On 04/04/2012 08:51 AM, Rob Crittenden wrote:

In IPA we use a profile that automatically issues server certificates. It uses a pattern to pluck the hostname out of the CSR and sticks that into a user-configurable subject template.

The pattern is

policyset.serverCertSet.1.constraint.params.pattern=CN=[^,]+,.+

The template by default looks like

policyset.serverCertSet.1.default.params.name=CN=$request.req_subject_name.cn$, OU=pki-ipa, O=IPA

We discovered that if CN is an RDN in the subject template then certificates get the wrong subject.

For example, if we use CN=Test then the issued subject ends up being CN=Test, CN=Test.

If we use CN=Test, CN=Coyote, O=Acme the issued subject is CN=Coyote,CN=Test,CN=Coyote,O=Acme

We are creating the CSR with:

/usr/bin/certutil -d /etc/httpd/alias -R -s CN=pinto.example.com,OU=Test,CN=Coyote,O=Acme -o /var/lib/ipa/ipa-iem5hd/tmpcertreq -k rsa -g 2048 -z /etc/httpd/alias/noise.txt -f /etc/httpd/alias/pwdfile.txt -a

So my questions are:

1. Do we just need to tweak the pattern? 2. Do I need to ban CN as an element of subjects? If it exists anywhere in the subject template it messes up the replacemnt.

The regexp is not doing what you expect, or so I believe (I have not researched the regexp parser being used but I suspect it follows PCRE rules, i.e. Perl Regexp's). Your pattern of CN=[^,]+,.+ Is going to require there be at least two RDN's of which the first one has CN as it's type. It will then return that first RDN with CN as it's type and every RDN which follows it. Here's why, the first part of the regexp will match CN=xxx where xxx is anything not containing a comma, then it must be followed by a comma, and then it matches the entire rest of the string. Is that what you want? I suspect not. Are you just looking for the first RDN with CN as it's type? If so drop the ,.+ from the above regexp. FWIW, regexps are not a robust way to parse DN's, they don't handle escaped characters, multi-valued RDN's etc. But for the above case a regexp is probably OK, I don't think you'll run afoul of those problems in this simple scenario. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/