freeipa

#6987 ca-add: invalid X.509 DN fails ungracefully
Closed: fixed Opened by ftweedal.

Closed: fixed
Reopen Issue

When the given subject DN is a valid DN but not a valid X.509 DN,
the DN gets passed on to Dogtag where it fails, causing an ungraceful
failure in IPA:

[root@ipaserver01 ~]# ipa ca-add
Name: SampleCA
Subject DN: CN=SampleCA,DN=testrelm.test
ipa: ERROR: Request failed with status 400: Non-2xx response from CA REST API: 400. java.lang.IllegalArgumentException: Invalid Subject DN: CN=SampleCA,DN=testrelm.test

Check that attributes are valid X.509 attributes either explicitly or
perhaps via python-cryptography Name class.

Bug indicated at https://bugzilla.redhat.com/show_bug.cgi?id=1452617#c4
but note that this BZ tracks a separate (and more severe) issue.

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

PR: https://github.com/freeipa/freeipa/pull/824

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.6

master:

  • 5f0e13ce9c3d1ead02de61a148de973fc6787b96 ca-add: validate Subject DN name attributes

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.