freeipa

#9276 certmap-match: show SAN fields, key usage, and extended key usage
Opened by cheimes. Modified

Open
Close Issue

Request for enhancement

To assist admins with writing certmap rules, please include SAN, KU, and EKU information in output.

The certmap match page in the browser UI at "Authentication -> Certificate Identity Mapping Rules -> Certificate Mapping Match" shows several properties of the certificate. However it is missing information about SAN fields like dNSName, RFC 822 name, directory name, principal name as well as key usage and extended key usage.

ipaserver.plugins.server and ipa cert-find --all --file /path/to/pem show all SAN fields, but not the KU and EKU fields.

$ ipa cert-find --all --file /var/lib/ipa/certs/httpd.crt
...
  Subject: CN=ipaserver.ipa.test,O=IPA.TEST
  Subject DNS name: ipaserver.ipa.test, ipa-ca.ipa.test
  Subject UPN: HTTP/ipaserver.ipa.test@IPA.TEST
  Subject Kerberos principal name: HTTP/ipaserver.ipa.test@IPA.TEST
  Subject Other Name: ...
  Issuer: CN=Certificate Authority,O=IPA.TEST
  Not Before: Wed Nov 16 13:33:58 2022 UTC
  Not After: Sat Nov 16 13:33:58 2024 UTC
  Fingerprint (SHA1): 44:00:d5:5c:99:02:e1:c8:e1:ca:ad:92:9d:ff:01:88:8c:d6:27:3d
  Fingerprint (SHA256): f7:bc:bf:1b:5c:e1:70:be:60:44:31:96:ab:eb:8a:a2:47:71:6d:a2:18:e0:0c:3b:d9:93:48:d2:e0:4d:c9:ae
  Serial number: 9
  Serial number (hex): 0x9
...
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.