Hi, I'm running a single-host, hosted-engine Ovirt deployment, version 4.3.10 (upgraded from 4.0->4.1->4.2) and it's complaining that my host cert does not have a SubjectAltName. If I try to use pki-enroll-request.sh to rebuild the host cert and follow the instructions to add a --san, I get an error: /usr/share/ovirt-engine/bin/pki-enroll-request.sh --name=host.na.me --san=host.na.me

Using configuration from openssl.conf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows organizationName :PRINTABLE:'My Org Name' commonName :PRINTABLE:'host.na.me' ERROR: adding extensions in section v3_ca_san 139875647600528:error:2207507C:X509 V3 routines:v2i_GENERAL_NAME_ex:missing value:v3_alt.c:531: 139875647600528:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=subjectAltName, value=host.na.me Cannot sign certificate Am I using this script incorrectly?

Hi Didi, On Tue, December 8, 2020 10:03 am, Yedidyah Bar David wrote: > On Tue, Dec 8, 2020 at 4:25 PM Derek Atkins <derek(a)ihtfp.com&gt; wrote: >> >> Hi, >> >> I'm running a single-host, hosted-engine Ovirt deployment, version >> 4.3.10 >> (upgraded from 4.0->4.1->4.2) and it's complaining that my host cert >> does >> not have a SubjectAltName. >> >> If I try to use pki-enroll-request.sh to rebuild the host cert and >> follow >> the instructions to add a --san, I get an error: >> >> /usr/share/ovirt-engine/bin/pki-enroll-request.sh --name=host.na.me >> --san=host.na.me > > Please try with '--san=DNS:host.na.me'. AHA, thank you... Thank worked. >> Using configuration from openssl.conf >> Check that the request matches the signature >> Signature ok >> The Subject's Distinguished Name is as follows >> organizationName :PRINTABLE:'My Org Name' >> commonName :PRINTABLE:'host.na.me' >> ERROR: adding extensions in section v3_ca_san >> 139875647600528:error:2207507C:X509 V3 >> routines:v2i_GENERAL_NAME_ex:missing value:v3_alt.c:531: >> 139875647600528:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error >> in >> extension:v3_conf.c:95:name=subjectAltName, value=host.na.me >> Cannot sign certificate >> >> Am I using this script incorrectly? > > You are using it well. --san argument is passed as-is to openssl's > 'subjectAltName', which requires a prefix to tell its type. Search the > net for 'openssl subjectAltName' for other examples. Is there any chance this could be added to the --help output? An actual example would have been very useful.

On Tue, December 8, 2020 10:17 am, Yedidyah Bar David wrote: > On Tue, Dec 8, 2020 at 5:09 PM Derek Atkins <derek(a)ihtfp.com&gt; wrote: >> [snip] >> Is there any chance this could be added to the --help output? >> An actual example would have been very useful. > > Frankly, I'd prefer people (like you) that need to use these > utilities manually, to search the net if they have problems, > than spending hours debating about how long --help should be, > what should be included in it and what not, what link we might > provide for further reference (and please note that I didn't > include such a link in my original reply - simply because I > failed to find one that seemed "most suitable"), etc. That said, > patches are welcome! If you think you can improve the current > text in a conflict-free way, which everyone will agree to, please > go ahead and push a patch! :-) I'll take a look at doing that.

I did google some before asking here, but there were very few hits for usage of pki-enroll-request.sh -- although I admit I did not try many different search terms. Most of the results were not ovirt related nor related to this script at all.

> BTW: What I personally do, is to search the code and/or relevant > logs to see what other tools (the engine, engine-setup, in this > case) do, as "reference examples". That presumes having ready access to (in this case) ovirt sources -- which you obviously do but I do not. As a user, I don't feel I should need to go refer to the sources to determine how a utility program should be properly used. IMHO that's what documentation is used for. However I will keep that in mind for my next issue ;)

But I do understand your PoV -- for GnuCash I often reference the sources when answering people's questions. However that's a case where I am (or was) one of the developers so I do have the sources handy. :)

Thanks again. I am all set now!