4:56 a.m.
Hi list,
I'm currently trying to add some extensions (For puppet trusted
factshttps://docs.puppet.com/puppet/latest/ssl_attributes_extensions.html)
to my certificates. As far as I understand, I have to create / modify
a profile to do so. From the CSR, I can see the request extension
Requested Extensions:
1.3.6.1.4.1.34380.1.1.13:
..my_puppet_role
X509v3 Subject Alternative Name:
So basically the question is how to declare 1.3.6.1.4.1.34380.1.1.13
retrieve it's value in $request$ ? Is there something similar,
somewhere that I can use as an example ? a doc to read ?
Many thanks
Joris
6:05 p.m.
you could try to mofidy a profile for SSL server certificat enrollment:
cp
-p /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg
/var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg.orig
vim /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg
...snip...
policyset.serverCertSet.list=1,2,3,4,5,6,7,8,pp
...snip...
policyset.serverCertSet.pp.constraint.class_id=extensionConstraintImpl
policyset.serverCertSet.pp.constraint.name=Extension Constraint
policyset.serverCertSet.pp.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.13
policyset.serverCertSet.pp.constraint.params.extCritical=false
policyset.serverCertSet.pp.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp.default.name=User Supplied Key Usage Extension
policyset.serverCertSet.pp.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.13
policyset.serverCertSet.pp.default.params.userExtCritical=false
restart the CA and apply a CSR to the modified profile that has a user
supplied extension for that OID, and a value, they should then appear in
the X509v3 extensions of the issued certificate
On Thu, Dec 8, 2016 at 2:56 AM, joris dedieu <joris.dedieu(a)gmail.com> wrote:
Hi list,
I'm currently trying to add some extensions (For puppet trusted
factshttps://docs.puppet.com/puppet/latest/ssl_attributes_extensions.html)
to my certificates. As far as I understand, I have to create / modify
a profile to do so. From the CSR, I can see the request extension
Requested Extensions:
1.3.6.1.4.1.34380.1.1.13:
..my_puppet_role
X509v3 Subject Alternative Name:
So basically the question is how to declare 1.3.6.1.4.1.34380.1.1.13
retrieve it's value in $request$ ? Is there something similar,
somewhere that I can use as an example ? a doc to read ?
Many thanks
Joris
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
3:50 a.m.
Hi Marc,
2016-12-09 1:05 GMT+01:00 Marc Sauton <msauton(a)redhat.com>:
you could try to mofidy a profile for SSL server certificat
enrollment:
cp -p /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg
/var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg.orig
vim /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg
...snip...
policyset.serverCertSet.list=1,2,3,4,5,6,7,8,pp
...snip...
policyset.serverCertSet.pp.constraint.class_id=extensionConstraintImpl
policyset.serverCertSet.pp.constraint.name=Extension Constraint
policyset.serverCertSet.pp.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.13
policyset.serverCertSet.pp.constraint.params.extCritical=false
policyset.serverCertSet.pp.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp.default.name=User Supplied Key Usage Extension
policyset.serverCertSet.pp.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.13
policyset.serverCertSet.pp.default.params.userExtCritical=false
Excellent, it works like a charm ! I just changed
extensionConstraintImpl to noConstraintImpl so that the extensions are
not mandatory anymore. Here the complete puppet trusted facts
sequence. Useful to use DogTag (FreeIPA in my case) as an external
pki for Puppet.
Many thanks
Joris
policyset.serverCertSet.pp1.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp1.constraint.name=Puppet Node UUID (pp_uuid)
policyset.serverCertSet.pp1.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.1
policyset.serverCertSet.pp1.constraint.params.extCritical=false
policyset.serverCertSet.pp1.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp1.default.name=Puppet Node UUID (pp_uuid)
policyset.serverCertSet.pp1.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.1
policyset.serverCertSet.pp1.default.params.userExtCritical=false
policyset.serverCertSet.pp2.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp2.constraint.name=Puppet Node Instance ID
(pp_instance_id)
policyset.serverCertSet.pp2.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.2
policyset.serverCertSet.pp2.constraint.params.extCritical=false
policyset.serverCertSet.pp2.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp2.default.name=Puppet Node Instance ID
(pp_instance_id)
policyset.serverCertSet.pp2.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.2
policyset.serverCertSet.pp2.default.params.userExtCritical=false
policyset.serverCertSet.pp3.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp3.constraint.name=Puppet Node Image Name
(pp_image_name)
policyset.serverCertSet.pp3.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.3
policyset.serverCertSet.pp3.constraint.params.extCritical=false
policyset.serverCertSet.pp3.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp3.default.name=Puppet Node Image Name (pp_image_name)
policyset.serverCertSet.pp3.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.3
policyset.serverCertSet.pp3.default.params.userExtCritical=false
policyset.serverCertSet.pp4.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp4.constraint.name=Puppet Node Preshared Key
(pp_preshared_key)
policyset.serverCertSet.pp4.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.4
policyset.serverCertSet.pp4.constraint.params.extCritical=false
policyset.serverCertSet.pp4.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp4.default.name=Puppet Node Preshared Key
(pp_preshared_key)
policyset.serverCertSet.pp4.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.4
policyset.serverCertSet.pp4.default.params.userExtCritical=false
policyset.serverCertSet.pp5.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp5.constraint.name=Puppet Node Cost Center
Name (pp_cost_center)
policyset.serverCertSet.pp5.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.5
policyset.serverCertSet.pp5.constraint.params.extCritical=false
policyset.serverCertSet.pp5.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp5.default.name=Puppet Node Cost Center Name
(pp_cost_center)
policyset.serverCertSet.pp5.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.5
policyset.serverCertSet.pp5.default.params.userExtCritical=false
policyset.serverCertSet.pp6.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp6.constraint.name=Puppet Node Product Name
(pp_product)
policyset.serverCertSet.pp6.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.6
policyset.serverCertSet.pp6.constraint.params.extCritical=false
policyset.serverCertSet.pp6.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp6.default.name=Puppet Node Product Name (pp_product)
policyset.serverCertSet.pp6.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.6
policyset.serverCertSet.pp6.default.params.userExtCritical=false
policyset.serverCertSet.pp7.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp7.constraint.name=Puppet Node Project Name
(pp_project)
policyset.serverCertSet.pp7.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.7
policyset.serverCertSet.pp7.constraint.params.extCritical=false
policyset.serverCertSet.pp7.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp7.default.name=Puppet Node Project Name (pp_project)
policyset.serverCertSet.pp7.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.7
policyset.serverCertSet.pp7.default.params.userExtCritical=false
policyset.serverCertSet.pp8.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp8.constraint.name=Puppet Node Application
Name (pp_application)
policyset.serverCertSet.pp8.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.8
policyset.serverCertSet.pp8.constraint.params.extCritical=false
policyset.serverCertSet.pp8.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp8.default.name=Puppet Node Application Name
(pp_application)
policyset.serverCertSet.pp8.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.8
policyset.serverCertSet.pp8.default.params.userExtCritical=false
policyset.serverCertSet.pp9.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp9.constraint.name=Puppet Node Service Name
(pp_service)
policyset.serverCertSet.pp9.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.9
policyset.serverCertSet.pp9.constraint.params.extCritical=false
policyset.serverCertSet.pp9.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp9.default.name=Puppet Node Service Name (pp_service)
policyset.serverCertSet.pp9.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.9
policyset.serverCertSet.pp9.default.params.userExtCritical=false
policyset.serverCertSet.pp10.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp10.constraint.name=Puppet Node Employee Name
(pp_employee)
policyset.serverCertSet.pp10.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.10
policyset.serverCertSet.pp10.constraint.params.extCritical=false
policyset.serverCertSet.pp10.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp10.default.name=Puppet Node Employee Name
(pp_employee)
policyset.serverCertSet.pp10.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.10
policyset.serverCertSet.pp10.default.params.userExtCritical=false
policyset.serverCertSet.pp11.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp11.constraint.name=Puppet Node created_by
Tag (pp_created_by)
policyset.serverCertSet.pp11.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.11
policyset.serverCertSet.pp11.constraint.params.extCritical=false
policyset.serverCertSet.pp11.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp11.default.name=Puppet Node created_by Tag
(pp_created_by)
policyset.serverCertSet.pp11.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.11
policyset.serverCertSet.pp11.default.params.userExtCritical=false
policyset.serverCertSet.pp12.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp12.constraint.name=Puppet Node Environment
Name (pp_environment)
policyset.serverCertSet.pp12.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.12
policyset.serverCertSet.pp12.constraint.params.extCritical=false
policyset.serverCertSet.pp12.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp12.default.name=Puppet Node Environment Name
(pp_environment)
policyset.serverCertSet.pp12.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.12
policyset.serverCertSet.pp12.default.params.userExtCritical=false
policyset.serverCertSet.pp13.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp13.constraint.name=Puppet Node Role Name (pp_role)
policyset.serverCertSet.pp13.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.13
policyset.serverCertSet.pp13.constraint.params.extCritical=false
policyset.serverCertSet.pp13.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp13.default.name=Puppet Node Role Name (pp_role)
policyset.serverCertSet.pp13.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.13
policyset.serverCertSet.pp13.default.params.userExtCritical=false
policyset.serverCertSet.pp14.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp14.constraint.name=Puppet Node Software
Version (pp_software_version)
policyset.serverCertSet.pp14.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.14
policyset.serverCertSet.pp14.constraint.params.extCritical=false
policyset.serverCertSet.pp14.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp14.default.name=Puppet Node Software Version
(pp_software_version)
policyset.serverCertSet.pp14.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.14
policyset.serverCertSet.pp14.default.params.userExtCritical=false
policyset.serverCertSet.pp15.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp15.constraint.name=Puppet Node Department
Name (pp_department)
policyset.serverCertSet.pp15.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.15
policyset.serverCertSet.pp15.constraint.params.extCritical=false
policyset.serverCertSet.pp15.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp15.default.name=Puppet Node Department Name
(pp_department)
policyset.serverCertSet.pp15.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.15
policyset.serverCertSet.pp15.default.params.userExtCritical=false
policyset.serverCertSet.pp16.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp16.constraint.name=Puppet Node Cluster Name
(pp_cluster)
policyset.serverCertSet.pp16.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.16
policyset.serverCertSet.pp16.constraint.params.extCritical=false
policyset.serverCertSet.pp16.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp16.default.name=Puppet Node Cluster Name (pp_cluster)
policyset.serverCertSet.pp16.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.16
policyset.serverCertSet.pp16.default.params.userExtCritical=false
policyset.serverCertSet.pp17.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp17.constraint.name=Puppet Node Provisioner
Name (pp_provisioner)
policyset.serverCertSet.pp17.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.17
policyset.serverCertSet.pp17.constraint.params.extCritical=false
policyset.serverCertSet.pp17.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp17.default.name=Puppet Node Provisioner Name
(pp_provisioner)
policyset.serverCertSet.pp17.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.17
policyset.serverCertSet.pp17.default.params.userExtCritical=false
policyset.serverCertSet.pp18.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp18.constraint.name=Puppet Node Region Name (pp_region)
policyset.serverCertSet.pp18.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.18
policyset.serverCertSet.pp18.constraint.params.extCritical=false
policyset.serverCertSet.pp18.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp18.default.name=Puppet Node Region Name (pp_region)
policyset.serverCertSet.pp18.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.18
policyset.serverCertSet.pp18.default.params.userExtCritical=false
policyset.serverCertSet.pp19.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp19.constraint.name=Puppet Node Datacenter
Name (pp_datacenter)
policyset.serverCertSet.pp19.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.19
policyset.serverCertSet.pp19.constraint.params.extCritical=false
policyset.serverCertSet.pp19.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp19.default.name=Puppet Node Datacenter Name
(pp_datacenter)
policyset.serverCertSet.pp19.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.19
policyset.serverCertSet.pp19.default.params.userExtCritical=false
policyset.serverCertSet.pp20.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp20.constraint.name=Puppet Node Zone Name (pp_zone)
policyset.serverCertSet.pp20.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.20
policyset.serverCertSet.pp20.constraint.params.extCritical=false
policyset.serverCertSet.pp20.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp20.default.name=Puppet Node Zone Name (pp_zone)
policyset.serverCertSet.pp20.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.20
policyset.serverCertSet.pp20.default.params.userExtCritical=false
policyset.serverCertSet.pp21.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp21.constraint.name=Puppet Node Network Name
(pp_network)
policyset.serverCertSet.pp21.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.21
policyset.serverCertSet.pp21.constraint.params.extCritical=false
policyset.serverCertSet.pp21.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp21.default.name=Puppet Node Network Name (pp_network)
policyset.serverCertSet.pp21.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.21
policyset.serverCertSet.pp21.default.params.userExtCritical=false
policyset.serverCertSet.pp22.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp22.constraint.name=Puppet Node Security
Policy Name (pp_securitypolicy)
policyset.serverCertSet.pp22.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.22
policyset.serverCertSet.pp22.constraint.params.extCritical=false
policyset.serverCertSet.pp22.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp22.default.name=Puppet Node Security Policy
Name (pp_securitypolicy)
policyset.serverCertSet.pp22.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.22
policyset.serverCertSet.pp22.default.params.userExtCritical=false
policyset.serverCertSet.pp23.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp23.constraint.name=Puppet Node Cloud
Platform Name (pp_cloudplatform)
policyset.serverCertSet.pp23.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.23
policyset.serverCertSet.pp23.constraint.params.extCritical=false
policyset.serverCertSet.pp23.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp23.default.name=Puppet Node Cloud Platform
Name (pp_cloudplatform)
policyset.serverCertSet.pp23.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.23
policyset.serverCertSet.pp23.default.params.userExtCritical=false
policyset.serverCertSet.pp24.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp24.constraint.name=Puppet Node Application
Tier (pp_apptier)
policyset.serverCertSet.pp24.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.24
policyset.serverCertSet.pp24.constraint.params.extCritical=false
policyset.serverCertSet.pp24.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp24.default.name=Puppet Node Application Tier
(pp_apptier)
policyset.serverCertSet.pp24.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.24
policyset.serverCertSet.pp24.default.params.userExtCritical=false
policyset.serverCertSet.pp25.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp25.constraint.name=Puppet Node Hostname (pp_hostname)
policyset.serverCertSet.pp25.constraint.params.extOID=1.3.6.1.4.1.34380.1.1.25
policyset.serverCertSet.pp25.constraint.params.extCritical=false
policyset.serverCertSet.pp25.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp25.default.name=Puppet Node Hostname (pp_hostname)
policyset.serverCertSet.pp25.default.params.userExtOID=1.3.6.1.4.1.34380.1.1.25
policyset.serverCertSet.pp25.default.params.userExtCritical=false
restart the CA and apply a CSR to the modified profile that has a user
supplied extension for that OID, and a value, they should then appear in the
X509v3 extensions of the issued certificate
On Thu, Dec 8, 2016 at 2:56 AM, joris dedieu <joris.dedieu(a)gmail.com> wrote:
>
> Hi list,
> I'm currently trying to add some extensions (For puppet trusted
> factshttps://docs.puppet.com/puppet/latest/ssl_attributes_extensions.html)
> to my certificates. As far as I understand, I have to create / modify
> a profile to do so. From the CSR, I can see the request extension
>
>
> Requested Extensions:
> 1.3.6.1.4.1.34380.1.1.13:
> ..my_puppet_role
> X509v3 Subject Alternative Name:
>
> So basically the question is how to declare 1.3.6.1.4.1.34380.1.1.13
> retrieve it's value in $request$ ? Is there something similar,
> somewhere that I can use as an example ? a doc to read ?
>
> Many thanks
> Joris
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-users
12:53 p.m.
Glad it helps.
Note in the context of IPA, the PKI / Dogtag profiles are now stored in the
LDAP server backend, so the procedure is different in FreeIPA 4.4.
If those changes are working fine in your environment, and if this may
benefit others, as puppet makes use of more PKI, I would propose to open a
RFE to add a new profile by default in the Dogtag project (so it can make
its way to FreeIPA), and/or document this in the wiki or on an article that
I can add to https://access.redhat.com/ for the "Red Hat Certificate
System" product.
Thanks for any feedback,
M.
On Fri, Dec 9, 2016 at 1:50 AM, joris dedieu <joris.dedieu(a)gmail.com> wrote:
Hi Marc,
2016-12-09 1:05 GMT+01:00 Marc Sauton <msauton(a)redhat.com>:
> you could try to mofidy a profile for SSL server certificat enrollment:
>
> cp -p /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg
> /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg.orig
> vim /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg
> ...snip...
> policyset.serverCertSet.list=1,2,3,4,5,6,7,8,pp
> ...snip...
> policyset.serverCertSet.pp.constraint.class_id=extensionConstraintImpl
> policyset.serverCertSet.pp.constraint.name=Extension Constraint
> policyset.serverCertSet.pp.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.13
> policyset.serverCertSet.pp.constraint.params.extCritical=false
> policyset.serverCertSet.pp.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp.default.name=User Supplied Key Usage
Extension
> policyset.serverCertSet.pp.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.13
> policyset.serverCertSet.pp.default.params.userExtCritical=false
Excellent, it works like a charm ! I just changed
extensionConstraintImpl to noConstraintImpl so that the extensions are
not mandatory anymore. Here the complete puppet trusted facts
sequence. Useful to use DogTag (FreeIPA in my case) as an external
pki for Puppet.
