URL:
https://github.com/freeipa/freeipa/pull/963
Author: rcritten
Title: #963: Include the CA basic constraint in CSRs when renewing a CA
Action: opened
PR body:
"""
The CSR generated by `ipa-cacert-manage renew --external-ca` did
not include the CA basic constraint:
X509v3 Basic Constraints: critical
CA:TRUE
Add a flag to certmonger::resubmit_request to specify that a
CA is being requested.
Note that this also sets pathlen to -1 which means an unlimited
pathlen. Leave it up to the issuing CA to set this.
https://pagure.io/freeipa/issue/7088
"""
To pull the PR as Git branch:
git remote add ghfreeipa
https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/963/head:pr963
git checkout pr963