Hi,

related to RFC6125 ( Best practice checking server identities) i have to create a cert profile which adds the Common name from the subject into a SAN.

So far so good, this works now with this config.

policyset.cmcServerCert.10.constraint.class_id=noConstraintImpl

policyset. cmcServerCert.10.constraint.name=No Constraint

policyset. cmcServerCert.10.default.class_id=subjectAltNameExtDefaultImpl

policyset. cmcServerCert.10.default.name=Subject Alt Name Constraint

policyset. cmcServerCert.10.default.params.subjAltNameExtCritical=false

policyset. cmcServerCert.10.default.params.subjAltExtGNEnable=true

policyset. cmcServerCert.10.default.params.subjAltExtGNEnable_0=true

policyset. cmcServerCert.10.default.params.subjAltExtType_0=DNSName

policyset. cmcServerCert.10.default.params.subjAltExtPattern_0=$request.req_subject_name.cn$

policyset. cmcServerCert.10.default.params.subjAltNameNumGNs=1

Now I have to add additional SANS if the user sends them in the request.

CSR part:

Requested Extensions:

            X509v3 Subject Alternative Name:

                DNS:mywebservice.example.com, DNS:mywebservicealias.example.com

With this config, it is possible to take the SANS out of the csr and bring that in the cert..

policyset. cmcServerCert.9.constraint.class_id=noConstraintImpl

policyset. cmcServerCert.9.constraint.name=No Constraint

policyset. cmcServerCert.9.constraint.subjAltNameExtCritical=false

policyset. cmcServerCert.9.default.class_id=userExtensionDefaultImpl

policyset. cmcServerCert.9.default.name=User Supplied Extension Default

policyset. cmcServerCert.9.default.params.userExtOID=2.5.29.17

The problem what I had is that I had to take the SANS out of the request and then ADD the cn out of the subjet as SAN too.

I’m not able to get this working.

Please help.

Thanks in advanced.

Br

florian