September 2011 - Pki-devel - Dogtag PKI List Archives

Patch for Review: Script to proxy-ize a dogtag instance
by Ade Lee 30 Sep '11

30 Sep '11

https://bugzilla.redhat.com/show_bug.cgi?id=737192 - Need script to upgrade proxy configuration Please review attached patch. Thanks, Ade

2 1

patches for review - Bugzilla Bug #737761 - Update Dogtag Packages for Fedora 16
by Matthew Harmsen 29 Sep '11

29 Sep '11

* *Bugzilla Bug #737761* <https://bugzilla.redhat.com/show_bug.cgi?id=737761> - Update Dogtag Packages for Fedora 16 Please review the attached patches: * https://bugzilla.redhat.com/attachment.cgi?id=525249&action=diff&context=pa… * https://bugzilla.redhat.com/attachment.cgi?id=525250&action=diff&context=pa… * https://bugzilla.redhat.com/attachment.cgi?id=525251&action=diff&context=pa… * https://bugzilla.redhat.com/attachment.cgi?id=525252&action=diff&context=pa… * https://bugzilla.redhat.com/attachment.cgi?id=525253&action=diff&context=pa… * https://bugzilla.redhat.com/attachment.cgi?id=525254&action=diff&context=pa… Thanks, -- Matt

2 1

[Fwd: [Freeipa-devel] script to proxy-ize a dogtag instance]
by Ade Lee 28 Sep '11

28 Sep '11

Cross posting to pki-devel.

2 1

patch for review - https://bugzilla.redhat.com/show_bug.cgi?id=739708
by Ade Lee 27 Sep '11

27 Sep '11

https://bugzilla.redhat.com/show_bug.cgi?id=739708 - pki-selinux lacks rules in F16 This patch adds two of the three rules. The remaining one: allow pki_ca_t unreserved_port_t:tcp_socket name_connect; is still under investigation. I have no idea why tomcat would be trying to connect to an ephemeral port (and I have not been able to reproduce on my system). As far as I can tell, this happens on startup on Alexander's system -- but it does not affect the startup of the server. I'll keep looking for it. Please review. Ade

2 1

patch for review - Bugzilla Bug #739201 - pkisilent does not take arch into account as Java packages migrated to arch-dependent directories
by Matthew Harmsen 23 Sep '11

23 Sep '11

* *Bugzilla Bug #739201* <https://bugzilla.redhat.com/show_bug.cgi?id=739201> - pkisilent does not take arch into account as Java packages migrated to arch-dependent directories Please review the attached patch: * https://bugzilla.redhat.com/attachment.cgi?id=524528&action=diff&context=pa… Thanks, -- Matt

2 1

Generating CSR in the Browser
by Adam Young 19 Sep '11

19 Sep '11

How are people using the Certificates that they generate from the Browser? Say I use the code at /ca/ee/ca/profileSelect?profileId=caUserCert To generate a new Cert Signing Request, the key pair for that CSR is in my browsers NSS Database, but in order to even get to this point, I need to have a Certificate allowing me to talk to the server, so I am guessing I can't do this from the end users browser. I'm guessing the workflow goes something like this: 1. A new member of an organization needs a certificate, so they go to their supervisor 2. Supervisor fills out the form above and submites the CSR. 3. Someone in higher echelons approves the request and generates the corresponding certificate 4. The Supervisor then gets the certificate to the end user. How does the private key get to the end users browser? Does it go by way of the CRM subsystem, and, if so, isn't there a chicken/egg problem in getting it?

2 3

Upgrading a machine to use the proxy.
by Adam Young 16 Sep '11

16 Sep '11

To convert an older build where the PKI system wasn't proxied: awk '{print $0} /Define an AJP 1.3 Connector on port/ {print "<Connector port=\"9447\" protocol=\"AJP/1.3\" redirectPort=\"9444\" />}" }' /etc/pki-ca/server.xml > server.xml.new ; mv server.xml.new /etc/pki-ca/server.xml sed -e "s/\[PKI_MACHINE_NAME\]/$HOSTNAME/g" -e "s/\[PKI_AJP_PORT\]/9444/g" /usr/share/pki/ca/conf/proxy.conf > /etc/pki-ca/proxy.conf I've used the default ports here. Adjest is you've altered yours. IPA copies the proxy.conf file into /etc/httpd/conf.d and renames it. You can do the same thing by hand. I'm not sure if this should go into PKI or IPA.

4 6

Talking to PKI-CA via Curl
by Adam Young 16 Sep '11

16 Sep '11

Some of you may be interested: http://adam.younglogic.com/2011/09/talking-to-dogtag-pki-via-curl/ Here's the short of it: once you have an NSS database set up, you can do something like: curl --cacert ./CA.crt \ --cert "CA Administrator of Instance pki-ca2's AyoungBostonDevelRedhat Domain ID" \ https://servername:8443/ca/agent/ca/displayBySerial?serialNumber=0x6 \ --pass freeipa4all

2 6

The Why's of PKI
by Adam Young 14 Sep '11

14 Sep '11

The Layout of the PKI project is very unusual for a Java Server application. I'm trying to understand the rationale for some of the things that were done. Why do we create a separate server instance for each subsystem? Is a reason to continue doing so? Is using different ports for CA and DRM (an so forth) merely an artifact of using multiple servers, or is there an additional reason to do so? Do we expect the same user to have and user different certificates for different servers, such that the certificate then becomes a union of authentication and authorization? Is there a reason to separate the CA and DRM Directory servers? Is it a "best practice" to do so? What would be the implications of using a single instance for both? Is there any reason why the CA uses an LDAP server instead of a Relational Database? Do we expect people to make queries dircetyl against the CA DirSrv, or is the Database best hidden from public view? Why do we split the build process up into multiple Source RPMS? Is there a reason to maintain this split? Are there design documents or discussions for these decisions?

4 19

edit error
by Brian G Broussard 14 Sep '11

14 Sep '11

hello the page below I edited to fix what looks like a copy and past error and I messed up the format. Do not seem to be able to fix it. [http://pki.fedoraproject.org/wiki/PKI_Install_Guide] http://pki.fedoraproject.org/wiki/PKI_Install_Guide under DRM section thanks Brian G Broussard Chief Technical Engineer Manchac Technologies, LLC 1501-A Wimbledon Drive Alexandria, LA 71301 Office: (318) 442-3686 Ext 221 Cell: (337) 739-6437 Fax: (318) 445-1268 [mailto:brian.broussard@manchac.com] brian.broussard(a)manchac.com [http://www.dosis.com/] www.dosis.com [http://www.manchac.com/] www.manchac.com

2 1