Many thanks
Joris
policyset.serverCertSet.pp1.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp1.constraint.name=Puppet Node UUID (pp_uuid)
policyset.serverCertSet.pp1.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.1
policyset.serverCertSet.pp1.constraint.params.extCritical=false
policyset.serverCertSet.pp1.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp1.default.name=Puppet Node UUID (pp_uuid)
policyset.serverCertSet.pp1.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.1
policyset.serverCertSet.pp1.default.params.userExtCritical=false
policyset.serverCertSet.pp2.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp2.constraint.name=Puppet Node Instance ID
(pp_instance_id)
policyset.serverCertSet.pp2.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.2
policyset.serverCertSet.pp2.constraint.params.extCritical=false
policyset.serverCertSet.pp2.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp2.default.name=Puppet Node Instance ID
(pp_instance_id)
policyset.serverCertSet.pp2.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.2
policyset.serverCertSet.pp2.default.params.userExtCritical=false
policyset.serverCertSet.pp3.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp3.constraint.name=Puppet Node Image Name
(pp_image_name)
policyset.serverCertSet.pp3.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.3
policyset.serverCertSet.pp3.constraint.params.extCritical=false
policyset.serverCertSet.pp3.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp3.default.name=Puppet Node Image Name
(pp_image_name)
policyset.serverCertSet.pp3.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.3
policyset.serverCertSet.pp3.default.params.userExtCritical=false
policyset.serverCertSet.pp4.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp4.constraint.name=Puppet Node Preshared Key
(pp_preshared_key)
policyset.serverCertSet.pp4.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.4
policyset.serverCertSet.pp4.constraint.params.extCritical=false
policyset.serverCertSet.pp4.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp4.default.name=Puppet Node Preshared Key
(pp_preshared_key)
policyset.serverCertSet.pp4.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.4
policyset.serverCertSet.pp4.default.params.userExtCritical=false
policyset.serverCertSet.pp5.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp5.constraint.name=Puppet Node Cost Center
Name (pp_cost_center)
policyset.serverCertSet.pp5.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.5
policyset.serverCertSet.pp5.constraint.params.extCritical=false
policyset.serverCertSet.pp5.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp5.default.name=Puppet Node Cost Center Name
(pp_cost_center)
policyset.serverCertSet.pp5.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.5
policyset.serverCertSet.pp5.default.params.userExtCritical=false
policyset.serverCertSet.pp6.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp6.constraint.name=Puppet Node Product Name
(pp_product)
policyset.serverCertSet.pp6.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.6
policyset.serverCertSet.pp6.constraint.params.extCritical=false
policyset.serverCertSet.pp6.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp6.default.name=Puppet Node Product Name
(pp_product)
policyset.serverCertSet.pp6.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.6
policyset.serverCertSet.pp6.default.params.userExtCritical=false
policyset.serverCertSet.pp7.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp7.constraint.name=Puppet Node Project Name
(pp_project)
policyset.serverCertSet.pp7.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.7
policyset.serverCertSet.pp7.constraint.params.extCritical=false
policyset.serverCertSet.pp7.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp7.default.name=Puppet Node Project Name
(pp_project)
policyset.serverCertSet.pp7.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.7
policyset.serverCertSet.pp7.default.params.userExtCritical=false
policyset.serverCertSet.pp8.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp8.constraint.name=Puppet Node Application
Name (pp_application)
policyset.serverCertSet.pp8.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.8
policyset.serverCertSet.pp8.constraint.params.extCritical=false
policyset.serverCertSet.pp8.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp8.default.name=Puppet Node Application Name
(pp_application)
policyset.serverCertSet.pp8.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.8
policyset.serverCertSet.pp8.default.params.userExtCritical=false
policyset.serverCertSet.pp9.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp9.constraint.name=Puppet Node Service Name
(pp_service)
policyset.serverCertSet.pp9.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.9
policyset.serverCertSet.pp9.constraint.params.extCritical=false
policyset.serverCertSet.pp9.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp9.default.name=Puppet Node Service Name
(pp_service)
policyset.serverCertSet.pp9.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.9
policyset.serverCertSet.pp9.default.params.userExtCritical=false
policyset.serverCertSet.pp10.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp10.constraint.name=Puppet Node Employee Name
(pp_employee)
policyset.serverCertSet.pp10.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.10
policyset.serverCertSet.pp10.constraint.params.extCritical=false
policyset.serverCertSet.pp10.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp10.default.name=Puppet Node Employee Name
(pp_employee)
policyset.serverCertSet.pp10.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.10
policyset.serverCertSet.pp10.default.params.userExtCritical=false
policyset.serverCertSet.pp11.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp11.constraint.name=Puppet Node created_by
Tag (pp_created_by)
policyset.serverCertSet.pp11.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.11
policyset.serverCertSet.pp11.constraint.params.extCritical=false
policyset.serverCertSet.pp11.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp11.default.name=Puppet Node created_by Tag
(pp_created_by)
policyset.serverCertSet.pp11.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.11
policyset.serverCertSet.pp11.default.params.userExtCritical=false
policyset.serverCertSet.pp12.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp12.constraint.name=Puppet Node Environment
Name (pp_environment)
policyset.serverCertSet.pp12.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.12
policyset.serverCertSet.pp12.constraint.params.extCritical=false
policyset.serverCertSet.pp12.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp12.default.name=Puppet Node Environment Name
(pp_environment)
policyset.serverCertSet.pp12.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.12
policyset.serverCertSet.pp12.default.params.userExtCritical=false
policyset.serverCertSet.pp13.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp13.constraint.name=Puppet Node Role Name
(pp_role)
