freeipa

#6858 RFE - Option to add custom OID or display name in IPA Cert
Closed: fixed Opened by pvoborni.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1427105

Please note that this Bug is private and may not be accessible as it contains confidential Red Hat customer information.

Description of problem:
RFE - Option to add custom OID or display name in IPA Cert
Something like this should be accepted
Template display name: Foobar Subordinate Certification Authority
Object identifier: <custome oid>
ipa-server-install --external-ca-type=ms-cs --external-ca --subject="O=Foobar 
Corp/OU=Linux Dev/C=US/ST=NY/L=FooBar"
The OID that is created with the above installation options ends up having the
following:
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: O=Foobar Corp/OU=Linux Dev/C=US/ST=NY/L=FooBar, CN=Certificate Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    <REMOVED>
                Exponent: 65537 (0x10001)
        Attributes:
        Requested Extensions:
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
...
However some companies uses different time of naming convention & needs
different OID. For example something like below might be needed.
Template display name: Foobar Subordinate Certification Authority
Object identifier: <custom oid>
This is only for one environment, too. Two of our other environments do not
share the same OID. Due to these restrictions that we have, a dynamic name and
OID are necessary for us to actually be able to utilize the template field.
Justification:
It is not uncommon for organizations to utilize custom CA templates. They also
said that I may be off base by stating that an OID needs to be set; the
template name may be enough. Currently, though, I am not able to use the IdM
server as a sub CA like the feature --external-ca-type=ms-cs is implying.
Attempting this approach, will help avoiding another offline root CA, if at all possible.

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1427105

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1427105

I'm taking this one. (For some reason I cannot change ticket metadata
to assign myself).

@ftweedal you need to be a project member to assign tickets to yourself.

Metadata Update from @mbasti:
- Issue assigned to ftweedal

@cheimes how do I become a project member on pagure?

@ftweedal I granted you "ticket" permissions for freeipa project

Metadata Update from @ftweedal:
- Issue set to the milestone: FreeIPA 4.6 (was: Future Releases)

PR: https://github.com/freeipa/freeipa/pull/930

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.6.1 (was: FreeIPA 4.6)

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.6.2 (was: FreeIPA 4.6.1)

master:

  • c5afee964eee0cdf81a4f22fd78a6838a3da7537 cli: simplify parsing of arbitrary types
  • 1699cff3501519982d896bd5d5add233d12b0f00 Remove duplicate references to external CA type
  • b4365e3a7fa2fb1d4e7ffc41f21c23e3d369ffd6 install: allow specifying external CA template
  • fc7c684b122cbcf1ff31c0ee45551388abb588fc ipa-ca-install: add --external-ca-profile option
  • 2207dc5c172710471f3c7c77242cb2ba1fcfa779 certmonger: refactor 'resubmit_request' and 'modify'
  • 560ee3c0b512cbb8cdc4099a81204e745a515f7c certmonger: add support for MS V2 template
  • 29f4ec865b2d0654e7e46c8a089a04f23ea9a00c ipa-cacert-manage: support MS V2 template extension
  • d43cf35cca4e7b84801bbbd5b1bb910d6a5e453a Add tests for external CA profile specifiers
  • 49c0a7b4d4ec5ddef7f9648be72ccacb15c28840 ipa-cacert-manage: handle alternative tracking request CA name
  • 75a2eda85d7e9769f612733a6ade5719b1511c09 ipa-cacert-manage: avoid some duplicate string definitions

ipa-4-6:

  • 61303c73a20f45499c70add171478c96eb24305e cli: simplify parsing of arbitrary types
  • 6de5432d25723b5ae4af88bf126fb48862abc8ce Remove duplicate references to external CA type
  • f612678ad6af006bd3bb949db119d126c0ba1822 install: allow specifying external CA template
  • 0054cfb7ebd41fb39a92d71e623cf2cbf8365de3 ipa-ca-install: add --external-ca-profile option
  • 9774af3dc7c1ddf0b8f4386ce599c64dbcf38120 certmonger: refactor 'resubmit_request' and 'modify'
  • 9d8c2fcf2407487a2273e980ef78268369b39cbd certmonger: add support for MS V2 template
  • 562f114aad4dc674f87f6264ff123b9f0cf403f9 ipa-cacert-manage: support MS V2 template extension
  • 05be8398572fc517e4adc48b2454a68bc402ce26 Add tests for external CA profile specifiers
  • d07563b744060a4c4d02cb44de20d5589800f38e ipa-cacert-manage: handle alternative tracking request CA name
  • 78d0122c938cc31d288116370ec1a14d5bddd7f8 ipa-cacert-manage: avoid some duplicate string definitions

Metadata Update from @pvomacka:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.