SAN:Directory Name (DirName) handling

[fuentesea]

Hello,
I have problems to handle Directory Name in Subject Alternative Name.
My EJBCA configuration (only relevant to the case)

Certificate Profile:
X.509v3 extensions

• Basic Constraints+Critical
• Authority Key ID

X.509v3 extensions Usages

• Key usege: use + critical+digital signature+non-repudiation+Key encipherment+Data encipherment+Key agreement+Encipher only+Decipher only
• Extended Key Usage: use +Client authetication+Email Protection

X.509v3 extensions Names

• Subject Alternative Name: use
• Subject Directory Attributes: use

End Entity Profile:

• Subject DN Attributes: CN, Common name [required, modifiable], OU, Organizational Unit [modifiable], serialNumber, Serial number (in DN) [modifiable], C, Country (ISO 3166) [modifiable], title, Title [modifiable]
• Subject Alternative Name: Directory Name (Distinguished Name)[modifiable]

My intention is to create an End Entity profile tha can emit certificate similar to the following (based on openssl dump of an existing certificate)
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
46:00:00: xxxxxxxxxxxxxx
Signature Algorithm: sha256WithRSAEncryption
Issuer: MY EJBCA data
Validity
Not Before: date
Not After : date
Subject: CN=Company Name, serialNumber=idetifier key , OU=company OU, C=SE
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
xxxxxxxxxxxxxx
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Encipher Only, Decipher Only
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Client Authentication, E-mail Protection
X509v3 Subject Key Identifier:
xxxxxxx
X509v3 Authority Key Identifier:
xxxxxx
X509v3 CRL Distribution Points:
Full Name:
URI:my crl distribution
Authority Information Access:
CA Issuers - URI:my issuer URI
OCSP - URI:my ocsp uri
X509v3 Certificate Policies:
Policy: 2.16.32.1.1.4
CPS: my policy uri
User Notice:
Explicit Text:
X509v3 Subject Alternative Name:
DirName:/title=Final user title/serialNumber=final user key/CN=final user name
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
xxxxxxxxxxx
No Trusted Uses.
No Rejected Uses.
Key Id: 01:00:00:00

I didn't succeed to get the dirname populated in the RA UI from a CSR
the config file used to generate the CSR is the following
[ req ]
default_bits = 2048
prompt = no
distinguished_name = req_distinguished_name
req_extensions = v3_req

[ req_distinguished_name ]
CN = Company Name
serialNumber = identifier key
OU = company OU
C = SE

[ v3_req ]
subjectAltName = dirName:san_dir

[ san_dir ]
CN = final user name
serialNumber =final user key
OU = final user OU
title = final user title
C = SE

Any help will be much appreciated.

Thanks in advance,
regards

[primetomas]

I'm not sure what the problem is, if any? Yes you can add a directory name to the end entity profile. When adding an end entity it will show up as an input field.

[fuentesea]

Hi primetomas.
Yes, I know that. The field is shown in the RA UI but is not filled with the data requested in the CSR. All the other fields are taken correctly from it.
If you take a look at the config file used to generate the CSR, I added a dirName field but, as I said, it is not shown prefilled in the field (your picture), as a consequence the final certificate will not have that info.
Other fields like DNS (if I add them to the profile) are handled correctly.
Do you want me to attach a CSR, the config file and profile configurations?

[primetomas]

That you were using the RA UI and looking for pre-filled information was the missing piece of information :-). You might have used the REST API in which case it's a very different topic.

So it's the pre-filling in the RA UI that is the issue. It may be that dirName wasn't added since it's a very uncommon altName to use actually. But I haven't looked into it. Attaching a CSR could be helpful, the EJBCA configuration is no problem for me.

[fuentesea]

If I understand correctly, REST API should handle this without any problem. That is my final goal and I wanted to test it manually before doing any development.
I can make POC app calling the API if needed, let me know if you want me to do that.

This is the request
-----BEGIN CERTIFICATE REQUEST-----
MIIDIzCCAgsCAQAwUjEUMBIGA1UEAwwLQ29tYXB5IE5hbWUxFDASBgNVBAUTC0FC
QzEyMzQ1Njc4MRcwFQYDVQQLDA5BRE1JTklTVFJBVElPTjELMAkGA1UEBhMCU0Uw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3bdBAYFdaQ/1okIaUeeIW
4TrC9Xf1V7kvQcFAeG9CFT0bNHEnJlgtV7tR9WCkwOtrjsCWHZqTg3D5+HBVJo75
IXHiYQ1qvWgKMNHh3qrimqYbOttJko0vBHDkHGF7ElPAtkTBLA2k75S8eKVVaL6j
0CYfBQqKr0xpYsspkcZsP20PgR4M1GGXLOgJmNiivhDpG0SatsR0TV6tWtiLjmhC
+Cdh7bPqs5r+oYa1qKiQvC4FNIiksWM8qk3PKBI5Pa2MAOBjebY5f4kJt5oGXHjT
XW7qwC4RZK+uy9QxoOS/lh3cqPa/hz34xzyvPg8Hd4rmRxVmzi63ChiFAAhy+ZBv
AgMBAAGggYswgYgGCSqGSIb3DQEJDjF7MHkwdwYDVR0RBHAwbqRsMGoxFDASBgNV
BAMMC0ZJTkFMRSBVU0VSMRUwEwYDVQQFEwxYWVogODc2NTQzMjExFzAVBgNVBAsM
DkFETUlOSVNUUkFUSU9OMRUwEwYDVQQMDAxBRE1JTlNUUkFUT1IxCzAJBgNVBAYT
AlNFMA0GCSqGSIb3DQEBCwUAA4IBAQCEPX2vJI55MZ9CXf1oqRieq9AF6RSp6oSx
LVPLoGNGpeQGhz56uQdm+lmVdb7CN6SpBuz1Qa5ucPo1Cy0YiuAyVP0rbYM7A460
pFLfBJEOd2pC8h1a3EODvV/LRg0vp1nOTk3EdAhaU1cKLeKuXVJcdBjxsgJ6XL5d
7rZvNDKXsHcMOBrVNKY1oHK31wEr+/LI9Zni572saPpkLSH1V8uKNw30eX5RckdF
75/+nJkg3KkOrQI2aXleGruSwKcI97UFAoqOnTJTfLp8sdEV9eEpnYjy45BfSi89
zdkZ0+EaZ02FRFz4BoodIVWdDEY1EAie3WNGodpiwpSrgP8e+wiC
-----END CERTIFICATE REQUEST-----

