Re: [Pki-users] Problem with Subject Alternative Name Extension

Dear pki-users. I'm trying to setup a pki-ca instance to produce X509 certificates which include a Subject Alternative Name Extension with the following attributes: Criticality = not critical Type = RFC822Name Value = the email of the requestor. I'm using the Signed CMC-Authenticated User Certificate Enrollment profile and this is the relevant section of my /var/lib/pki-ca/profiles/ca/caFullCMCUserCert.cfg file: policyset.cmcUserCertSet.8.constraint.class_id=extensionConstraintImpl policyset.cmcUserCertSet.8.constraint.name=Extension Constraint policyset.cmcUserCertSet.8.constraint.params.extCritical=false policyset.cmcUserCertSet.8.constraint.params.extOID=2.5.29.17 policyset.cmcUserCertSet.8.default.class_id=subjectAltNameExtDefaultImpl policyset.cmcUserCertSet.8.default.name=Subject Alternative Name Extension Default policyset.cmcUserCertSet.8.default.params.subjAltExtGNEnable_0=true policyset.cmcUserCertSet.8.default.params.subjAltExtPattern_0=$request.requestor_email$ policyset.cmcUserCertSet.8.default.params.subjAltExtType_0=RFC822Name policyset.cmcUserCertSet.8.default.params.subjAltNameExtCritical=false policyset.cmcUserCertSet.8.default.params.subjAltNameNumGNs=1 The input certificate request is generated using certutil and CMCEnroll and the command used is the following: certutil -R -g 2048 -s "<the-subject>" -7"<the-requestor-email>" -d<a-local-dir> …… The certificate is generated, but the extension is not populated with the email address and I always get: Identifier: Subject Alternative Name - 2.5.29.17 Critical: no Value: RFC822Name: $request.requestor_email$