Closed rtvd closed 5 days ago
A valid work-around is to go into Advanced -> Edit when creating a new certificate and use the relevant part of the configuration you've posted:
subjectAltName = @subjectAltName_sect
[subjectAltName_sect]
otherName.0 = 1.3.6.1.5.2.2;SEQUENCE:princ_name
[princ_name]
realm = EXP:0, GeneralString:REALM
principal_name = EXP:1, SEQUENCE:principal_seq
[principal_seq]
name_type = EXP:0, INTEGER:1
name_string = EXP:1, SEQUENCE:principals
[principals]
princ1 = GeneralString:username
Adjust REALM and username according to your needs. If you need a certificate for a service, expand the [principals]
section like this:
[principals]
princ1 = GeneralString:krbtgt
princ2 = GeneralString:REALM
Maybe it will be useful for someone :-)
It would be nice to have an ability to use XCA with Kerberos PKINIT. https://k5wiki.kerberos.org/wiki/Pkinit_configuration
This would involve being able to issue certificates for Kerberos KDC and for Kerberos principals.
The issue is that the required attributes are quite fancy. The example OpenSSL configuration looks like this: