freeipa

#7042 Dogtag-generated CSR not recognized by external CA
Closed: invalid Opened by g5pw.

Closed: invalid
Reopen Issue

I'm installing FreeIPA with an external CA, using this command for the first install:

ipa-server-install --external-ca --subject="C=IT,ST=TS,L=Trieste,O=Mittelab,OU=eNOC" --auto-reverse --setup-dns

Now, when I try to sign the resulting CSR with my CA (a self-signed one generated by the openssl command) the signing fails because of a failed match for the ST field. The exact output is:

Using configuration from openssl.cnf
Check that the request matches the signature
Signature o
The stateOrProvinceName field is different between
CA certificate (TS) and the request (TS)

After a brief look with openssl asn1parse, it looks like the CA has all the fields encoded as Utf8String, but the CSR that Dogtag generates encodes the subject as PrintableString.

Is there any way to tell Dogtag to use Utf8String instead?

The CA is generated with the following command:

openssl req -nodes -new -newkey rsa:4096 -keyout private/ca.key \
            -sha512 -out certs/ca.crt \
            -extensions v3_ca -x509 -days 3650 \
            -config openssl.cnf \
            -subj "/C=IT/ST=TS/L=Trieste/O=Mittelab/OU=eNOC"

The command to sign the CSR is:

openssl ca  -md sha512 -batch -days 760 \
            -cert certs/ca.crt -keyfile private/ca.key \
            -in csr/ipa.csr -out certs/ipa.crt \
            -config openssl.cnf \
            -extensions v3_enhanced_intermediate_ca

I'm also attaching the openssl.cnf file.
openssl.cnf

I just noticed that if I set string_mask = default in my openssl.cnf, the issue persists!

The problem is:

[ policy_strict ]
...
stateOrProvinceName     = match
...

The match regime fails when the encoding differs, even if the encoded
values are equal. This directive needs to be relaxed either to supplied
(meaning that the attribute must be present in the CSR subject, but its
value does not matter) or optional (allowed to be absent; if present its
value does not matter).

This is a quirk of the the openssl ca(1) program and not a bug in
FreeIPA/Dogtag. It is valid for a CA to encode the same attribute value using UTF8String in the issuer DN and PrintableString in the subject DN, or vice versa
(unless it is a self-signed cert).

Could you confirm that relaxing that config (you may need to do it for other
attributes too) allows you to sign the cert?

Metadata Update from @ftweedal:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

Close invalid. @g5pw please re-open if you find that the steps above
do not resolve the issue.
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.