policyset.serverCertSet.pp13.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.13
policyset.serverCertSet.pp13.constraint.params.extCritical=false
policyset.serverCertSet.pp13.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp13.default.name=Puppet Node Role Name (pp_role)
policyset.serverCertSet.pp13.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.13
policyset.serverCertSet.pp13.default.params.userExtCritical=false
policyset.serverCertSet.pp14.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp14.constraint.name=Puppet Node Software
Version (pp_software_version)
policyset.serverCertSet.pp14.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.14
policyset.serverCertSet.pp14.constraint.params.extCritical=false
policyset.serverCertSet.pp14.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp14.default.name=Puppet Node Software Version
(pp_software_version)
policyset.serverCertSet.pp14.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.14
policyset.serverCertSet.pp14.default.params.userExtCritical=false
policyset.serverCertSet.pp15.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp15.constraint.name=Puppet Node Department
Name (pp_department)
policyset.serverCertSet.pp15.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.15
policyset.serverCertSet.pp15.constraint.params.extCritical=false
policyset.serverCertSet.pp15.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp15.default.name=Puppet Node Department Name
(pp_department)
policyset.serverCertSet.pp15.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.15
policyset.serverCertSet.pp15.default.params.userExtCritical=false
policyset.serverCertSet.pp16.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp16.constraint.name=Puppet Node Cluster Name
(pp_cluster)
policyset.serverCertSet.pp16.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.16
policyset.serverCertSet.pp16.constraint.params.extCritical=false
policyset.serverCertSet.pp16.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp16.default.name=Puppet Node Cluster Name
(pp_cluster)
policyset.serverCertSet.pp16.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.16
policyset.serverCertSet.pp16.default.params.userExtCritical=false
policyset.serverCertSet.pp17.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp17.constraint.name=Puppet Node Provisioner
Name (pp_provisioner)
policyset.serverCertSet.pp17.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.17
policyset.serverCertSet.pp17.constraint.params.extCritical=false
policyset.serverCertSet.pp17.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp17.default.name=Puppet Node Provisioner Name
(pp_provisioner)
policyset.serverCertSet.pp17.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.17
policyset.serverCertSet.pp17.default.params.userExtCritical=false
policyset.serverCertSet.pp18.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp18.constraint.name=Puppet Node Region Name
(pp_region)
policyset.serverCertSet.pp18.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.18
policyset.serverCertSet.pp18.constraint.params.extCritical=false
policyset.serverCertSet.pp18.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp18.default.name=Puppet Node Region Name
(pp_region)
policyset.serverCertSet.pp18.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.18
policyset.serverCertSet.pp18.default.params.userExtCritical=false
policyset.serverCertSet.pp19.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp19.constraint.name=Puppet Node Datacenter
Name (pp_datacenter)
policyset.serverCertSet.pp19.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.19
policyset.serverCertSet.pp19.constraint.params.extCritical=false
policyset.serverCertSet.pp19.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp19.default.name=Puppet Node Datacenter Name
(pp_datacenter)
policyset.serverCertSet.pp19.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.19
policyset.serverCertSet.pp19.default.params.userExtCritical=false
policyset.serverCertSet.pp20.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp20.constraint.name=Puppet Node Zone Name
(pp_zone)
policyset.serverCertSet.pp20.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.20
policyset.serverCertSet.pp20.constraint.params.extCritical=false
policyset.serverCertSet.pp20.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp20.default.name=Puppet Node Zone Name (pp_zone)
policyset.serverCertSet.pp20.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.20
policyset.serverCertSet.pp20.default.params.userExtCritical=false
policyset.serverCertSet.pp21.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp21.constraint.name=Puppet Node Network Name
(pp_network)
policyset.serverCertSet.pp21.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.21
policyset.serverCertSet.pp21.constraint.params.extCritical=false
policyset.serverCertSet.pp21.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp21.default.name=Puppet Node Network Name
(pp_network)
policyset.serverCertSet.pp21.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.21
policyset.serverCertSet.pp21.default.params.userExtCritical=false
policyset.serverCertSet.pp22.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp22.constraint.name=Puppet Node Security
Policy Name (pp_securitypolicy)
policyset.serverCertSet.pp22.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.22
policyset.serverCertSet.pp22.constraint.params.extCritical=false
policyset.serverCertSet.pp22.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp22.default.name=Puppet Node Security Policy
Name (pp_securitypolicy)
policyset.serverCertSet.pp22.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.22
policyset.serverCertSet.pp22.default.params.userExtCritical=false
policyset.serverCertSet.pp23.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp23.constraint.name=Puppet Node Cloud
Platform Name (pp_cloudplatform)
policyset.serverCertSet.pp23.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.23
policyset.serverCertSet.pp23.constraint.params.extCritical=false
policyset.serverCertSet.pp23.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp23.default.name=Puppet Node Cloud Platform
Name (pp_cloudplatform)
policyset.serverCertSet.pp23.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.23
policyset.serverCertSet.pp23.default.params.userExtCritical=false
policyset.serverCertSet.pp24.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp24.constraint.name=Puppet Node Application
Tier (pp_apptier)
policyset.serverCertSet.pp24.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.24
policyset.serverCertSet.pp24.constraint.params.extCritical=false
policyset.serverCertSet.pp24.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp24.default.name=Puppet Node Application Tier
(pp_apptier)
policyset.serverCertSet.pp24.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.24
policyset.serverCertSet.pp24.default.params.userExtCritical=false
policyset.serverCertSet.pp25.constraint.class_id=noConstraintImpl
policyset.serverCertSet.pp25.constraint.name=Puppet Node Hostname
(pp_hostname)
policyset.serverCertSet.pp25.constraint.params.extOID=1.3.
