There is a naming constraint in the CA profile of:

policyset.caCertSet.1.constraint.params.pattern=CN=.*

So simply swap the order of the RDN values and it will work.

There is a naming constraint in the CA profile of:

policyset.caCertSet.1.constraint.params.pattern=CN=.*

So simply swap the order of the RDN values and it will work.

Thanks. I found three CA cfg Which one?

var/lib/pki/pki-tomcat/ca/profiles/ca/caCACert.cfg:16:policyset.caCertSet.1.constraint.params.pattern=CN=.*

var/lib/pki/pki-tomcat/ca/profiles/ca/caCMCcaCert.cfg:16:policyset.caCertSet.1.constraint.params.pattern=CN=.*

var/lib/pki/pki-tomcat/ca/profiles/ca/caInstallCACert.cfg:17:policyset.caCertSet.1.constraint.params.pattern=CN=.*

Should I leave this parameter blank as?

please let me know

Look in the pki debug log and you'll see what profile is being used;

INFO: CertProcessor: Submitting certificate request to ...

If you have specific profile questions you'd be better off engaging the dogtag pki team directly.

You can change the pattern to .*. I haven't tested what would happen if you leave the pattern blank.

The actual profile is caCACert. In FreeIPA deployments, it is stored in the LDAP object cn=caCACert,ou=certificateProfiles,ou=ca,o=ipaca. You cannot edit it via the ipa command. Instead, you can use the pki ca-profile-edit command (you can use the IPA RA Agent certificate to authenticate), or else ldapmodify the object directly.

You can change the pattern to .*. I haven't tested what would happen if you leave the pattern blank.

The actual profile is caCACert. In FreeIPA deployments, it is stored in the LDAP object cn=caCACert,ou=certificateProfiles,ou=ca,o=ipaca. You cannot edit it via the ipa command. Instead, you can use the pki ca-profile-edit command (you can use the IPA RA Agent certificate to authenticate), or else ldapmodify the object directly.

Thanks.
I'm using a containerized FreeIPA CA. I can manually change it with vim. After changing the caCAcert.cfg file, Do I need to do something else in order to make the change take effect?

@ogonzales as mentioned above, the actual profile config is stored in LDAP. That is the object that needs to be modified - not a flat file on disk. You can use the pki ca-profile-edit command (will invoke an editor) or ldapmodify (the certProfileConfig attribute is base-64 encoded, so you must decode, edit, and re-encode it).

Got it. Thanks!