Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 169 / 554

Customizing the Subject DN in the CSR
147
7. When you have finished configuring the new RA, restart the instance using the command above.
Note
If any errors occurred and you need to recreate the RA2 instance, you can remove the
existing RA2 instance using the
pkiremove
command, as follows:
# pkiremove -pki_instance_root=/var/lib -pki_instance_name=rhpki-ra2
You can then run the
pkicreate
procedure again.
5.3.2. Customizing the Subject DN in the CSR
This section describes how to customize the Subject Distinguished Name (DN) in the Certificate
Signing Request (CSR).
By default, the DN is taken from the input provided by the user on the User Enrollment page,
specifically, "UID" and "Your Email." For example, "UID=yourUID, E=youremail@example.com". You
can customize the DN by editing the
user.vm
file for the RA. This procedure is covered below.
Note
There is no graphical interface for performing this customization.
Procedure 5.4. Customizing the DN
1. Edit the
<instance_root> /docroot/ee/user/user.vm
file. This is typically
/var/lib/
rhpki-ra/docroot/ee/user/user.vm
2. Locate the "validate" function and formulate your preferred DN in the
var dn=
statement.
The default value is
var dn = "uid="+x+".e="+e;
where "x" is the UID and "e" is the email
from the user input.
3. When you have finished specifying the new Subject DN, save and close the file.
5.3.2.1. Updating the CSR Form
Currently, the request form only requests UID, Site ID, and Email information. If the site requires more
information than the form provides for, then you need to modify the enrollment form to allow additional
input. The enrollment form is included at the end of the
user.vm
file. For example:
<tr>
<td>District:</td>
<td><input type=text name=district value=""></td>
</tr>
After you have made the appropriate changes to the enrollment form, you need to use the previous
procedure to customize the Subject DN to utilize the information collected from the user.