May 2009 - Pki-devel - Dogtag PKI List Archives

Dogtag's http interface
by Melton, Lawrence 14 Sep '09

14 Sep '09

Since CMS 6.0 through CS 7.1, we've been using a Java application (instead of a web browser) to access the CA's http interface, such as this: //* This is the relative URL for submitting cert requests to the CA public static final String caProfileSubmit = "/ca/profileSubmit"; //* This is the relative URL for accessing the end entity web page at the CA public static final String caEndEntity = "/ca/index.html"; //* This is the relative URL for accessing the agent web page at the CA public static final String caAgent = "/ca/index.html"; //* This is a relative URL for POSTing a request for certificate requests; only an agent should be able to get to this page public static final String caAgentAccess = "/ca/queryReq"; //* This is the relative URL for accessing the agent web page at the DRM for searching for archived keys public static final String drmSearchForKey = "/kra/srchKeyForRecovery"; //* This is the relative URL for accessing the agent web page at the DRM for diplaying archived keys by certificate serial number public static final String drmDisplayBySerialNumber = "/kra/displayBySerialForRecovery"; //* This is the relative URL for accessing the agent web page at the DRM for requesting recovery of archived private keys by certificate serial number public static final String drmRecoverBySerialNumber = "/kra/recoverBySerial"; //* This is the relative URL for accessing the agent web page at the DRM for granting key recovery requests public static final String drmGrantRecovery = "/kra/grantRecovery"; //* This is the relative URL for retrieving a key in a PKCS#12 message from the DRM public static final String drmGetPKCS12Message = "/kra/getPk12"; //* This is the relative URL for accessing the agent web page at the DRM public static final String drmAgent = "/kra/index.html"; //* This is the relative URL for retrieving the DRM's transport certificate public static final String drmDisplayTransportCert = "/kra/displayTransportCert"; Now with CS 7.3 and Dogtag, the interface is different. I think the end entity page is found at "/ca/ee/ca/index.html" and the agent page is found at "/ca/agent/ca/index.html". I'm still trying to figure out the rest. Is there an http interface document for Dogtag? Is there an intuitive formula or a web.xml document that shows the new interface? Thanks, Larry

2 2

(no subject)
by Stutzman, David K CTR USA AMC 21 May '09

21 May '09

Sorry for the seemingly rhetorical question... Does the ESC support generation of keys and issuance of certificates onto anything other than the supported "Global Platform" hardware tokens (ie software tokens such as NSS's internal cert DB, PKCS#12 files, Java KeyStores, etc)? The way I understand it, the ESC *only* supports a few types of HW tokens, but I've been asked to get an official yes or no. Thanks, Dave -- David Stutzman Fort Monmouth - Myer Center IA - Tactical Network Protection david.konrad.stutzman @us.army.mil D&S Consultants, Inc. dstutzman @dsci.com Lab: 732-532-8959

3 2

help with certificate creation
by Rico Hightower 15 May '09

15 May '09

Hello, I am fairly new to the PKI concept but I do have some knowledge on the concept. As part of a college project I am working on, the first task was to get Dogtag CA up and running and that was successfully done. However, now I would like to get into the "nuts and bolts" of a certificate. I have the source code, but I am not able to locate the class(es) that are responsible for the actual construction of a X.509 certificate. If someone is familiar with this, I would greatly appreciate the help.

2 1