Max SANs ?
-
You are just adding them in the cert manager?
Does it accept them if you use fewer SANs?
What pfSense version are you running?
Steve
-
I'm running 2.7.2-RELEASE (amd64).
And yes, I'm using the cert manager.
I played around with this some more. The largest number of SANs that I can get it to take so far is 6.
Once I go over 6, it goes into a confused state and won't allow me to create the cert until I go down to 3 SANs.
-
Hmm, interesting. Is that with any type of SAN? Only combinations?
Let me try to replicate....
-
I can't replicate that, I can create a cert with any number of SANs. I stopped at 18:
Do you have the recommended patches applied from the System Patches package? I'm not aware of anything that would apply to this though.
Is your example list above something you are actually hitting this with?
-
@the-loquitur said in Max SANs ?:
values must be valid hostnames
mdf-lan-fir-p-1
wouldn't be a valid fqdn
-
But it's a valid hostname.
-
I was able to save this no problem:
-
Hi. I believe that I've found the use-case where it fails.
When I create a test CA where I don't bother to fill out the:
Country Code
State
City
Organization
Organization Unitand only fill in the Descriptive Name and Common Name. Then it pukes.
I ended up creating 2 CAs: one with the RDNs and the other without. When I try to create a cert using the no-RDN CA, it fails. When I try to create a cert using the CA with RDNs, it works.
Initially, I was working with FreeRadius for the first time and created a CA for just to use for proof of concept, filling out the very least fields. Then I ran into this.
For me, this is deterministic.
BTW, the GUI form for creating a CA actually says that the RDN fields are optional.
-
Are you entering those values on the server cert if they are not auto filled by the CA?
-
O. I don’t fill them out when creating the CA and then correspondingly, I don’t fill them out when creating a cert using the CA.
At this point, I’m all done with reporting this.
Thanks
-
Hmm, still unable to replicate it here without any optional fields on the CA or cert:
Do you have all the recommended patches applied?
