<div dir="ltr">Hi Fraser, thanks a lot for your quick reply!<div> <div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"> Could you confirm whether you are on RHEL / CentOS 7.2, and if so, whether it was installed at 7.2 or an upgrade from 7.1 or an earlier version? </blockquote><div> </div><div>This is a replica that was previously installed in CentOS 7.1.</div><div>I don't exactly remember but I think I used COPR repository to install FreeIPA 4.2 and then upgraded CentOS to 7.2.</div><div> </div><div>Also, I remember my pki got broken after upgrading this replica in 7.2. I had to renew the replica's certificate and force-sync to successfully launch pki-tomcatd. Now this replica is my pki master.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"> > ### certprofile > $ ipa certprofile-show --out caIPAserviceCert.cfg caIPAserviceCert > ----------------------------------------------------------- > Profile configuration stored in file 'caIPAserviceCert.cfg' > ----------------------------------------------------------- > Profile ID: caIPAserviceCert > Profile description: Standard profile for network services > Store issued certificates: TRUE > You do not include the caIPAserviceCert.cfg in the diffs below, however, I suspect you will find it to be identical to /usr/share/pki/ca/profiles/ca/caIPAserviceCert.cfg. Could you please confirm this? </blockquote><div> </div><div>Ah true... I did not realised I was actually writing a new file! </div><div>And you're right, diff is the same (except 2 profileId/classId lignes that don't exist in template + enableBy that differs)</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"> FreeIPA since v4.2 configures Dogtag to use the LDAPProfileSubsystem which stores profile configuration in LDAP. The file output by the ``ipa certprofile-show`` command will have come from LDAP; this is the version that's actually in use in your IPA installation. </blockquote><div> </div><div>Thanks a lot for your answers.</div><div> </div><div>So now, what would you suggest me to do?</div><div>Replace my /tmp/caIPAserviceCert.cfg with your suggested values and import to LDAP ?</div><div> </div><div>Cheers,</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div class=""><div class="h5"> > And a diff between them : > > $ diff /usr/share/ipa/profiles/caIPAserviceCert.cfg > /usr/share/pki/ca/profiles/ca/caIPAserviceCert.cfg > 1,2d0 > < profileId=caIPAserviceCert > < classId=caEnrollImpl > 15c13 > < policyset.serverCertSet.list=1,2,3,4,5,6,7,8,9,10,11 > --- > > policyset.serverCertSet.list=1,2,3,4,5,6,7,8 > 22c20 > < <a href="http://policyset.serverCertSet.1.default.params.name" rel="noreferrer" target="_blank">policyset.serverCertSet.1.default.params.name</a>=CN=$$ > <a href="http://request.req_subject_name.cn" rel="noreferrer" target="_blank">request.req_subject_name.cn</a>$$, $SUBJECT_DN_O > --- > > <a href="http://policyset.serverCertSet.1.default.params.name" rel="noreferrer" target="_blank">policyset.serverCertSet.1.default.params.name</a>=CN=$ > <a href="http://request.req_subject_name.cn" rel="noreferrer" target="_blank">request.req_subject_name.cn</a>$, OU=pki-ipa, O=IPA > 48c46 > < > policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0=http:// > $IPA_CA_RECORD.$DOMAIN/ca/ocsp > --- > > policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0= > 95,97c93,95 > < > policyset.serverCertSet.9.default.params.crlDistPointsIssuerName_0=$CRL_ISSUER > < > policyset.serverCertSet.9.default.params.crlDistPointsIssuerType_0=DirectoryName > < policyset.serverCertSet.9.default.params.crlDistPointsPointName_0=http:// > $IPA_CA_RECORD.