<div> I can send you the email that I got from the list? Will this be good?</div><div> </div><div>Thanks,</div><div> </div><div>R <div class="gmail_quote"><div>On Thu, Jan 12, 2017 at 3:05 PM John Magne <<a href="mailto:jmagne@redhat.com">jmagne@redhat.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi: Is there any way you can reproduce the confusing answer you got, which may give us a head start? ----- Original Message ----- > From: "Rafael Leiva-Ochoa" <<a href="mailto:spawn@rloteck.net" class="gmail_msg" target="_blank">spawn@rloteck.net</a>> > To: <a href="mailto:pki-users@redhat.com" class="gmail_msg" target="_blank">pki-users@redhat.com</a> > Sent: Thursday, January 12, 2017 2:36:36 PM > Subject: Re: [Pki-users] SAN on Certificate > > Any takers? > On Tue, Jan 10, 2017 at 4:35 PM Rafael Leiva-Ochoa < <a href="mailto:spawn@rloteck.net" class="gmail_msg" target="_blank">spawn@rloteck.net</a> > > wrote: > > > > Hi Everyone, > > I am sorry for asking this question again, but the last time I asked it, I > was confused with the answer. I am trying to create a "certificate profile" > that will support 3 to 4 SAN (Subject Alternative Names), since the current > profiles do not have support for this by default. I was trying to duplicate > the "Manual Server Certificate Enrollment" profile, and adding SAN support. > I tried using this as a guild: > > <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Certificate_and_CRL_Extensions.html#Subject_Alternative_Name_Extension_Default" rel="noreferrer" class="gmail_msg" target="_blank">https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Certificate_and_CRL_Extensions.html#Subject_Alternative_Name_Extension_Default</a> > > and > > <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Managing_Subject_Names_and_Subject_Alternative_" rel="noreferrer" class="gmail_msg" target="_blank">https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Managing_Subject_Names_and_Subject_Alternative_</a> > Names .html > > This is how the profile looks like: > > policyset.serverCertSet.9. constraint.class_id= noConstraintImpl > policyset.serverCertSet.9.constraint. name =No Constraint > policyset.serverCertSet.9. default.class_id= subjectAltNameExtDefaultImpl > policyset.serverCertSet.9.default. name = Subject Alternative Name Extension > Default > policyset.serverCertSet.9. default.params. subjAltExtGNEnable_0=true > policyset.serverCertSet.9. default.params. subjAltExtPattern_0= > policyset.serverCertSet.9. default.params.subjAltExtType_ 0=DNSName > policyset.serverCertSet.9. default.params. subjAltNameExtCritical=false > policyset.serverCertSet.9. default.params. subjAltNameNumGNs=1 > > The CSR looks like this: > > *Common Name :* <a href="http://node1.example.com" rel="noreferrer" class="gmail_msg" target="_blank">node1.example.com</a> > * Subject Alternative Names :* <a href="http://test.example.com" rel="noreferrer" class="gmail_msg" target="_blank">test.example.com</a> , <a href="http://test1.example.com" rel="noreferrer" class="gmail_msg" target="_blank">test1.example.com</a> , > <a href="http://test2.example.com" rel="noreferrer" class="gmail_msg" target="_blank">test2.example.com</a> > *Organization:* Test Corp > *Organization Unit:* IT Department > *Locality:* LA > *State:* OR > *Country:* US > > I am doing to do this instead of using wildcard certs. > > Thanks, > > Rafael > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > Pki-users mailing list > <a href="mailto:Pki-users@redhat.com" class="gmail_msg" target="_blank">Pki-users@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/pki-users" rel="noreferrer" class="gmail_msg" target="_blank">https://www.redhat.com/mailman/listinfo/pki-users</a> </blockquote></div></div>