Tikkanen, Tuomo (Nokia - FI/Espoo) wrote:
On 23.4.2016 1:23, EXT Rob Crittenden wrote:
Tikkanen, Tuomo (Nokia - FI/Espoo) wrote:
........
Repetitio est mater studiorum:

How I can clean this defective state of certmonger?

# ipa-getcert stop-tracking -i 20160212110456


Ah! That was obvious! Thanks a lot Rob.


Second question if/when the above urgent problem is solved:

Is there any way to get IP address to SAN field for the IPA
Server-Certs?

Not without changing code. IP address SAN are explicitly forbidden:
Subject alt name type IP Address is forbidden

rob

Is there any true reason why IP Address is forbidden by certmonger /
freeipa? Or is it just "not implemented" kind of restriction?


It is denied by IPA, not certmonger.

IP addresses are frowned upon in certs in general and they are denied by IPA because the access control would be really difficult. Today a host must be granted access to issue certs with additional names in it.

You can open a RFE for this on the IPA trac if you really need it.

I'm not deeply familiar with the new profile support so perhaps it is possible to do this using the latest version of IPA, I'm not sure.

rob

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to