On Thu, Jul 12, 2018 at 09:26:09AM -0000, vitenbergd--- via FreeIPA-users wrote:

Hello, everyone

I've got problem similar to: https://serverfault.com/questions/253960/adding-subject-alternate-names-san-...

So, there is a HP crypto device for which i should issue certificate (via FreeIPA CA), it allows you to generate CSR, and there is no access to private key/or some kind of cmdline interface. But internal divice's CSR generation mechanism allows you to add only CommonName and there is no support for SAN. And i want to ask if there is a way to add SAN attributes during certificate issue process on FreeIPA. Several thoughts from serverfault answers:

1. Edit existing CSR, add SAN hostnames (cause CSR was signed by private key, it will be now invalid), force FreeIPA not to check signature.
2. Extract FreeIPA private key and maybe use some 3rd party tools to issue certificate with edited CSR (p. #1)
3. Edit FreeIPA CA/PKI subsystem options to add SAN attributes (somehow?) at sign time

The Dogtag CA as of IPA v4.5 (IIRC) provides the CommonNameToSANDefault profile component. If you include it on the relevant profile, the Subject DN CN attribute, if it looks like a DNS name, will be automatically copied to the SAN extension on the final certificate.

See my blog post[1] for more details:

[1] https://frasertweedale.github.io/blog-redhat/posts/2017-07-11-cn-deprecation...

HTH, Fraser

Have a good day!

D. Vitenberg _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahost...