<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>RHEL 5.8<o:p></o:p></p><p class=MsoNormal>Red Hat CS 8.1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’m hoping this should be a relatively straight forward question and others have run into something similar:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>When generating a certificate, is it possible to dynamically include/not include the Subject Alt Name field based on an LDAP parameter? When looking at the certificate profile there’s a “subjAltExtGNEnable” parameter, but I don’t believe that can be set to a request parameter, like $request.includeSAN$ for example, based on the testing I’ve done.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Assuming that the “subjAltExtGNEnable” field must be static text, perhaps there is another work around. If included, the Subject Alt Name in this case would represent a user’s full DN. If not included, the request parameter could be left blank and the Subject Alt Name would be empty. Here’s a little snippet from the cert profile:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>policyset.CSCertSet.7.constraint.class_id=noConstraintImpl<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.constraint.name=No Constraint<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.class_id=subjectAltNameExtDefaultImpl<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.name=Subject Alternative Name Extension Default<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtGNEnable_0=true<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtGNEnable_1=false<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtGNEnable_2=false<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtGNEnable_3=false<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtGNEnable_4=false<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtPattern_0=$request.pkisponsordn$<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtPattern_1=<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtPattern_2=<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtPattern_3=<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtPattern_4=<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtType_0=DirectoryName<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtType_1=RFC822Name<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtType_2=RFC822Name<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtType_3=RFC822Name<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltExtType_4=RFC822Name<o:p></o:p></p><p class=MsoNormal>policyset.CSCertSet.7.default.params.subjAltNameExtCritical=false<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The issue that arises here is the CA fails with an IO exception from the $request.pkisponsordn$ format. That value is a user DN, similar to <o:p></o:p></p><p class=MsoNormal>CN=FIRSTNAME.LASTNAME, OU=ORGANIZATION, OU=ORGANIZATION2, O=COUNTRY, C=COUNTRYCODE. The CA’s debug log shows the ‘=’ and the ‘,’ being escaped by backslashes. The CA then fails to populate the Subject Alt Name due to the following error:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>SubjectAltNameExtDefault: populate java.io.IOException: Unknown AVA keyword ‘CN\’.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Is there a way to properly escape the user DN so it can be used in the Subject Alt Name? Again, the ultimate goal being the user DN could be populated or not. If populated, it is included as the Subject Alt Name. If not populated, the Subject Alt Name is left blank when the certificate is generated.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ryan Millay<o:p></o:p></p></div></body></html>