$DOMAIN/ipa/crl/MasterCRL.bin > --- > > policyset.serverCertSet.9.default.params.crlDistPointsIssuerName_0= > > policyset.serverCertSet.9.default.params.crlDistPointsIssuerType_0= > > policyset.serverCertSet.9.default.params.crlDistPointsPointName_0= > <a href="https://ipa.example.com/ipa/crl/MasterCRL.bin" rel="noreferrer" target="_blank">https://ipa.example.com/ipa/crl/MasterCRL.bin</a> > 100,109d97 > < policyset.serverCertSet.10.constraint.class_id=noConstraintImpl > < <a href="http://policyset.serverCertSet.10.constraint.name" rel="noreferrer" target="_blank">policyset.serverCertSet.10.constraint.name</a>=No Constraint > < > policyset.serverCertSet.10.default.class_id=subjectKeyIdentifierExtDefaultImpl > < <a href="http://policyset.serverCertSet.10.default.name" rel="noreferrer" target="_blank">policyset.serverCertSet.10.default.name</a>=Subject Key Identifier Extension > Default > < policyset.serverCertSet.10.default.params.critical=false > < policyset.serverCertSet.11.constraint.class_id=noConstraintImpl > < <a href="http://policyset.serverCertSet.11.constraint.name" rel="noreferrer" target="_blank">policyset.serverCertSet.11.constraint.name</a>=No Constraint > < policyset.serverCertSet.11.default.class_id=userExtensionDefaultImpl > < <a href="http://policyset.serverCertSet.11.default.name" rel="noreferrer" target="_blank">policyset.serverCertSet.11.default.name</a>=User Supplied Extension Default > < policyset.serverCertSet.11.default.params.userExtOID=2.5.29.17 > > Thanks by advance for your support, > Regards > > -- > Youenn Piolet > <a href="mailto:piolet.y@gmail.com">piolet.y@gmail.com</a> > > > 2016-03-31 9:41 GMT+02:00 Fraser Tweedale <<a href="mailto:ftweedal@redhat.com">ftweedal@redhat.com</a>>: > > > On Sun, Mar 27, 2016 at 09:14:47PM +0200, Martin Štefany wrote: > > > Hello, > > > > > > I seem to be having some issues with IPA CA feature not generating > > > certificates with DNS SubjectAltNames. > > > > > > I'm sure this worked very well under CentOS 7.1 / IPA 4.0, but now under > > > CentOS 7.2 / IPA 4.2 something's different. > > > > > > Here are the original steps which worked fine for my first use case :: > > > > > > $ ipa dnsrecord-add <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> mail --a-ip=172.17.100.25 > > > $ ipa host-add <a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a> > > > $ ipa service-add smtp/<a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a> > > > $ ipa service-add smtp/<a href="http://mail1.example.com" rel="noreferrer" target="_blank">mail1.example.com</a> > > > $ ipa service-add-host smtp/<a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a> --hosts=<a href="http://mail1.example.com" rel="noreferrer" target="_blank">mail1.example.com</a> > > > $ ipa-getcert request -k /etc/pki/tls/private/postfix.key \ > > > -f /etc/pki/tls/certs/postfix.pem \ > > > -N CN=<a href="http://mail1.example.com" rel="noreferrer" target="_blank">mail1.example.com</a>,O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a> \ > > > -D <a href="http://mail1.example.com" rel="noreferrer" target="_blank">mail1.example.com</a> -D <a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a> \ > > > -K smtp/<a href="http://mail1.example.com" rel="noreferrer" target="_blank">mail1.example.com</a> > > > (and repeat for every next member of the cluster...) > > > > > > After this, I would get certificate with something like :: > > > $ sudo ipa-getcert list > > > Number of certificates and requests being tracked: 3. > > > Request ID '20150419153933': > > > status: MONITORING > > > stuck: no > > > key pair storage: > > > type=FILE,location='/etc/pki/tls/private/postfix.key' > > > certificate: type=FILE,location='/etc/pki/tls/certs/postfix.pem' > > > CA: IPA > > > issuer: CN=Certificate Authority,O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a> > > > subject: CN=<a href="http://mail1.example.com" rel="noreferrer" target="_blank">mail1.example.com</a>,O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a> > > > expires: 2017-04-19 15:39:35 UTC > > > dns: <a href="http://mail1.example.com" rel="noreferrer" target="_blank">mail1.example.com</a>,<a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a> > > > principal