[primetomas]

Works fine for me, this JSON REST request to the pkcs10Enroll endpoint:

{
  "certificate_request": "MIIDIzCCAgsCAQAwUjEUMBIGA1UEAwwLQ29tYXB5IE5hbWUxFDASBgNVBAUTC0FCQzEyMzQ1Njc4MRcwFQYDVQQLDA5BRE1JTklTVFJBVElPTjELMAkGA1UEBhMCU0UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3bdBAYFdaQ/1okIaUeeIW4TrC9Xf1V7kvQcFAeG9CFT0bNHEnJlgtV7tR9WCkwOtrjsCWHZqTg3D5+HBVJo75IXHiYQ1qvWgKMNHh3qrimqYbOttJko0vBHDkHGF7ElPAtkTBLA2k75S8eKVVaL6j0CYfBQqKr0xpYsspkcZsP20PgR4M1GGXLOgJmNiivhDpG0SatsR0TV6tWtiLjmhC+Cdh7bPqs5r+oYa1qKiQvC4FNIiksWM8qk3PKBI5Pa2MAOBjebY5f4kJt5oGXHjTXW7qwC4RZK+uy9QxoOS/lh3cqPa/hz34xzyvPg8Hd4rmRxVmzi63ChiFAAhy+ZBvAgMBAAGggYswgYgGCSqGSIb3DQEJDjF7MHkwdwYDVR0RBHAwbqRsMGoxFDASBgNVBAMMC0ZJTkFMRSBVU0VSMRUwEwYDVQQFEwxYWVogODc2NTQzMjExFzAVBgNVBAsMDkFETUlOSVNUUkFUSU9OMRUwEwYDVQQMDAxBRE1JTlNUUkFUT1IxCzAJBgNVBAYTAlNFMA0GCSqGSIb3DQEBCwUAA4IBAQCEPX2vJI55MZ9CXf1oqRieq9AF6RSp6oSxLVPLoGNGpeQGhz56uQdm+lmVdb7CN6SpBuz1Qa5ucPo1Cy0YiuAyVP0rbYM7A460pFLfBJEOd2pC8h1a3EODvV/LRg0vp1nOTk3EdAhaU1cKLeKuXVJcdBjxsgJ6XL5d7rZvNDKXsHcMOBrVNKY1oHK31wEr+/LI9Zni572saPpkLSH1V8uKNw30eX5RckdF75/+nJkg3KkOrQI2aXleGruSwKcI97UFAoqOnTJTfLp8sdEV9eEpnYjy45BfSi89zdkZ0+EaZ02FRFz4BoodIVWdDEY1EAie3WNGodpiwpSrgP8e+wiC",
  "certificate_profile_name": "ENDUSER",
  "end_entity_profile_name": "EMPTY",
  "certificate_authority_name": "ManagementCA",
  "username": "JohnDoe",
  "password": "foo123",
  "include_chain": false,
  "email": "[email protected]",
  "response_format": "DER"
}

Produces this cert:

openssl x509 -in  ~/tmp/support/community/dirname-cert.pem -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            20:ab:ff:90:06:04:fd:77:ef:57:25:b2:a3:9f:3f:74
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Management CA, O = PK-DM, C = AE
        Validity
            Not Before: Apr 23 12:57:42 2025 GMT
            Not After : Mar 14 14:31:07 2026 GMT
        Subject: CN = Comapy Name, serialNumber = ABC12345678, OU = ADMINISTRATION, C = SE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Authority Key Identifier: 
                BB:68:9F:70:58:D6:2A:B4:B8:C1:38:66:FA:C3:CF:8F:C1:98:6A:DA
            X509v3 Subject Alternative Name: 
                DirName:/CN=FINALE USER/serialNumber=XYZ 87654321/OU=ADMINISTRATION/title=ADMINSTRATOR/C=SE

[fuentesea]

Good to hear that.
I'll test using REST API.
Thank you for your help.
Regards.
PS: can you fix the RA UI to avoid another user has this issue next time?

[primetomas]

I'll create an issue for it to be fixed in the future. Thanks!

[primetomas]

Internal tracking issue for RA UI fix: ECA-13370
Thanks for the report, it was a small issue and should be fixed in EJBCA 9.4.