I've hit a roadblock while trying to generate a certificate for a VMware vSphere appliance. The VMware "Certificate Management" tool doesn't allow one to upload a certificate and key.  Instead, one has to generate a CSR in the VMware GUI which then gets submitted to the CA (IPA in this case). Unfortunately, the VMware tool refuses to generate a CSR that does not include an email address in its subject alternative names extension, and IPA refuses to issue a host or service certificate that includes an email address. Is it possible to create a certificate profile that will simply ignore the email address (i.e. not include it in the SAN of the issued certificate)?

Ian Pilcher via FreeIPA-users wrote: > I've hit a roadblock while trying to generate a certificate for > a VMware vSphere appliance. > > The VMware "Certificate Management" tool doesn't allow one to > upload a certificate and key.  Instead, one has to generate a > CSR in the VMware GUI which then gets submitted to the CA (IPA > in this case). > > Unfortunately, the VMware tool refuses to generate a CSR that > does not include an email address in its subject alternative > names extension, and IPA refuses to issue a host or service > certificate that includes an email address. > > Is it possible to create a certificate profile that will simply > ignore the email address (i.e. not include it in the SAN of the > issued certificate)? > IPA doesn't allow a CSR that has a RFC822Name SAN for a non-user. This validation happens before the CSR is submitted to the CA. You'd have to modify code to drop this requirement.