freeipa

#6455 Add example of RDN order for ipa-server-install --subject
Closed: Fixed Opened by cheimes.

Closed: Fixed
Reopen Issue

The --subject argument of ipa-server-install takes RDN in LDAP order ('OU=freeipa, C=US'), not in X.509 order as used by browsers ('C=US, OU=freeipa'). The unexpected order can cause some confusion and break an installation. ipa-server-install --help should mention the order:

The certificate subject base (default O=). RDNs are in LDAP order (e.g. 'O=REALM, OU=freeipa, C=US').

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=828866 (Red Hat Enterprise Linux 7)

A commit to resolve this is part of pull request:
https://github.com/freeipa/freeipa/pull/245

master:

  • 3f5660973251fe4b178e6486b6b86fbdd162d4d6 Indicate that ca subject / subject base uses LDAP RDN order

Metadata Update from @cheimes:
- Issue assigned to ftweedal
- Issue set to the milestone: FreeIPA 4.5
Metadata
None
None
None
Highest
enhancement
Installation
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.