freeipa

#7007 Use CommonNameToSANDefault in default profile (new installs only)
Closed: fixed Opened by ftweedal.

Closed: fixed
Reopen Issue

Because clients (esp. Chrome) are beginning to ignore CN, it is
imperative that host/service certs issued by FreeIPA put DNS naming
information into the Subject Alt Name extension.

Until https://pagure.io/freeipa/issue/5323 is implement we don't have
a proper profile update machinery that is aware of what versions of
Dogtag are in the topology, but we can still improve the situation for
new installations - which will certainly use Dogtag 10.4 - by adding the
CommonNameToSANDefault profile component to the default
certificate profile in FreeIPA.

This patch is a small part of https://pagure.io/freeipa/issue/4970 but
I created this separate ticket so this particular aspect can be
triaged and merged independently.

master PR: https://github.com/freeipa/freeipa/pull/859

4.5 PR: https://github.com/freeipa/freeipa/pull/863

Metadata Update from @pvoborni:
- Issue priority set to: critical
- Issue set to the milestone: FreeIPA 4.5.3

master:

  • 1a35a2e213b46f3c5bb91d0f1b7fa05e8f051d4a (HEAD) Add CommonNameToSANDefault to default cert profile

ipa-4-5:

  • 33aa4c25a2c3d158e43978d8699c3776d0e06599 (HEAD) Add CommonNameToSANDefault to default cert profile

Metadata Update from @jcholast:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1475238

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1475238

Issue linked to Bugzilla: Bug 1475238
Metadata
None
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.