I'm attempting to make VMWare's certificate authority (VMCA) v6.7 a trusted sub-CA of a FreeIPA certificate authority. I should be able to generate a certificate signing request within VMCA using either an interactive tool (certificate-manager) or by using VMWare's certool and a config file (certool.cfg).

Of course, interactive tools have their appeal. The tool asks questions. Some answers are required:

Press Enter key to skip optional parameters or use Previous value.

Enter proper value for 'Country' [Previous value : US] : 

Enter proper value for 'Name' [Previous value : vcenter.int.demarcohome.com] : 

Enter proper value for 'Organization' [Previous value : DeMarco Home] : 

Enter proper value for 'OrgUnit' [Previous value : none] : 

Enter proper value for 'State' [Previous value : North Carolina] : 

Enter proper value for 'Locality' [Previous value : Raleigh] : 

Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] : 

Enter proper value for 'Email' [Previous value : nick@demarcohome.com] : 

Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter.int.demarcohome.com

Enter proper value for VMCA 'Name' : vcenter

Within FreeIPA, when I attempt to sign this CSR, the request is not signed, with error #3009:

invalid 'csr': subject alt name type RFC822Name is forbidden for non-user principals

Decoding the CSR (https://www.sslshopper.com/csr-decoder.html) tells me it includes subject alternate names (SANs):

IP Address:

The error 'Name is forbidden for non-user principals' makes some sense to me, but not enough to point me in the right direction. Do I need to format my CSR differently by answering the questions differently, or am I going about the process of creating a subordinate CA incorrectly within FreeIPA?


The most common names used as Subject Alternative Name (SAN) in an X.509 v3 certificate extension are 'DNSName' and 'RFC822Name'. The name 'RFC822Name' is usually an email address while 'DNSName' is a hostname.

The error "'invalid 'csr': subject alt name type RFC822Name is forbidden for non-user principals'" says it all. You can't use a SAN with name type 'RFC822Name' when you request a certificate for a non-user principal.

It seems you are trying to create a certificate for a certificate authority (CA). In this case you used the wrong certificate profile to create the certificate signing request (CSR). I would recommend to talk to your PKI administrators and explain them that you want to create CSR for a CA and ask them which profile to use. Different types of certificates require different profiles because of the different extensions used in the certificates.

You can find more information about how to make VMCA a intermediate CA here:


And here you see the requirements for the CSR to make VMCA a intermediate CA:


| improve this answer | |
  • Your answer is helpful. I'm the PKI administrator, and also the person who takes out the trash. Please guide me on a few more points. Future me update my question. – ndemarco Mar 4 at 16:13
  • The article for making a VSphere 6.7 VMCA an intermediate CA is docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/… – ndemarco Mar 4 at 16:15
  • On certificate profiles, please share some starting points for learning about certificate profiles. – ndemarco Mar 4 at 16:17
  • I would recommend to check the product documentation first. Other than that I think a good starting point is to read rfc5280 and the openssl-req man page. There you will find more information about how to create a CSR using openssl and how to make sure the correct certificate extensions are added to the CSR. Check for 'v3_ca' configuration profile to see which extensions are required when you create a CSR for a Certificate Authority. – Thorsten Scherf Mar 4 at 16:46
  • I thank you for taking time to write this. It is, however, not a realistic task. FreeIPA's documentation is scattered, full of superseded info, and written for a deeply technical audience, contrary to the product's stated goal. RFC5280 is 147 pages of dense material. In my experience, this will raise many more questions than it will answer. It's not my intention to become an expert in the field of PKI. Can you point me to a profile you believe I should be using for this? – ndemarco Mar 4 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.