freeipa

#9328 X509v3 Authority Key Identifier Extension in SSL certificate
Opened by ogonzales. Modified

Open
Close Issue

Request for enhancement

I want to add the "dirName" and "serial number" fields to the X509v3 Authority Key Identifier Extension in SSL certificates

Issue

I'm unable to generate a SSL certificate with the "dirName" and "serial number" fields in X509v3 Authority Key Identifier Extension. I only get the "keyid" field

Steps to Reproduce

  1. I add a SubCA with a specified subject line
  2. I customize a certificate profile to add the "serial number" and "dirName" as parameters in the Authority Key Identifier
  3. The customized certificate profile is successfully imported into my FreeIPA server
  4. I submit a request with ipa-getcert request using this customized certificate and this new SubCA

Actual behavior

An SSL is generated but the X509v3 Authority Key Identifier Extension shows only the "keyid" field

Expected behavior

An SSL is generated but the X509v3 Authority Key Identifier Extension with three fields: keyid, dirName and serial number.

Version/Release/Distribution

docker containerized FreeIPA server.
VERSION: 4.9.10, API_VERSION: 2.248

Additional info:

Here is part of the customized certificate profile I used to generate the SSL cert
policyset.serverCertSet.9.constraint.class_id=noConstraintImpl
policyset.serverCertSet.9.constraint.name=No Constraint
policyset.serverCertSet.9.default.class_id=authorityKeyIdentifierExtDefaultImpl
policyset.serverCertSet.9.default.name=Authority Key Identifier Extension Default
policyset.serverCertSet.9.default.params.authorityCertIssue="/C=US/ST=MIL/L=SWFTS/O=SWFTS/OU=SWFTS/CN=SWFTS"
policyset.serverCertSet.9.default.params.authorityCertSerialNumber=100

Please see attached capture for desired output

Capture.PNG

Can we see the actual commands you used to create the profile and submit the request using certmonger?

I added a host named as "myorg.ipa.test", then customized a certificate profile named as "myorg_cert_profile"

Here is the way I'm trying to request an SSL cert.

  1. ipa ca-add "my_org_subca" --subject="CN=MYORG,OU=MYORG,O=MYORG,L=MYORG,ST=MYORG,C=US"
  2. ipa certprofile-import --file=./myorg_cert_profile --desc "my org cert profile" -store TRUE myorg
  3. ipa caacl-add myorg_acl--hostcat=all
  4. ipa caacl-add-profile myorg_acl --certprofile myorg
  5. ipa caacl-add-ca myorg_acl --ca="my_org_subca"
  6. ipa-getcert request -g 4096 -k myorg.key -f myorg.pem N "cn=myorg.ipa.test -K host/myorg.ipa.test -X "my_org_subca" -T myorg -I myorg -r

Can we see the actual commands you used to create the profile and submit the request using certmonger?

I added a host named as "myorg.ipa.test", then customized a certificate profile named as "myorg_cert_profile"

Here is the way I'm trying to request an SSL cert.

ipa ca-add "my_org_subca" --subject="CN=MYORG,OU=MYORG,O=MYORG,L=MYORG,ST=MYORG,C=US"
ipa certprofile-import --file=./myorg_cert_profile --desc "my org cert profile" -store TRUE myorg
ipa caacl-add myorg_acl--hostcat=all
ipa caacl-add-profile myorg_acl --certprofile myorg
ipa caacl-add-ca myorg_acl --ca="my_org_subca"
ipa-getcert request -g 4096 -k myorg.key -f myorg.pem N "cn=myorg.ipa.test -K host/myorg.ipa.test -X "my_org_subca" -T myorg -I myorg -r

From reviewing the code, there is currently no way to set these fields.

The fields are optional, and rarely (if ever) used. Can you please explain your use case?

From reviewing the code, there is currently no way to set these fields.

The fields are optional, and rarely (if ever) used. Can you please explain your use case?

The above image is from SSL that was generated with openssl and its config file. The openssl conf has two attributes: keyid and issuer in the authority key identifier. Also the critical attribute is set as True.

I'm trying to generate the same SSL certificate with FreeIPA CA in order to meet organizational requirements

Will there be an operational impact if the fields are omitted? Most likely there will not be, but I cannot say for sure what the relying programs in your organisation expect.

If this is just a "tick the box", all I can suggest would be to push back and say it's not supported, but that there should not be any operational impact.

Copy. Thank you!
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.