Closed thoemy closed 8 years ago
Thanks for the bug report! Making sure that any errors are visible in the pki-realm
output is definitely a good idea.
Does the error mean that the Wheezy certtool
does not support the uri
SAN option, or is it named differently, or SANs are not supported at all in this version? The gnutls.conf
template should be updated to take these possibilities into account. Can you check to see which one of these is the reason of the error?
From https://www.gnutls.org/abi-tracker/changelog/gnutls/3.4.4/log.html:
* Version 3.0.20 (released 2012-06-05)
...
** certtool: Added support for the URI subject alternative name type in certtool.
....
So the version in Debian wheezy does not support the uri
SAN option. All other options are supported.
@thoemy Great, thank you. I'll try and update the script shortly so that it won't add the uri
SANs if the gnutls
version is too old.
pki-realm
may fail to generate arequest.pem
when thegnutls.conf
file is invalid. In my case it complains about an unknownuri
option.The failure is not visible in the ansible output and one wonders why the realm is not correctly setup.
Removing the
uri
from the above realm configuration makes things work.This happened with an older Debian wheezy system.
So the error from the certtool output should probably shown to the user and the task aborted.