This is the same info I supplied for another IPA ticket, https://fedorahosted.org/freeipa/ticket/3977 : https://access.redhat.com/site/documentation//en-US/Red_Hat_Certificate_Syst... I think that's what you are looking for. Give it a try and let me know. Christina On 06/11/2014 09:44 PM, Fraser Tweedale wrote:
Hi all,
Currently the ExtendedKeyUsageExtDefault unconditionally sets the EKU info for the certificate according to its configuration. If an EKU extension is present in a signing request, it gets clobbered.
This is apparently a cause for confusion (see https://fedorahosted.org/freeipa/ticket/2915), but because the policy default is always paired with a policy constraint, it is possible to copy the EKU from the request and allow the constraint to reject unacceptable values.
Implementing this behaviour seems reasonable to me (and it would resolve the above ticket) but I only have a newcomer's view of the profiles system. Perhaps "multitude of profiles" is preferred over "versatile profiles", or things must remain as they are for other reasons. I appreciate your input!
(A side note: There are several profiles that use NoConstraint with ExtendedKeyUsageExtDefault; to preserve existing behaviour, these would have to be changed to use ExtendedKeyUsageExtConstraint, configured to match the default).
Cheers,
Fraser
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel