<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Title" content=""> <meta name="Keywords" content=""> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> I’m aware of the bug filed here but the work around as documented did not work:<o:p></o:p> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1322963">https://bugzilla.redhat.com/show_bug.cgi?id=1322963</a><o:p></o:p> <o:p> </o:p> Looking at this ticket:<o:p></o:p> https://fedorahosted.org/freeipa/ticket/5799<o:p></o:p> It seems that it won’t be fixed until freeipa 4.5.<o:p></o:p> <o:p> </o:p> Is there any workaround currently in freeipa 4.2/4.3 to somehow manually generate a CSR that can be recognized by Microsoft ?<o:p></o:p> the ipa-server-install was able to generate a CSR for rootCA signing if one specifies --external-ca-type ms-cs, which works for MS AD CA.<o:p></o:p> <o:p> </o:p> but no such option exist for ipa-cacert-manage.<o:p></o:p> <o:p> </o:p> details below:<o:p></o:p> I’m trying to upgrade our current IPA installation from self-signed to be signed by the CA operated by IT.<o:p></o:p> So I followed the procedure here to generate the CSR to be signed:<o:p></o:p> <a href="http://www.freeipa.org/page/V4/CA_certificate_renewal">http://www.freeipa.org/page/V4/CA_certificate_renewal</a><o:p></o:p> However, when I submitted the CSR to be signed, the Microsoft Windows 2012R2 ADCA rejected the CSR with this error:<o:p></o:p> Certificate not issued (Denied) Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Active Directory Certi<o:p></o:p> olicy: ipaCSRExport/PANW_Subordinate Certification Authority.<o:p></o:p> The requested certificate template is not supported by this CA. 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE)<o:p></o:p> 1401.5098.0:<2016/11/3, 11:11:3>: 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE)<o:p></o:p> 1401.5602.0:<2016/11/3, 11:11:3>: 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE)<o:p></o:p> 1401.16709.0:<2016/11/3, 11:11:3>: 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE)<o:p></o:p> Certificate Request Processor: The requested certificate template is not supported by this CA. 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE)<o:p></o:p> Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Active Directory Certificate Services policy: ipaCSREx<o:p></o:p> nate Certification Authority.<o:p></o:p> <o:p> </o:p> here is the what CSR looks like(with keys taken out):<o:p></o:p> Certificate Request:<o:p></o:p> Data:<o:p></o:p> Version: 0 (0x0)<o:p></o:p> Subject: O=XYZ.LOCAL, CN=Certificate Authority<o:p></o:p> Subject Public Key Info:<o:p></o:p> Public Key Algorithm: rsaEncryption<o:p></o:p> Public-Key: (2048 bit)<o:p></o:p> Modulus:<o:p></o:p> Attributes:<o:p></o:p> friendlyName :unable to print attribute<o:p></o:p> Requested Extensions:<o:p></o:p> X509v3 Key Usage:<o:p></o:p> Digital Signature, Non Repudiation, Certificate Sign, CRL Sign<o:p></o:p> X509v3 Basic Constraints: critical<o:p></o:p> CA:FALSE<o:p></o:p> X509v3 Subject Key Identifier:<o:p></o:p> C9:8C:B7:B1:9D:4B:02:E2:74:FD:59:3E:1C:FC:9C:C9:98:EE:81:BD<o:p></o:p> 1.3.6.1.4.1.311.20.2:<o:p></o:p> ...i.p.a.C.S.R.E.x.p.o.r.t<o:p></o:p> Signature Algorithm: sha256WithRSAEncryption<o:p></o:p> <o:p> </o:p> I tried the workaround documented on the webpage and asked the CSR to be process via command line certreq. Same error.<o:p></o:p> I’ve also tried this workaround:<o:p></o:p> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1322963">https://bugzilla.redhat.com/show_bug.cgi?id=1322963</a><o:p></o:p> where I manually generated the cert via certutil:<o:p></o:p> # echo -e -n '\x1E\x0A\x00\x53\x00\x75\x00\x62\x00\x43\x00\x41' >ext-value<o:p></o:p> # certutil -R -d /etc/pki/pki-tomcat/alias -f <(grep -Po '(?<=internal=).*' /etc/pki/pki-tomcat/password.conf) -k 'caSigningCert cert-pki-ca' --extGeneric=1.3.6.1.4.1.311.20.2:not-critical:ext-value -o ipa.csr -a<o:p></o:p> <o:p> </o:p> which didn’t work either.<o:p></o:p> <o:p> </o:p> I’m running IPA version 4.2.0 on Centos 7.2.1511<o:p></o:p> ipa-server-4.2.0-15.0.1.el7.centos.17.x86_64<o:p></o:p> <o:p> </o:p> Also, If run the ipa-server-install –external-ca --external-ca-type ms-cs on a test box, it’ll generate a CSR that works, the only difference been that the X509V3 extentions are not there.<o:p></o:p> Exponent: 65537 (0x10001)<o:p></o:p> Attributes:<o:p></o:p> a0:00<o:p></o:p> so I’m not sure if the same logic that’s used in ipa-server-install can be used in ipa-cacert-manage to generate the renew CSR<o:p></o:p> <o:p> </o:p> Please help to generate a correct CSR for Microsoft Windows 2012R2 CA to recognize and sign so I can chain the existing self-signed CA to it. Thanks.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div> <div> -- <o:p></o:p> </div> </div> Efficiency is Intelligent Laziness<o:p></o:p> </div> </body> </html>