internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-07-31 03:44:41 +00:00
Code Issues Projects Releases Wiki Activity

Fix ca-less test to use X.509 v3 certificates

Browse Source 
The generated certificates have been X.509 v1. This is not supported any
more. Only X.509 v3 is supported.

A new certificates/extensions.conf file has been added to make v3
certificates.

The existing certificates/pkinit/extensions.conf has been renamed to
certificates/pkinit-extensions.conf with additional changes. For example
"[kdc_cert]" had to be removed for v3.

The extensions config files are using environment variables, which are
set by the generate-certificates.sh script before calling openssl.

The script generate-certificates.sh has been reworked for a simpler
structure, also new options have been added: "ca" and "cleanup".
This commit is contained in:
Thomas Woerner
2024-03-05 11:05:19 +01:00
parent ce05b5e137
commit b92da82661
5 changed files with 169 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
tests/ca-less/certificates/extensions.conf Normal file
View File

@@ -0,0 +1,7 @@
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
authorityKeyIdentifier = keyid,issuer
subjectAltName = @alt_names
[alt_names]
DNS.1 = ${ENV::HOST_FQDN}