[Pki-users] Configurable Subject Alt Name in Cert Profile?

[ryan.millay at gdc4s.com]

RHEL 5.8

Red Hat CS 8.1

 

I'm hoping this should be a relatively straight forward question and
others have run into something similar:

 

When generating a certificate, is it possible to dynamically include/not
include the Subject Alt Name field based on an LDAP parameter?  When
looking at the certificate profile there's a "subjAltExtGNEnable"
parameter, but I don't believe that can be set to a request parameter,
like $request.includeSAN$ for example, based on the testing I've done.

 

Assuming that the "subjAltExtGNEnable" field must be static text,
perhaps there is another work around.  If included, the Subject Alt Name
in this case would represent a user's full DN.  If not included, the
request parameter could be left blank and the Subject Alt Name would be
empty.  Here's a little snippet from the cert profile:

 

policyset.CSCertSet.7.constraint.class_id=noConstraintImpl

policyset.CSCertSet.7.constraint.name=No Constraint

policyset.CSCertSet.7.default.class_id=subjectAltNameExtDefaultImpl

policyset.CSCertSet.7.default.name=Subject Alternative Name Extension
Default

policyset.CSCertSet.7.default.params.subjAltExtGNEnable_0=true

policyset.CSCertSet.7.default.params.subjAltExtGNEnable_1=false

policyset.CSCertSet.7.default.params.subjAltExtGNEnable_2=false

policyset.CSCertSet.7.default.params.subjAltExtGNEnable_3=false

policyset.CSCertSet.7.default.params.subjAltExtGNEnable_4=false

policyset.CSCertSet.7.default.params.subjAltExtPattern_0=$request.pkispo
nsordn$

policyset.CSCertSet.7.default.params.subjAltExtPattern_1=

policyset.CSCertSet.7.default.params.subjAltExtPattern_2=

policyset.CSCertSet.7.default.params.subjAltExtPattern_3=

policyset.CSCertSet.7.default.params.subjAltExtPattern_4=

policyset.CSCertSet.7.default.params.subjAltExtType_0=DirectoryName

policyset.CSCertSet.7.default.params.subjAltExtType_1=RFC822Name

policyset.CSCertSet.7.default.params.subjAltExtType_2=RFC822Name

policyset.CSCertSet.7.default.params.subjAltExtType_3=RFC822Name

policyset.CSCertSet.7.default.params.subjAltExtType_4=RFC822Name

policyset.CSCertSet.7.default.params.subjAltNameExtCritical=false

 

The issue that arises here is the CA fails with an IO exception from the
$request.pkisponsordn$ format.  That value is a user DN, similar to 

CN=FIRSTNAME.LASTNAME, OU=ORGANIZATION, OU=ORGANIZATION2, O=COUNTRY,
C=COUNTRYCODE.  The CA's debug log shows the '=' and the ',' being
escaped by backslashes.  The CA then fails to populate the Subject Alt
Name due to the following error:

 

SubjectAltNameExtDefault: populate java.io.IOException: Unknown AVA
keyword 'CN\'.

 

Is there a way to properly escape the user DN so it can be used in the
Subject Alt Name?  Again, the ultimate goal being the user DN could be
populated or not.  If populated, it is included as the Subject Alt Name.
If not populated, the Subject Alt Name is left blank when the
certificate is generated.

 

Thank you,

 

Ryan Millay

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/pki-users/attachments/20130121/646fdd74/attachment.htm>