freeipa

#6291 Incorrect CA ACL evaluation of SAN DNS names in certificate request
Closed: Fixed Opened by mbabinsk.

Closed: Fixed
Reopen Issue

ipa cert-request is supposed to check that the DNS names included in the SubjectAltName extension of CSR are authorized to be used with the certificate profile used with the CSR.

A regression introduced in c2af032c0333f7e210c54369159d1d9f5e3fec74 effectively bypassed this check, allowing the host principal to succesfully submit CSR with SAN DNS names of any host enrolled in FreeIPA domain.

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1372597

Fixed in master:
- 25ed36fda14b30d6a50746a536939e3b428993cb Fix CA ACL Check on SubjectAltNames

Metadata Update from @mbabinsk:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.4.1
Metadata
None
None
None
Low
defect
Certificate management
mbabinsk. ftweedal
wanted
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.