I'm attempting to make VMWare's certificate authority (VMCA) v6.7 a trusted sub-CA of a FreeIPA certificate authority. I should be able to generate a certificate signing request within VMCA using either an interactive tool (certificate-manager) or by using VMWare's certool and a config file (certool.cfg).
Of course, interactive tools have their appeal. The tool asks questions. Some answers are required:
Press Enter key to skip optional parameters or use Previous value. Enter proper value for 'Country' [Previous value : US] : Enter proper value for 'Name' [Previous value : vcenter.int.demarcohome.com] : Enter proper value for 'Organization' [Previous value : DeMarco Home] : Enter proper value for 'OrgUnit' [Previous value : none] : Enter proper value for 'State' [Previous value : North Carolina] : Enter proper value for 'Locality' [Previous value : Raleigh] : Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] : Enter proper value for 'Email' [Previous value : firstname.lastname@example.org] : Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter.int.demarcohome.com Enter proper value for VMCA 'Name' : vcenter
Within FreeIPA, when I attempt to sign this CSR, the request is not signed, with error #3009:
invalid 'csr': subject alt name type RFC822Name is forbidden for non-user principals
Decoding the CSR (https://www.sslshopper.com/csr-decoder.html) tells me it includes subject alternate names (SANs):
email:email@example.com, IP Address:10.71.73.8 vcenter.int.demarcohome.com
The error 'Name is forbidden for non-user principals' makes some sense to me, but not enough to point me in the right direction. Do I need to format my CSR differently by answering the questions differently, or am I going about the process of creating a subordinate CA incorrectly within FreeIPA?