Per impromptu 10.2.6 meeting of 7/17/2015: 10.3

Per Bug Triage of 05/03/2016: 10.3.1

In discussions with vakwetu, we propose adding some additional fields to the default DN to provide for greater uniqueness. This would change pki_ca_signing_subject_dn from:

cn=CA Signing Certificate,o=%(pki_security_domain_name)s

to:

cn=CA Signing Certificate,ou=%(pki_instance_name)s,ou=%(pki_subsystem_name)s,o=%(pki_security_domain_name)s

Note that, by default, %(pki_subsystem_name)s is defined as:

CA %(pki_hostname)s %(pki_https_port),
KRA %(pki_hostname)s %(pki_https_port)s,
OCSP %(pki_hostname)s %(pki_https_port)s,
TKS %(pki_hostname)s %(pki_https_port)s, or
TPS %(pki_hostname)s %(pki_https_port)s

Obviously, consideration must be made for the following:

• Make certain that integrating products such as FreeIPA are not broken
• Make certain that any upgrade/migration is accounted for
• May need to account for ftweedal's subordinate CA model which may allow multiple subsystems of the same type to co-exist within the same PKI instance (e. g. - would they have a unique pki_subsystem_name to distinguish them from an instance's CA and/or each other?)
• Realize that an installer may override these values and reintroduce this problem (e. g. - by removing the hostname and/or port values from pki_subsystem_name)

If this proposal (or something like it) is implemented, all default DN values should be looked at to see if they require similar uniqueness consideration.

Per discussions with development and QE, it was noted that a simple workaround exists for this ticket by merely placing a revised value for pki_ca_signing_subject_dn in the pkispawn overrides file.

Consequently, it was determined to defer this ticket until 10.4, where we may possibly look at adding uniqueness to the default values of other DNs as well.

Per Offline Triage of 11/30/2016-12/01/2016: 10.4 - minor

Per CS/DS Meeting of August 7, 2017, it was determined to move this issue from 10.4 ==> FUTURE.

Per 10.5.x/10.6 Triage: FUTURE

RHBZ: CLOSED UPSTREAM

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2056

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.