#2446 pkispawn: make subject_dn defaults unique per instance name (for shared HSM)
Closed: Fixed None Opened 7 years ago by cfu.

When installing multiple instances on the same host sharing the same HSM, if subject_dn's are not specifically spelled out with unique names for each instance, installation will fail with complaints that same subject name and serial number already exist.
This happens in the scenario if you are creating a subordinate CA, for example, that's in the same domain name as the root CA. It is very inconvenient that you are expected to spell out subject dn's of all system certs in the pkispawn config file.
I think it would be much more convenient if we change default.cfg so that the instance name is in the default subject dn, e.g. adding it as an "ou" component:
ou=%(pki_instance_name)s


fix with instance name added as "ou" component in all default subject dn's
default.cfg.subjectDNfix

Per PKI Bug Council of 08/31/2016: 10.3.6

Pushed to master:
commit 1195ee9d6e45783d238edc1799363c21590febce

Cherry-picked into DOGTAG_10_3_BRANCH:

From 1d1b3a705fdaca26d580566ff3fb1725334ff674 Mon Sep 17 00:00:00 2001
From: Christina Fu cfu@dhcp-16-189.sjc.redhat.com
Date: Wed, 31 Aug 2016 14:03:02 -0700
Subject: [PATCH 02/10] Ticket #2446 pkispawn: make subject_dn defaults unique
per instance name (for shared HSM) When installing multiple instances on the
same host sharing the same HSM, if subject_dn's are not specifically spelled
out with unique names for each instance, installation will fail with
complaints that same subject name and serial number already exist. This
happens in the scenario if you are creating a subordinate CA, for example,
that's in the same domain name as the root CA. It is very inconvenient that
you are expected to spell out subject dn's of all system certs in the
pkispawn config file. This patch changes default.cfg so that the instance
name is in the default subject dn, e.g. adding it as an "ou" component:
ou=%(pki_instance_name)s

(cherry picked from commit 1195ee9d6e45783d238edc1799363c21590febce)

Metadata Update from @cfu:
- Issue assigned to cfu
- Issue set to the milestone: 10.3.6

7 years ago

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2566

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.

Login to comment on this ticket.

Metadata