in /etc/pki/ovirt-engine/certs/apache.cer -noout -subject | sed 's;subject= \(.*\);\1;')" --san=DNS:some.dns.name