6.1.4.1.34380.1.1.25
policyset.serverCertSet.pp25.constraint.params.extCritical=false
policyset.serverCertSet.pp25.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.pp25.default.name=Puppet Node Hostname
(pp_hostname)
policyset.serverCertSet.pp25.default.params.userExtOID=1.3.
6.1.4.1.34380.1.1.25
policyset.serverCertSet.pp25.default.params.userExtCritical=false
>
> restart the CA and apply a CSR to the modified profile that has a user
> supplied extension for that OID, and a value, they should then appear in
the
> X509v3 extensions of the issued certificate
>
> On Thu, Dec 8, 2016 at 2:56 AM, joris dedieu <joris.dedieu(a)gmail.com>
wrote:
>>
>> Hi list,
>> I'm currently trying to add some extensions (For puppet trusted
>> factshttps://docs.puppet.com/puppet/latest/ssl_attributes_
extensions.html)
>> to my certificates. As far as I understand, I have to create / modify
>> a profile to do so. From the CSR, I can see the request extension
>>
>>
>> Requested Extensions:
>> 1.3.6.1.4.1.34380.1.1.13:
>> ..my_puppet_role
>> X509v3 Subject Alternative Name:
>>
>> So basically the question is how to declare 1.3.6.1.4.1.34380.1.1.13
>> retrieve it's value in $request$ ? Is there something similar,
>> somewhere that I can use as an example ? a doc to read ?
>>
>> Many thanks
>> Joris
>>
>> _______________________________________________
>> Pki-users mailing list
>> Pki-users(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/pki-users
>
>
7:18 p.m.
On Fri, Dec 09, 2016 at 10:53:57AM -0800, Marc Sauton wrote:
Glad it helps.
Note in the context of IPA, the PKI / Dogtag profiles are now stored in the
LDAP server backend, so the procedure is different in FreeIPA 4.4.
If those changes are working fine in your environment, and if this may
benefit others, as puppet makes use of more PKI, I would propose to open a
RFE to add a new profile by default in the Dogtag project (so it can make
its way to FreeIPA), and/or document this in the wiki or on an article that
I can add to https://access.redhat.com/ for the "Red Hat Certificate
System" product.
Thanks for any feedback,
M.
Better to open such an RFE against FreeIPA, IMO. There is no need
for the profile to be defined by the Dogtag project.
Thanks,
Fraser
On Fri, Dec 9, 2016 at 1:50 AM, joris dedieu
<joris.dedieu(a)gmail.com> wrote:
> Hi Marc,
>
> 2016-12-09 1:05 GMT+01:00 Marc Sauton <msauton(a)redhat.com>:
> > you could try to mofidy a profile for SSL server certificat enrollment:
> >
> > cp -p /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg
> > /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg.orig
> > vim /var/lib/pki/pki-ca1/ca/profiles/ca/caServerCert.cfg
> > ...snip...
> > policyset.serverCertSet.list=1,2,3,4,5,6,7,8,pp
> > ...snip...
> > policyset.serverCertSet.pp.constraint.class_id=extensionConstraintImpl
> > policyset.serverCertSet.pp.constraint.name=Extension Constraint
> > policyset.serverCertSet.pp.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.13
> > policyset.serverCertSet.pp.constraint.params.extCritical=false
> > policyset.serverCertSet.pp.default.class_id=userExtensionDefaultImpl
> > policyset.serverCertSet.pp.default.name=User Supplied Key Usage
> Extension
> > policyset.serverCertSet.pp.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.13
> > policyset.serverCertSet.pp.default.params.userExtCritical=false
>
> Excellent, it works like a charm ! I just changed
> extensionConstraintImpl to noConstraintImpl so that the extensions are
> not mandatory anymore. Here the complete puppet trusted facts
> sequence. Useful to use DogTag (FreeIPA in my case) as an external
> pki for Puppet.
>
>
>
> Many thanks
> Joris
>
> policyset.serverCertSet.pp1.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp1.constraint.name=Puppet Node UUID (pp_uuid)
> policyset.serverCertSet.pp1.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.1
> policyset.serverCertSet.pp1.constraint.params.extCritical=false
> policyset.serverCertSet.pp1.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp1.default.name=Puppet Node UUID (pp_uuid)
> policyset.serverCertSet.pp1.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.1
> policyset.serverCertSet.pp1.default.params.userExtCritical=false
> policyset.serverCertSet.pp2.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp2.constraint.name=Puppet Node Instance ID
> (pp_instance_id)
> policyset.serverCertSet.pp2.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.2
> policyset.serverCertSet.pp2.constraint.params.extCritical=false
> policyset.serverCertSet.pp2.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp2.default.name=Puppet Node Instance ID
> (pp_instance_id)
> policyset.serverCertSet.pp2.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.2
> policyset.serverCertSet.pp2.default.params.userExtCritical=false
> policyset.serverCertSet.pp3.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp3.constraint.name=Puppet Node Image Name
> (pp_image_name)
> policyset.serverCertSet.pp3.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.3
> policyset.serverCertSet.pp3.constraint.params.extCritical=false
> policyset.serverCertSet.pp3.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp3.default.name=Puppet Node Image Name
> (pp_image_name)
> policyset.serverCertSet.pp3.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.3
> policyset.serverCertSet.pp3.default.params.userExtCritical=false
> policyset.serverCertSet.pp4.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp4.constraint.name=Puppet Node Preshared Key
> (pp_preshared_key)
> policyset.serverCertSet.pp4.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.4
> policyset.serverCertSet.pp4.constraint.params.extCritical=false
> policyset.serverCertSet.pp4.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp4.default.name=Puppet Node Preshared Key
> (pp_preshared_key)
> policyset.serverCertSet.pp4.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.4
> policyset.serverCertSet.pp4.default.params.userExtCritical=false
> policyset.serverCertSet.pp5.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp5.constraint.name=Puppet Node Cost Center
> Name (pp_cost_center)
> policyset.serverCertSet.pp5.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.5
> policyset.serverCertSet.pp5.constraint.params.extCritical=false
> policyset.serverCertSet.pp5.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp5.default.name=Puppet Node Cost Center Name
> (pp_cost_center)
> policyset.serverCertSet.pp5.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.5
> policyset.serverCertSet.pp5.default.params.userExtCritical=false
