Dogtag's http interface
by Melton, Lawrence
Since CMS 6.0 through CS 7.1, we've been using a Java application (instead
of a web browser) to access the CA's http interface, such as this:
//* This is the relative URL for submitting cert requests to the CA
public static final String caProfileSubmit = "/ca/profileSubmit";
//* This is the relative URL for accessing the end entity web page at
the CA
public static final String caEndEntity = "/ca/index.html";
//* This is the relative URL for accessing the agent web page at the CA
public static final String caAgent = "/ca/index.html";
//* This is a relative URL for POSTing a request for certificate
requests; only an agent should be able to get to this page
public static final String caAgentAccess = "/ca/queryReq";
//* This is the relative URL for accessing the agent web page at the DRM
for searching for archived keys
public static final String drmSearchForKey = "/kra/srchKeyForRecovery";
//* This is the relative URL for accessing the agent web page at the DRM
for diplaying archived keys by certificate serial number
public static final String drmDisplayBySerialNumber =
"/kra/displayBySerialForRecovery";
//* This is the relative URL for accessing the agent web page at the DRM
for requesting recovery of archived private keys by certificate serial
number
public static final String drmRecoverBySerialNumber =
"/kra/recoverBySerial";
//* This is the relative URL for accessing the agent web page at the DRM
for granting key recovery requests
public static final String drmGrantRecovery = "/kra/grantRecovery";
//* This is the relative URL for retrieving a key in a PKCS#12 message
from the DRM
public static final String drmGetPKCS12Message = "/kra/getPk12";
//* This is the relative URL for accessing the agent web page at the DRM
public static final String drmAgent = "/kra/index.html";
//* This is the relative URL for retrieving the DRM's transport
certificate
public static final String drmDisplayTransportCert =
"/kra/displayTransportCert";
Now with CS 7.3 and Dogtag, the interface is different. I think the end
entity page is found at "/ca/ee/ca/index.html" and the agent page is found
at "/ca/agent/ca/index.html". I'm still trying to figure out the rest.
Is there an http interface document for Dogtag? Is there an intuitive
formula or a web.xml document that shows the new interface?
Thanks,
Larry
15 years, 3 months
- 2
- 2
NSS rpm
by Stutzman, David K CTR USA AMC
I have several dogtag installations and a couple are EC enabled according to the directions at http://pki.fedoraproject.org/wiki?title=ECC_Enabling_Dogtag.
Part of that is building a special NSS: http://pki.fedoraproject.org/wiki/ECC_Capable_NSS.
I followed all this and I have the 2 CAs up and running. There a couple outstanding bugs I have that, when fixed, I'll be needing to update the Dogtag RPMs. The problem is, doing so will overwrite my custom NSS with the nss required as a dep of the rest of the RPMs. For now I have added an ignore to the yum configuration on the 2 CAs in question, but when I need to update the rest of the RPMs I'll have the problem. I'd like to not have to rebuild, by hand, NSS each time I update the CA which requres an NSS update. I also don't necessarily want to keep using the same old NSS and ignore fixes in newer versions that may or may not be required by newer Dogtag components.
So, I'm asking if it would be possible to make the NSS that is required by Dogtag one that is built according to the ECC directions, or have 2 different packages that could satisfy the NSS dependency. Dogtag out of the box has EC referenced all through the GUI, config files, etc and it's quite misleading to the user. I spoke with Rob C (rcrit) in the dogtag IRC channel and he suggested I bring this up on this mailing list for discussion.
I've spoken with some people in the past questioning the need for the special treatment of ECC in NSS as NSS has an EC implementation already. The directions above effectively strip that implementation out and require a 3rd party PKCS#11 module that implements the ECC algorithms. I'm only interested in the 3 "Suite B" curves implemented in the basic EC side of things in NSS. Rob suggested it might be because you don't want to change the softtoken because of FIPS but he was guessing.
Thanks,
Dave
15 years, 9 months
- 2
- 1
- ← Newer
- 1
- Older →