Re: [Pki-devel] question on subject patterns
On 04/04/2012 08:51 AM, Rob Crittenden wrote:
In IPA we use a profile that automatically issues server
certificates.
It uses a pattern to pluck the hostname out of the CSR and sticks that
into a user-configurable subject template.
The pattern is
policyset.serverCertSet.1.constraint.params.pattern=CN=[^,]+,.+
The template by default looks like
policyset.serverCertSet.1.default.params.name=CN=$request.req_subject_name.cn$,
OU=pki-ipa, O=IPA
We discovered that if CN is an RDN in the subject template then
certificates get the wrong subject.
For example, if we use CN=Test then the issued subject ends up being
CN=Test, CN=Test.
If we use CN=Test, CN=Coyote, O=Acme the issued subject is
CN=Coyote,CN=Test,CN=Coyote,O=Acme
We are creating the CSR with:
/usr/bin/certutil -d /etc/httpd/alias -R -s
CN=pinto.example.com,OU=Test,CN=Coyote,O=Acme -o
/var/lib/ipa/ipa-iem5hd/tmpcertreq -k rsa -g 2048 -z
/etc/httpd/alias/noise.txt -f /etc/httpd/alias/pwdfile.txt -a
So my questions are:
1. Do we just need to tweak the pattern?
2. Do I need to ban CN as an element of subjects? If it exists anywhere
in the subject template it messes up the replacemnt.
The regexp is not doing what you expect, or so I believe (I have not
researched the regexp parser being used but I suspect it follows PCRE
rules, i.e. Perl Regexp's).
Your pattern of CN=[^,]+,.+
Is going to require there be at least two RDN's of which the first one
has CN as it's type. It will then return that first RDN with CN as it's
type and every RDN which follows it. Here's why, the first part of the
regexp will match CN=xxx where xxx is anything not containing a comma,
then it must be followed by a comma, and then it matches the entire rest
of the string. Is that what you want? I suspect not.
Are you just looking for the first RDN with CN as it's type? If so drop
the ,.+ from the above regexp.
FWIW, regexps are not a robust way to parse DN's, they don't handle
escaped characters, multi-valued RDN's etc. But for the above case a
regexp is probably OK, I don't think you'll run afoul of those problems
in this simple scenario.
--
John Dennis <jdennis(a)redhat.com>
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/