patch for IPA to allow certificates to have the name of a service (instead of just hostname)

cert.py.diff

Index: /usr/lib/python2.6/site-packages/ipalib/plugins/cert.py
===================================================================
--- /usr/lib/python2.6/site-packages/ipalib/plugins/cert.py
+++ /usr/lib/python2.6/site-packages/ipalib/plugins/cert.py
@@ -297,11 +297,11 @@
         # Ensure that the hostname in the CSR matches the principal
         subject_host = get_csr_hostname(csr)
         (servicename, hostname, realm) = split_principal(principal)
-        if subject_host.lower() != hostname.lower():
+        if subject_host.lower() != hostname.lower() and subject_host.lower() != servicename.lower():
             raise errors.ACIError(
-                info=_("hostname in subject of request '%(subject_host)s' "
-                    "does not match principal hostname '%(hostname)s'") % dict(
-                        subject_host=subject_host, hostname=hostname))
+                info=_("CN in subject of request '%(subject_host)s' "
+                    "does not match principal service '%(servicename)s' or principal hostname '%(hostname)s'") % dict(
+                        subject_host=subject_host, servicename=servicename, hostname=hostname, ))

         dn = None
         service = None