> policyset.serverCertSet.pp6.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp6.constraint.name=Puppet Node Product Name
> (pp_product)
> policyset.serverCertSet.pp6.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.6
> policyset.serverCertSet.pp6.constraint.params.extCritical=false
> policyset.serverCertSet.pp6.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp6.default.name=Puppet Node Product Name
> (pp_product)
> policyset.serverCertSet.pp6.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.6
> policyset.serverCertSet.pp6.default.params.userExtCritical=false
> policyset.serverCertSet.pp7.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp7.constraint.name=Puppet Node Project Name
> (pp_project)
> policyset.serverCertSet.pp7.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.7
> policyset.serverCertSet.pp7.constraint.params.extCritical=false
> policyset.serverCertSet.pp7.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp7.default.name=Puppet Node Project Name
> (pp_project)
> policyset.serverCertSet.pp7.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.7
> policyset.serverCertSet.pp7.default.params.userExtCritical=false
> policyset.serverCertSet.pp8.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp8.constraint.name=Puppet Node Application
> Name (pp_application)
> policyset.serverCertSet.pp8.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.8
> policyset.serverCertSet.pp8.constraint.params.extCritical=false
> policyset.serverCertSet.pp8.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp8.default.name=Puppet Node Application Name
> (pp_application)
> policyset.serverCertSet.pp8.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.8
> policyset.serverCertSet.pp8.default.params.userExtCritical=false
> policyset.serverCertSet.pp9.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp9.constraint.name=Puppet Node Service Name
> (pp_service)
> policyset.serverCertSet.pp9.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.9
> policyset.serverCertSet.pp9.constraint.params.extCritical=false
> policyset.serverCertSet.pp9.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp9.default.name=Puppet Node Service Name
> (pp_service)
> policyset.serverCertSet.pp9.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.9
> policyset.serverCertSet.pp9.default.params.userExtCritical=false
> policyset.serverCertSet.pp10.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp10.constraint.name=Puppet Node Employee Name
> (pp_employee)
> policyset.serverCertSet.pp10.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.10
> policyset.serverCertSet.pp10.constraint.params.extCritical=false
> policyset.serverCertSet.pp10.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp10.default.name=Puppet Node Employee Name
> (pp_employee)
> policyset.serverCertSet.pp10.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.10
> policyset.serverCertSet.pp10.default.params.userExtCritical=false
> policyset.serverCertSet.pp11.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp11.constraint.name=Puppet Node created_by
> Tag (pp_created_by)
> policyset.serverCertSet.pp11.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.11
> policyset.serverCertSet.pp11.constraint.params.extCritical=false
> policyset.serverCertSet.pp11.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp11.default.name=Puppet Node created_by Tag
> (pp_created_by)
> policyset.serverCertSet.pp11.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.11
> policyset.serverCertSet.pp11.default.params.userExtCritical=false
> policyset.serverCertSet.pp12.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp12.constraint.name=Puppet Node Environment
> Name (pp_environment)
> policyset.serverCertSet.pp12.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.12
> policyset.serverCertSet.pp12.constraint.params.extCritical=false
> policyset.serverCertSet.pp12.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp12.default.name=Puppet Node Environment Name
> (pp_environment)
> policyset.serverCertSet.pp12.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.12
> policyset.serverCertSet.pp12.default.params.userExtCritical=false
> policyset.serverCertSet.pp13.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp13.constraint.name=Puppet Node Role Name
> (pp_role)
> policyset.serverCertSet.pp13.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.13
> policyset.serverCertSet.pp13.constraint.params.extCritical=false
> policyset.serverCertSet.pp13.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp13.default.name=Puppet Node Role Name (pp_role)
> policyset.serverCertSet.pp13.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.13
> policyset.serverCertSet.pp13.default.params.userExtCritical=false
> policyset.serverCertSet.pp14.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp14.constraint.name=Puppet Node Software
> Version (pp_software_version)
> policyset.serverCertSet.pp14.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.14
> policyset.serverCertSet.pp14.constraint.params.extCritical=false
> policyset.serverCertSet.pp14.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp14.default.name=Puppet Node Software Version
> (pp_software_version)
> policyset.serverCertSet.pp14.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.14
> policyset.serverCertSet.pp14.default.params.userExtCritical=false
> policyset.serverCertSet.pp15.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp15.constraint.name=Puppet Node Department
> Name (pp_department)
> policyset.serverCertSet.pp15.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.15
> policyset.serverCertSet.pp15.constraint.params.extCritical=false
> policyset.serverCertSet.pp15.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp15.default.name=Puppet Node Department Name
> (pp_department)
> policyset.serverCertSet.pp15.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.15
> policyset.serverCertSet.pp15.default.params.userExtCritical=false
> policyset.serverCertSet.pp16.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp16.constraint.name=Puppet Node Cluster Name
> (pp_cluster)
> policyset.serverCertSet.pp16.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.16
> policyset.serverCertSet.pp16.constraint.params.extCritical=false
> policyset.serverCertSet.pp16.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp16.default.name=Puppet Node Cluster Name
> (pp_cluster)
> policyset.serverCertSet.pp16.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.16
> policyset.serverCertSet.pp16.default.params.userExtCritical=false
> policyset.serverCertSet.pp17.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp17.constraint.name=Puppet Node Provisioner
