Cause

If you receive the error that a user cannot have the same Subject DN as another user, when you are issuing certificates, this is caused by the Enforce unique DN check.

By default, different end entities cannot have the same subject DN issued from one CA. The check enforces Subject DN uniqueness and is performed when new certificates are issued.

This may be inconvenient in some cases as one user can appear as multiple end entities.

Solution

To disable the enforcement of subject DN uniqueness, do the following:

1. In the CA GUI, click Certification Authorities under CA Functions.

2. Click Edit CA and in the CA configuration, and clear the option Enforce unique DN.

For more information on the Enforce unique DN option, see CA Fields.

Problem

When adding a new user, an exception with an SQL error like the following is thrown: "Value too large for column USERDATA.SUBJECTALTNAME" or "Value too large for column USERDATA.SUBJECTDN".

Cause

This can happen if you have specified one or more fields of the Subject Alternative Name with a total length exceeding 2000 characters (400 characters for subject DN).

Solution

Extend the size of the column SUBJECTALTNAME and SUBJECTDN of the table USERDATA and SUBJECTDN of CERTIFICATEDATA.

The following displays an example for extending the subjectDN and altName columns in MySQL (version > 5.0.3):

The new column sizes can cause issues when applying indexes in some database versions, giving errors like for example: "Specified key was too long; max key length is 767 bytes"

To circumvent this issue, create the index over a subset of the column by running the following:

For more information on Subject Alternative Names and Subject DN Fields, see End Entity Profiles Fields.

Problem

When issuing a new certificate, I get the exception/error: Got request with status GENERATED (40), NEW, FAILED or INPROCESS required: foo; nested exception is: javax.ejb.EJBException:null

Cause

When using the AuthenticationSession (default) all users have a STATUS. The status lifecycle begins with NEW and ends with REVOKED. Only when the status is NEW, FAILED or INPROCESS is it possible to issue a certificate to a user. After a certificate has been issued, the status is set to GENERATED. This works like a one-time-password scheme.

Solution

To issue a new certificate to the user, his/her status must be reset to NEW, FAILED, or INPROCESS.

To reset the status, run the following:

To view a list of all status codes, run:

For more information, see Create User Certificates and Roles and Access Rules Operations.