proprietary Subject DN Attributes not applied using PKCS#10 enrollment

[gilles380]

Hi support team,

I am doing some X509 issuing test using PKCS#10 enrollment, works fine, but now have defined new Subject DN Attributes in my end -entity profile (check box 'required' / 'modifiable' not selected, and my CSR does not contains those) . Then, my issued X509 does not contain those attributes in my subject, which is not my expectation. Any clue on this ? Thanks

[gilles380]

I guess I have to modify some java source file.. looking into it

[primetomas]

I do not think so. MOre important is to know how you are enrolling, through which UI or API and what settings your profiles have.

[gilles380]

Hi @primetomas and @svenska-primekey
I am enrolling using REST url : ejbca/ejbca-rest-api/v1/certificate/pkcs10enroll
Well to be more precise, I am working on Matter protocol, (I had you setup working https://www.youtube.com/watch?v=3DR5kHH9yyI)
I had a chat with keyfactor Guys , product team will add those attributes but before that, I need to have them working for a demo using ejbca CE (before , possibly, moving to EE).
=> as you add MATTER VID and PID, I want to had other Matter mandatory attributes (It is not DAC scoped, but NOC scoped) in
:profilemappings.properties :

DN attribute OIDs used by Matter IoT (https://csa-iot.org/all-solutions/matter/)

DN;VID;107;VID;107;VID (Matter VID);DN_MATTER_VID
DN;PID;108;PID;108;PID (Matter PID);DN_MATTER_PID

DN;FID;110;FID;110;FID (matter-fabric-id);DN_MATTER_FABRIC_ID
DN;NID;111;NID;111;NID (matter-node-id);DN_MATTER_NODE_ID
DN;CAT;112;CAT;112;CAT (matter-cat);DN_MATTER_CAT

Also, I guess I have an issue with my source code (I had other fields as it has been done for Matter PID and VID) but when adding end entity, if breaks with:
An exception has occurred.
java.lang.IllegalArgumentException: Unknown object id - FID - passed to distinguished name

2024-03-20 11:23:16,391 WARN [org.cesecore.certificates.util.DNFieldExtractor] (default task-3) setDN: : java.lang.IllegalArgumentException: Unknown object id - CAT - passed to distinguished name
at deployment.ejbca.ear//org.bouncycastle.asn1.x500.style.IETFUtils.decodeAttrName(Unknown Source)
at deployment.ejbca.ear//com.keyfactor.util.CeSecoreNameStyle.attrNameToOID(CeSecoreNameStyle.java:325)
at deployment.ejbca.ear//org.bouncycastle.asn1.x500.style.IETFUtils.rDNsFromString(Unknown Source)
at deployment.ejbca.ear//org.cesecore.certificates.util.DNFieldExtractor.setDN(DNFieldExtractor.java:238)
at deployment.ejbca.ear.adminweb.war//org.ejbca.ui.web.admin.rainterface.UserView.setSubjectDN(UserView.java:76)
...
...
Caused by: java.lang.IllegalArgumentException: Unknown object id - FID - passed to distinguished name

just tried with Matter VID, works fine but does not with my new fields:

certificate:
Data:
Version: 3 (0x2)
Serial Number:
31:ed:6d:23:47:bc:e3:96:75:f8:a0:a9:d6:7f:af:81:04:a5:65:51
Signature Algorithm: ecdsa-with-SHA256
Issuer: CN = CACACACA0003
Validity
Not Before: Mar 20 08:19:30 2024 GMT
Not After : Mar 20 08:19:29 2026 GMT
Subject: O = CSR, 1.3.6.1.4.1.37244.2.1 = FFF1

....

[svenska-primekey]

Are asking how to require this attribute in the Subject DN when it is not included in the CSR?

[gilles380]

Also, I tried to deleted unused End Entity Profiles but it fails, saying:
"Couldn't delete profile. it's still used by some end entities or roles."

[primetomas]

Hi Gilles, then we understand what you're looking for. It's a feature we are looking into. If you DM me we can discuss it directly with our IoT folks who knows the details about the Matter specification.
It's typically a bit more to it than editing those files, albeit you may be able to succeed in a hackish way. PID and VID are officially supported and added to the code so they definitely should work :-).
https://doc.primekey.com/ejbca/tutorials-and-guides/create-cas-for-matter-iot

The NOC DN attributes are not officially added yet.
(I would have added it as extensions or altNames if I wrote the spec...)

If you can get it into the CSR exactly like you want it you can use "Allow subjectDN override". This is typically the best, and most forward compatible, way to add "unknown/custom" DN attributes to certificates.

[gilles380]

Hi Tomas @primetomas how can we talk privately ? thanks

[gilles380]

CSR is not an option : in Matter design, let's say the HUB/gateway is in charge of pairing end devices. This GW ass the end device for a CSR, get it back , verify it then it foward it as it is to the external RA. => it is up to the RA/CA to add the NOC DN attributes

[primetomas]

I forget that GitHub doesn't have direct messaging :-). It is firstname.lastname at keyfactor com.
I just added my LinkedIn to my profile as well.