name: smtp/<a href="mailto:mail1.example.com@EXAMPLE.COM">mail1.example.com@EXAMPLE.COM</a> > > > key usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > > eku: id-kp-serverAuth,id-kp-clientAuth > > > pre-save command: > > > post-save command: > > > track: yes > > > auto-renew: yes > > > > > > with Subject line in form of: 'CN=<hostname>,O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a>' and 'dns' > > > info line present. > > > > > > Suddenly, in the current setup, after upgrade from 4.0 to 4.2, I'm > > > getting this :: > > > > > > $ ipa dnsrecord-add <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> w3 --a-ip=172.17.17.80 --a-create- > > > reverse > > > $ ipa host-add <a href="http://w3.example.com" rel="noreferrer" target="_blank">w3.example.com</a> > > > $ ipa service-add HTTP/<a href="http://w3.example.com" rel="noreferrer" target="_blank">w3.example.com</a> > > > $ ipa service-add HTTP/<a href="http://http1.example.com" rel="noreferrer" target="_blank">http1.example.com</a> > > > $ ipa service-add-host HTTP/<a href="http://w3.example.com" rel="noreferrer" target="_blank">w3.example.com</a> --hosts=<a href="http://http1.example.com" rel="noreferrer" target="_blank">http1.example.com</a> > > > $ ipa-getcert request -k /etc/pki/tls/private/httpd.key \ > > > -f /etc/pki/tls/certs/httpd.pem \ > > > -N CN=<a href="http://http1.example.com" rel="noreferrer" target="_blank">http1.example.com</a>,O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a> \ > > > -D <a href="http://http1.example.com" rel="noreferrer" target="_blank">http1.example.com</a> -D <a href="http://w3.example.com" rel="noreferrer" target="_blank">w3.example.com</a> \ > > > -K HTTP/<a href="http://http1.example.com" rel="noreferrer" target="_blank">http1.example.com</a> > > > $ sudo ipa-getcert list > > > Number of certificates and requests being tracked: 3. > > > Request ID '20160327095125': > > > status: MONITORING > > > stuck: no > > > key pair storage: > > > type=FILE,location='/etc/pki/tls/private/http.key' > > > certificate: type=FILE,location='/etc/pki/tls/certs/http.pem' > > > CA: IPA > > > issuer: CN=Certificate Authority,O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a> > > > subject: CN=<a href="http://http1.example.com" rel="noreferrer" target="_blank">http1.example.com</a>,OU=pki-ipa,O=IPA > > > expires: 2018-03-28 09:51:27 UTC > > > key usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > > eku: id-kp-serverAuth,id-kp-clientAuth > > > pre-save command: > > > post-save command: > > > track: yes > > > auto-renew: yes > > > > > > Where's the 'CN=<hostname>,OU=pki-ipa,O=IPA' coming from instead of > > > 'CN=<hostname>,O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a>' and why are DNS SubjectAltNames missing? > > > > > > To be clear, if I don't do :: > > > $ ipa service-add-host HTTP/<a href="http://w3.example.com" rel="noreferrer" target="_blank">w3.example.com</a> --hosts=<a href="http://http1.example.com" rel="noreferrer" target="_blank">http1.example.com</a> > > > > > > then certificate is just not issued with 'REJECTED', but once this is > > > done properly in described steps, DNS SANs are not happening. > > > > > > I've tried ipa-getcert from both CentOS 7.2 and Fedora 23, but only > > > against my current IPA 4.2 on CentOS 7.2. > > > > > > For the actual certificates :: > > > $ sudo openssl x509 -in /etc/pki/tls/certs/postfix.pem -noout -text > > > Certificate: > > > Data: > > > Version: 3 (0x2) > > > Serial Number: 15 (0xf) > > > Signature Algorithm: sha256WithRSAEncryption > > > Issuer: O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a>, CN=Certificate Authority > > > Validity > > > Not Before: Apr 19 15:39:35 2015 GMT > > > Not After : Apr 19 15:39:35 2017 GMT > > > Subject: O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a>, CN=<a