freeipa

#6976 External CA: check that IPA CA certificate contains Subject Key Identifier
Closed: fixed Opened by ftweedal.

Closed: fixed
Reopen Issue

The Subject Key Identifier extension is required for CA certificates.
If it is missing, subsequent cert issuance fails, because the CA
Subject Key Identifier is used to the construct the Authority Key Identifier
extension on the issued cert.

During the second stage of external CA installation, add a check for the
Subject Key Identifier extension.

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

Metadata Update from @ftweedal:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1455200

PR: https://github.com/freeipa/freeipa/pull/813

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.6

master:

  • bc6d4995144505c45a62320c71f503b54f68a962 Add Subject Key Identifier to CA cert validity check

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.