> Name (pp_provisioner)
> policyset.serverCertSet.pp17.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.17
> policyset.serverCertSet.pp17.constraint.params.extCritical=false
> policyset.serverCertSet.pp17.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp17.default.name=Puppet Node Provisioner Name
> (pp_provisioner)
> policyset.serverCertSet.pp17.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.17
> policyset.serverCertSet.pp17.default.params.userExtCritical=false
> policyset.serverCertSet.pp18.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp18.constraint.name=Puppet Node Region Name
> (pp_region)
> policyset.serverCertSet.pp18.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.18
> policyset.serverCertSet.pp18.constraint.params.extCritical=false
> policyset.serverCertSet.pp18.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp18.default.name=Puppet Node Region Name
> (pp_region)
> policyset.serverCertSet.pp18.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.18
> policyset.serverCertSet.pp18.default.params.userExtCritical=false
> policyset.serverCertSet.pp19.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp19.constraint.name=Puppet Node Datacenter
> Name (pp_datacenter)
> policyset.serverCertSet.pp19.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.19
> policyset.serverCertSet.pp19.constraint.params.extCritical=false
> policyset.serverCertSet.pp19.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp19.default.name=Puppet Node Datacenter Name
> (pp_datacenter)
> policyset.serverCertSet.pp19.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.19
> policyset.serverCertSet.pp19.default.params.userExtCritical=false
> policyset.serverCertSet.pp20.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp20.constraint.name=Puppet Node Zone Name
> (pp_zone)
> policyset.serverCertSet.pp20.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.20
> policyset.serverCertSet.pp20.constraint.params.extCritical=false
> policyset.serverCertSet.pp20.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp20.default.name=Puppet Node Zone Name (pp_zone)
> policyset.serverCertSet.pp20.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.20
> policyset.serverCertSet.pp20.default.params.userExtCritical=false
> policyset.serverCertSet.pp21.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp21.constraint.name=Puppet Node Network Name
> (pp_network)
> policyset.serverCertSet.pp21.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.21
> policyset.serverCertSet.pp21.constraint.params.extCritical=false
> policyset.serverCertSet.pp21.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp21.default.name=Puppet Node Network Name
> (pp_network)
> policyset.serverCertSet.pp21.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.21
> policyset.serverCertSet.pp21.default.params.userExtCritical=false
> policyset.serverCertSet.pp22.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp22.constraint.name=Puppet Node Security
> Policy Name (pp_securitypolicy)
> policyset.serverCertSet.pp22.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.22
> policyset.serverCertSet.pp22.constraint.params.extCritical=false
> policyset.serverCertSet.pp22.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp22.default.name=Puppet Node Security Policy
> Name (pp_securitypolicy)
> policyset.serverCertSet.pp22.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.22
> policyset.serverCertSet.pp22.default.params.userExtCritical=false
> policyset.serverCertSet.pp23.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp23.constraint.name=Puppet Node Cloud
> Platform Name (pp_cloudplatform)
> policyset.serverCertSet.pp23.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.23
> policyset.serverCertSet.pp23.constraint.params.extCritical=false
> policyset.serverCertSet.pp23.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp23.default.name=Puppet Node Cloud Platform
> Name (pp_cloudplatform)
> policyset.serverCertSet.pp23.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.23
> policyset.serverCertSet.pp23.default.params.userExtCritical=false
> policyset.serverCertSet.pp24.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp24.constraint.name=Puppet Node Application
> Tier (pp_apptier)
> policyset.serverCertSet.pp24.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.24
> policyset.serverCertSet.pp24.constraint.params.extCritical=false
> policyset.serverCertSet.pp24.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp24.default.name=Puppet Node Application Tier
> (pp_apptier)
> policyset.serverCertSet.pp24.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.24
> policyset.serverCertSet.pp24.default.params.userExtCritical=false
> policyset.serverCertSet.pp25.constraint.class_id=noConstraintImpl
> policyset.serverCertSet.pp25.constraint.name=Puppet Node Hostname
> (pp_hostname)
> policyset.serverCertSet.pp25.constraint.params.extOID=1.3.
> 6.1.4.1.34380.1.1.25
> policyset.serverCertSet.pp25.constraint.params.extCritical=false
> policyset.serverCertSet.pp25.default.class_id=userExtensionDefaultImpl
> policyset.serverCertSet.pp25.default.name=Puppet Node Hostname
> (pp_hostname)
> policyset.serverCertSet.pp25.default.params.userExtOID=1.3.
> 6.1.4.1.34380.1.1.25
> policyset.serverCertSet.pp25.default.params.userExtCritical=false
>
>
>
>
> >
> > restart the CA and apply a CSR to the modified profile that has a user
> > supplied extension for that OID, and a value, they should then appear in
> the
> > X509v3 extensions of the issued certificate
> >
> > On Thu, Dec 8, 2016 at 2:56 AM, joris dedieu <joris.dedieu(a)gmail.com>
> wrote:
> >>
> >> Hi list,
> >> I'm currently trying to add some extensions (For puppet trusted
> >> factshttps://docs.puppet.com/puppet/latest/ssl_attributes_
> extensions.html)
> >> to my certificates. As far as I understand, I have to create / modify
> >> a profile to do so. From the CSR, I can see the request extension
> >>
> >>
> >> Requested Extensions:
> >> 1.3.6.1.4.1.34380.1.1.13:
> >> ..my_puppet_role
> >> X509v3 Subject Alternative Name:
> >>
> >> So basically the question is how to declare 1.3.6.1.4.1.34380.1.1.13
> >> retrieve it's value in $request$ ? Is there something similar,
> >> somewhere that I can use as an example ? a doc to read ?
> >>
> >> Many thanks
> >> Joris
> >>
> >> _______________________________________________
> >> Pki-users mailing list
> >> Pki-users(a)redhat.com
> >> https://www.redhat.com/mailman/listinfo/pki-users
> >
> >
>
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
2685
days inactive
2689
days old
4 comments
3 participants
participants (3)
-
Fraser Tweedale -
joris dedieu -
Marc Sauton