When installing multiple instances on the same host sharing the same HSM, if subject_dn's are not specifically spelled out with unique names for each instance, installation will fail with complaints that same subject name and serial number already exist. This happens in the scenario if you are creating a subordinate CA, for example, that's in the same domain name as the root CA. It is very inconvenient that you are expected to spell out subject dn's of all system certs in the pkispawn config file. I think it would be much more convenient if we change default.cfg so that the instance name is in the default subject dn, e.g. adding it as an "ou" component: ou=%(pki_instance_name)s
fix with instance name added as "ou" component in all default subject dn's default.cfg.subjectDNfix
Per PKI Bug Council of 08/31/2016: 10.3.6
Pushed to master: commit 1195ee9d6e45783d238edc1799363c21590febce
Cherry-picked into DOGTAG_10_3_BRANCH:
From 1d1b3a705fdaca26d580566ff3fb1725334ff674 Mon Sep 17 00:00:00 2001 From: Christina Fu cfu@dhcp-16-189.sjc.redhat.com Date: Wed, 31 Aug 2016 14:03:02 -0700 Subject: [PATCH 02/10] Ticket #2446 pkispawn: make subject_dn defaults unique per instance name (for shared HSM) When installing multiple instances on the same host sharing the same HSM, if subject_dn's are not specifically spelled out with unique names for each instance, installation will fail with complaints that same subject name and serial number already exist. This happens in the scenario if you are creating a subordinate CA, for example, that's in the same domain name as the root CA. It is very inconvenient that you are expected to spell out subject dn's of all system certs in the pkispawn config file. This patch changes default.cfg so that the instance name is in the default subject dn, e.g. adding it as an "ou" component: ou=%(pki_instance_name)s
(cherry picked from commit 1195ee9d6e45783d238edc1799363c21590febce)
Metadata Update from @cfu: - Issue assigned to cfu - Issue set to the milestone: 10.3.6
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/2566
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Login to comment on this ticket.