href="http://mail1.example.com" rel="noreferrer" target="_blank">mail1.example.com</a> > > > Subject Public Key Info: > > > Public Key Algorithm: rsaEncryption > > > Public-Key: (2048 bit) > > > Modulus: > > > [cut] > > > Exponent: 65537 (0x10001) > > > X509v3 extensions: > > > X509v3 Authority Key Identifier: > > > keyid:[cut] > > > > > > Authority Information Access: > > > OCSP - URI:<a href="http://ipa-ca.example.com/ca/ocsp" rel="noreferrer" target="_blank">http://ipa-ca.example.com/ca/ocsp</a> > > > > > > X509v3 Key Usage: critical > > > Digital Signature, Non Repudiation, Key Encipherment, > > > Data Encipherment > > > X509v3 Extended Key Usage: > > > TLS Web Server Authentication, TLS Web Client > > > Authentication > > > X509v3 CRL Distribution Points: > > > > > > Full Name: > > > URI:<a href="http://ipa-ca.example.com/ipa/crl/MasterCRL.bin" rel="noreferrer" target="_blank">http://ipa-ca.example.com/ipa/crl/MasterCRL.bin</a> > > > CRL Issuer: > > > DirName: O = ipaca, CN = Certificate Authority > > > > > > X509v3 Subject Key Identifier: > > > [cut] > > > X509v3 Subject Alternative Name: > > > DNS:<a href="http://mail1.example.com" rel="noreferrer" target="_blank">mail1.example.com</a>, DNS:<a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a>, > > > othername:<unsupported>, othername:<unsupported> > > > Signature Algorithm: sha256WithRSAEncryption > > > [cut] > > > > > > vs. > > > > > > $ sudo openssl x509 -in /etc/pki/tls/certs/http.pem -text -noout > > > Certificate: > > > Data: > > > Version: 3 (0x2) > > > Serial Number: 71 (0x47) > > > Signature Algorithm: sha256WithRSAEncryption > > > Issuer: O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a>, CN=Certificate Authority > > > Validity > > > Not Before: Mar 27 09:51:27 2016 GMT > > > Not After : Mar 28 09:51:27 2018 GMT > > > Subject: O=IPA, OU=pki-ipa, CN=<a href="http://http1.example.com" rel="noreferrer" target="_blank">http1.example.com</a> > > > Subject Public Key Info: > > > Public Key Algorithm: rsaEncryption > > > Public-Key: (2048 bit) > > > Modulus: > > > [cut] > > > Exponent: 65537 (0x10001) > > > X509v3 extensions: > > > X509v3 Authority Key Identifier: > > > keyid:[cut] > > > > > > Authority Information Access: > > > OCSP - URI:<a href="http://idmc1.example.com:80/ca/ocsp" rel="noreferrer" target="_blank">http://idmc1.example.com:80/ca/ocsp</a> > > > > > > X509v3 Key Usage: critical > > > Digital Signature, Non Repudiation, Key Encipherment, > > > Data Encipherment > > > X509v3 Extended Key Usage: > > > TLS Web Server Authentication, TLS Web Client > > > Authentication > > > Signature Algorithm: sha256WithRSAEncryption > > > [cut] > > > > > > so even reference to CRL is missing here, but OCSP is present. > > > > > > > > > Sorry if this is duplicate, but from what I was able to find, DNS > > > SubjectAltNames are reported working since CentOS 7.1, and I think I'm > > > consistent with <a href="http://www.freeipa.org/page/PKI" rel="noreferrer" target="_blank">http://www.freeipa.org/page/PKI</a>, unless I miss something > > > obvious here. > > > > > > For new features like certificate profiles and ACLs, I haven't changed > > > any defaults as far as I know as there was no need for that. > > > > > > > > > Thank you for any support in advance! And Happy Easter! > > > > > > Martin > > > > Hi Martin, > > > > Thanks for the detailed info. Could you please provide the > > Dogtag configuration for the default profile, `caIPAserviceCert'? > > > > ipa certprofile-show --out caIPAserviceCert.cfg caIPAserviceCert > > > > (Then provide the contents of caIPAserviceCert.cfg) > > > > Could you also provide the contents of file > > `/etc/pki/pki-tomcat/ca/CS.cfg'? > > > > Regards, > > Fraser > > > > -- > > Manage your subscription for the Freeipa-users mailing list: > > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </div></div></blockquote></div> </div></div></div>