[Freeipa-devel] [freeipa PR#3500][opened] WIP: Change RA agent certificate profile to caRAagentCert

[abbra]

   URL: https://github.com/freeipa/freeipa/pull/3500
Author: abbra
 Title: #3500: WIP: Change RA agent certificate profile to caRAagentCert
Action: opened

PR body:
"""
Currently, RA agent certificate is issued using caServerCert profile.
This has unfortunate side effect of asserting id-pk-serverAuth EKU which
is not really needed for RA agent. If IPA CA certificate adds SAN DNS
constraints into issued certificates, presence of id-pk-serverAuth EKU
forces NSS (and other crypto libraries) to validate CN value with
regards to SAN DNS constraints, due to historical use of CN bearing DNS
name.

Since RA agent certificate has 'CN=IPA RA', it is guaranteed to fail
the check.

Default IPA CA configuration does *not* add SAN DNS constraints into RA
agent certificate. However, it is better to be prepared to such
behavior.

Related: https://bugzilla.redhat.com/1670239
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3500/head:pr3500
git checkout pr3500