Christina Fu 2018-05-18 21:35:12 EDT

Test Procedure:

* Install a CA (with single step pkispawn is good): When complete, check that its SSL server cert bears the Subject Alternative Name (SAN) extension that matches the CN of the cert.

* Install a KRA (on a separate Tomcat instance; (with single step pkispawn is good)): When complete, check that its SSL SSL server cert bears the Subject Alternative Name (SAN) extension that matches the CN of the cert.

* You could test install another subsystem (e.g. subCA) and do the same check.
It should be enough, as far as installation goes.

* Since I changed all *Server* profiles (not limited to the
   *InternalAuthServerCert* ones), you can manually test those too.

* Note that it appears that I have added the changes to the caCMC*server* ones previously.  You could go through CMC enrollment procedure and check them as well.

commit 7eae0d840c1b7494db2cea67744366fe409eafea (HEAD -> DOGTAG_10_5_BRANCH, ori
gin/DOGTAG_10_5_BRANCH)
Author: Christina Fu <cfu>
Date:   Thu May 17 19:36:10 2018 -0700

    Ticket #2995 SAN in internal SSL server certificate in pkispawn configuratio
n step
    
    This patch adds CommonNameToSANDefault to all server profiles so that
    SAN will be placed in server certs by default.
    For more flexible SAN or multi-value SAN, SubjectAltNameExtDefault
    will have to be used instead.
    
    fixes: https://pagure.io/dogtagpki/issue/2995
    
    Change-Id: I66556f2cb8ed4e1cbe2d0949c5848c6978ea9641

Build used for verification:

[root@pki1 ~]# rpm -qi pki-base
Name        : pki-base
Version     : 10.5.1
Release     : 12.el7_5
Architecture: noarch
Install Date: Thursday 24 May 2018 11:50:10 PM EDT
Group       : System Environment/Base
Size        : 2121862
License     : GPLv2
Signature   : (none)
Source RPM  : pki-core-10.5.1-12.el7_5.src.rpm
Build Date  : Wednesday 23 May 2018 11:58:47 AM EDT
Build Host  : ppc-021.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://pki.fedoraproject.org/
Summary     : Certificate System - PKI Framework



Certificate information for CA

Subject: CN=pki1.example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org


Identifier: Subject Alternative Name - 2.5.29.17
    Critical: no 
    Value: 
        DNSName: pki1.example.com


===========================


Certificate information for KRA

Subject: CN=pki1.example.com,OU=topology-02-KRA,O=topology-02_Foobarmaster.org

Identifier: Subject Alternative Name - 2.5.29.17
    Critical: no 
    Value: 
        DNSName: pki1.example.com


==============================


Certificate information for Sub CA

Subject: CN=pki1.example.com,OU=topology-02-Sub-CA,O=topology-02_Foobarmaster.org

Identifier: Subject Alternative Name - 2.5.29.17
    Critical: no 
    Value: 
        DNSName: pki1.example.com

Certificate information using CMC enrollment:

Subject: CN=nocp4.idm.lab.eng.rdu2.redhat.com,OU=pki-tomcate,O=mySecurityDomain

Identifier: Subject Alternative Name - 2.5.29.17
    Critical: no 
    Value: 
        DNSName: nocp4.idm.lab.eng.rdu2.redhat.com

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:1979