From 2f6ffa326adb4d4e9152463ffa733d559f7be2af Mon Sep 17 00:00:00 2001
From: Oleg Fayans <ofayans@redhat.com>
Date: Wed, 7 Sep 2016 09:52:33 +0200
Subject: tests: Added basic constraints extension to the CA certs

The IPA installer refuses to accept certs signed with a CA-signature that does
not have basic constraints enabled (Described in RFC 5280)

Reviewed-By: David Kupka <dkupka@redhat.com>
---
 ipatests/test_integration/scripts/caless-create-pki | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'ipatests/test_integration/scripts')

diff --git a/ipatests/test_integration/scripts/caless-create-pki b/ipatests/test_integration/scripts/caless-create-pki
index f428ebae1..8eefadf69 100644
--- a/ipatests/test_integration/scripts/caless-create-pki
+++ b/ipatests/test_integration/scripts/caless-create-pki
@@ -38,7 +38,10 @@ gen_cert() {
 
     csr="$(mktemp)"
     crt="$(mktemp)"
-    certutil -R -d "$dbdir" -s "$subject" -f "$pwfile" -z "$noise" -o "$csr" -4 >/dev/null <<EOF
+    certutil -R -d "$dbdir" -s "$subject" -f "$pwfile" -z "$noise" -o "$csr" -4 -2 >/dev/null <<EOF
+y
+0
+N
 1
 7
 file://$crl_path/$ca.crl
-- 
cgit