RHEL 5.8
Red Hat CS 8.1
I’m hoping this should be a relatively straight forward question and others have run into something similar:
When generating a certificate, is it possible to dynamically include/not include the Subject Alt Name field based on an LDAP parameter? When looking at the certificate profile there’s a “subjAltExtGNEnable” parameter, but I don’t believe that can be set to a request parameter, like $request.includeSAN$ for example, based on the testing I’ve done.
Assuming that the “subjAltExtGNEnable” field must be static text, perhaps there is another work around. If included, the Subject Alt Name in this case would represent a user’s full DN. If not included, the request parameter could be left blank and the Subject Alt Name would be empty. Here’s a little snippet from the cert profile:
policyset.CSCertSet.7.constraint.class_id=noConstraintImpl
policyset.CSCertSet.7.constraint.name=No Constraint
policyset.CSCertSet.7.default.class_id=subjectAltNameExtDefaultImpl
policyset.CSCertSet.7.default.name=Subject Alternative Name Extension Default
policyset.CSCertSet.7.default.params.subjAltExtGNEnable_0=true
policyset.CSCertSet.7.default.params.subjAltExtGNEnable_1=false
policyset.CSCertSet.7.default.params.subjAltExtGNEnable_2=false
policyset.CSCertSet.7.default.params.subjAltExtGNEnable_3=false
policyset.CSCertSet.7.default.params.subjAltExtGNEnable_4=false
policyset.CSCertSet.7.default.params.subjAltExtPattern_0=$request.pkisponsordn$
policyset.CSCertSet.7.default.params.subjAltExtPattern_1=
policyset.CSCertSet.7.default.params.subjAltExtPattern_2=
policyset.CSCertSet.7.default.params.subjAltExtPattern_3=
policyset.CSCertSet.7.default.params.subjAltExtPattern_4=
policyset.CSCertSet.7.default.params.subjAltExtType_0=DirectoryName
policyset.CSCertSet.7.default.params.subjAltExtType_1=RFC822Name
policyset.CSCertSet.7.default.params.subjAltExtType_2=RFC822Name
policyset.CSCertSet.7.default.params.subjAltExtType_3=RFC822Name
policyset.CSCertSet.7.default.params.subjAltExtType_4=RFC822Name
policyset.CSCertSet.7.default.params.subjAltNameExtCritical=false
The issue that arises here is the CA fails with an IO exception from the $request.pkisponsordn$ format. That value is a user DN, similar to
CN=FIRSTNAME.LASTNAME, OU=ORGANIZATION, OU=ORGANIZATION2, O=COUNTRY, C=COUNTRYCODE. The CA’s debug log shows the ‘=’ and the ‘,’ being escaped by backslashes. The CA then fails to populate the Subject Alt Name due to the following error:
SubjectAltNameExtDefault: populate java.io.IOException: Unknown AVA keyword ‘CN\’.
Is there a way to properly escape the user DN so it can be used in the Subject Alt Name? Again, the ultimate goal being the user DN could be populated or not. If populated, it is included as the Subject Alt Name. If not populated, the Subject Alt Name is left blank when the certificate is generated.
Thank you,
Ryan Millay