Indeed the CSR extensions are removed.
Here is a solution:
In the RA configuration window, you go to the "DN Fields Policy" tab and you add a field that you will never use, let say "UID", next you go to the "DN Validation Policy" tab and you set the field "UID" to "supplied".
In the CA configuration window, you click on "Manage Certificate Extensions", you add "subjectAltNames" (without the double quotes) and for the value "<dn>UID:move</dn>" (without the double quotes).
Now you only have to provide a csr with a DN field "UID" containing "DNS:ldap, DNS:ldap0, DNS:ldap.sb1732.net, DNS:ldap0.sb1732.net, DNS:ldap.bkgv.com, DNS:ldap0.bkgv.com", "subjectAltNames" will take the value of DN field "UID", which will be removed from the DN.
Regards, -- Fr�d�ric Giudicelli http://www.newpki.org
Brian Gregory, BKGV LLP wrote:
Hello,
I created a CSR (PKCS#10) file and imported it into my RA for signature. It had the following extension requests (output from openssl req -text command:)
Requested Extensions:
Netscape Comment: SB1732.Net LDAP Server Certificate
X509v3 Subject Alternative Name: DNS:ldap, DNS:ldap0, DNS:ldap.sb1732.net, DNS:ldap0.sb1732.net, DNS:ldap.bkgv.com, DNS:ldap0.bkgv.com
The resulting cert was signed ok, but the extension requests were not honored (the extensions for the CA in question have a different nsComment and no subjectAltName).
It is important that I be able to create certs with not only different CN's, but different subjectAltNames.
Does anyone have any clues on how to get the signature to honor my requested extensions?
Thanks! Brian Gregory. _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
_____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
