Could you try this and tell me if it works:
UID must be of format:
"ldap, DNS:ldap0, DNS:ldap.sb1732.net, DNS:ldap0.sb1732.net, DNS:ldap.bkgv.com, DNS:ldap0.bkgv.com" (you remove the initial "DNS:")
subjectAltName must be of format: "DNS:<dn>UID:move</dn>"
Tell me it works like that.
Regards, -- Fr�d�ric Giudicelli http://www.newpki.org
Brian Gregory wrote:
Hello Fr�d�ric, all -
Thank you for your assistance!
I had no trouble configuring the RA as specified, but when I tried adding the value to the CA config's Manage Certificate Extensions, I received the following error:
Error sent by PKI server: #3003 Could not get the field specificity:Cert Exts:subjectAltName [Entity_PKI.cpp:1857]
(in case I missed something, I also tried subjectAltNames - but figured you mean subjectAltName).
I am running 2.0.0-beta4.
Thanks, again! Brian.
On Fri, Mar 11, 2005 at 04:15:56PM +0100, Fr�d�ric Giudicelli wrote:
Indeed the CSR extensions are removed.
Here is a solution:
In the RA configuration window, you go to the "DN Fields Policy" tab and you add a field that you will never use, let say "UID", next you go to the "DN Validation Policy" tab and you set the field "UID" to "supplied".
In the CA configuration window, you click on "Manage Certificate Extensions", you add "subjectAltNames" (without the double quotes) and for the value "<dn>UID:move</dn>" (without the double quotes).
Now you only have to provide a csr with a DN field "UID" containing "DNS:ldap, DNS:ldap0, DNS:ldap.sb1732.net, DNS:ldap0.sb1732.net, DNS:ldap.bkgv.com, DNS:ldap0.bkgv.com", "subjectAltNames" will take the value of DN field "UID", which will be removed from the DN.
Regards, -- Fr�d�ric Giudicelli http://www.newpki.org
Brian Gregory, BKGV LLP wrote:
>Hello,
>
>I created a CSR (PKCS#10) file and imported it into my RA for
>signature. It had the following extension requests (output
>from openssl req -text command:)
>
> Requested Extensions:
> Netscape Comment: > SB1732.Net LDAP Server Certificate
> X509v3 Subject Alternative Name: > DNS:ldap, DNS:ldap0, DNS:ldap.sb1732.net, > DNS:ldap0.sb1732.net, DNS:ldap.bkgv.com, DNS:ldap0.bkgv.com
>
>The resulting cert was signed ok, but the extension requests were not
>honored (the extensions for the CA in question have a different nsComment
>and no subjectAltName).
>
>It is important that I be able to create certs with not only different >CN's,
>but different subjectAltNames.
>
>Does anyone have any clues on how to get the signature to honor my
>requested extensions?
>
>Thanks!
>Brian Gregory.
_____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
-- Fr�d�ric Giudicelli http://www.newpki.org _____________________________________________________________________ NewPKI http://www.newpki.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
