mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-05-08 06:13:21 +00:00
b92da82661
The generated certificates have been X.509 v1. This is not supported any more. Only X.509 v3 is supported. A new certificates/extensions.conf file has been added to make v3 certificates. The existing certificates/pkinit/extensions.conf has been renamed to certificates/pkinit-extensions.conf with additional changes. For example "[kdc_cert]" had to be removed for v3. The extensions config files are using environment variables, which are set by the generate-certificates.sh script before calling openssl. The script generate-certificates.sh has been reworked for a simpler structure, also new options have been added: "ca" and "cleanup".
20 lines
592 B
Plaintext
20 lines
592 B
Plaintext
basicConstraints = CA:FALSE
|
|
keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
|
|
extendedKeyUsage = 1.3.6.1.5.2.3.5
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid,issuer
|
|
issuerAltName = issuer:copy
|
|
subjectAltName = otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
|
|
|
|
[kdc_princ_name]
|
|
realm = EXP:0,GeneralString:${ENV::REALM_NAME}
|
|
principal_name = EXP:1,SEQUENCE:kdc_principal_seq
|
|
|
|
[kdc_principal_seq]
|
|
name_type = EXP:0,INTEGER:1
|
|
name_string = EXP:1,SEQUENCE:kdc_principals
|
|
|
|
[kdc_principals]
|
|
princ1 = GeneralString:krbtgt
|
|
princ2 = GeneralString:${ENV::REALM_NAME}
|