freeipa

#7496 csrgen fails if subject base contains lower-case attribute names
Closed: fixed Opened by ftweedal.

Closed: fixed
Reopen Issue

OpenSSL requires attribute short names ("CN", "O", etc) to be in
upper case, otherwise it fails to add the attribute. This can be
triggered when FreeIPA has been installed with --subject-base
containing a lower-case attribute shortname (e.g.
--subject-base="o=Red Hat").

For example:

ftweedal% ipa config-show |grep Subject
  Certificate Subject base: o=IPA.LOCAL 201804101556                                
ftweedal% ipa cert-request --principal alice --private-key ~
/dev/cert/req/key-rsa.pem --csr-profile-id userCert 
ipa: ERROR: error:0D06407A:lib(13):func(100):reason(122)                                                 
error:0B073043:lib(11):func(115):reason(67)

There is also a py3 bytes/str bug that prevents the above error message appearing,
which will be dealt with in the course of fixing this issue.

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

PR: https://github.com/freeipa/freeipa/pull/1813

Metadata Update from @ftweedal:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1813

master:

  • 53f87ee5cd9d19f6fb91a9a1eafc8ea798095954 py3: fix csrgen error handling
  • 7633d62d858c14523a99143aa0ff36f76bb4ff68 csrgen: support initialising OpenSSL adaptor with key object
  • 0ac1d3ea62efd9751fcc59cea46bcdafe1f11c37 csrgen: drive-by docstring
  • 852618fd6529fbdd7b03077fae37c6fbbe45b51b csrgen: fix when attribute shortname is lower case

ipa-4-6:

  • 7b8837cc828ac24e5e10fcb92d398bf42d37b88d py3: fix csrgen error handling
  • 76a7c15a42d9821dd074031e6af21efdcff5aaf3 csrgen: support initialising OpenSSL adaptor with key object
  • 9727ffdaa68dfdb08b3c42e52ba35d0773f3e829 csrgen: drive-by docstring
  • ea5a3da48fc1e9da58adccd6ed5cca90d1d4afef csrgen: fix when attribute shortname is lower case

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/1813
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.