October 2014 - Pki-devel - Dogtag PKI List Archives

[PATCH] 0010..0013 DNP3/IECUserRoles extension support
by Fraser Tweedale 23 Jun '15

23 Jun '15

Here is the first (rough) cut of IEC 62351-8 (IECUserRoles) extension support and a DNP3 profile that makes use of it. This is to meet (some of) the PKI needs for the "Smart Grid" DNP3 Secure Authentication v5 (SAv5) standard. In brief, the SN and all the IECUserRoles params will be given in profile inputs, and the key is taken from a CertReqInput. There's still a bit of work to go - notably, some of the IECUserRoles fields are unimplemented, and some of those that *are* implemented are not yet read out of the profile input but rather are hardcoded. The extension *does* appear on the certificate, so I should get that all completed tomorrow. Cheers, Fraser

2 6

CLI for editing profiles
by Fraser Tweedale 14 Apr '15

14 Apr '15

Along with LDAP profiles, we will be adding modules to the CLI for adding and editing profiles in the ConfigStore format that was used for file-based profiles. For more info, see: http://pki.fedoraproject.org/wiki/LDAP_Profile_Storage#Command-line_utiliti… There is an existing CLI for adding and modifying profiles, in the XML format, e.g. ``pki ca profile add caCustomProfile.xml``. The XML format carries information including the profile ID and class_id, but these data must be supplied out-of-band when dealing with the ConfigStore format. Because of this, I intend to: - add new commands to the existing profile CLI for working with the "raw" (i.e., ConfigStore) format, e.g. "edit-raw", "add-raw". Where necessary, these commands will take compulsory ``--profile-id`` and/or ``--class-id`` arguments, to account for the absense of such information in the profile ConfigStore format; and - transport this information in the XML format - not in the "raw" format - so that it will be unnecessary to make changes to ProfileClient or the ProfileService API. As usual, I welcome feedback - especially if you feel I am going the wrong way ^_^

3 26

[PATCH] pki-ftweedal-0015-Monitor-database-for-changes-to-LDAP-profiles.patch
by Fraser Tweedale 13 Apr '15

13 Apr '15

This is the first cut of the LDAP profile change monitoring. It depends on patches 0004..0009 and 0014 (https://www.redhat.com/archives/pki-devel/2014-September/msg00052.html) To summarise the implementation: a separate thread carries out a persistent LDAP search and calls back into the ProfileSubsystem when changes occur. I haven't had much experience with persistent searches or multithreaded programming in Java, so eyeballs familiar with those areas are needed. I haven't yet tested with changes replicating between clones (a task for tomorrow) but I wanted to get the patch on list for feedback as early as possible. Cheers, Fraser

2 9

[PATCH] 531 Moved web application deployment locations.
by Endi Sukma Dewata 28 Jan '15

28 Jan '15

Currently web applications are deployed into Host's appBase (i.e. <instance>/webapps). To allow better control of individual subsystem deployments, the web applications have to be moved out of the appBase so that the autoDeploy can work properly later. This patch moves the common web applications to <instance>/ common/webapps and subsystem web applications to <instance>/ <subsystem>/webapps. An upgrade script has been added to update existing deployments. https://fedorahosted.org/pki/ticket/1183 -- Endi S. Dewata

2 6

[PATCH] 0017 Enable Authority Key Identifier CRL extension
by Fraser Tweedale 10 Jan '15

10 Jan '15

This patch enables the Authority Key Identifier CRL Extension, which is REQUIRED by RFC 5280, by default. Should existing instances be left alone or should I also look at an upgrade script that offers to upgrade CS.cfg to be conformant? Fraser

3 12

[PATCH] 0016 - Fix BasicConstraints min/max path length check
by Fraser Tweedale 05 Dec '14

05 Dec '14

This patch fixes https://fedorahosted.org/pki/ticket/1035

2 10

lightweight sub-CAs; updated design
by Fraser Tweedale 31 Oct '14

31 Oct '14

Hi all, Just landed a big update to the lightweight sub-CAs design proposal: http://pki.fedoraproject.org/wiki/Lightweight_sub-CAs. I plan to start the implementing next week. Aside from general design review, specific things I need input on are: 1) How to propagate newly-generated sub-CA private keys to clones in an automated way, and how to store them. 2) REST API; whether to have a separate resource for sub-CAs, e.g. ``/ca/ee/ca/subca1/...``, or whether to use explicit parameters to indicate a sub-CAs. 2a) Similarly, for OCSP - whether to use a single OCSP responder for all the CAs in an instance or whether to have separate responders for different [sub-]CAs. 3) The other main change in the design (I'm open to reconsidering but the more I thought about it, the more it made sense) is that there will be one CertificateAuthority object for the sub-CA (as well as the primary CA), and likewise one CertificateRepository object for each CA. The certificate repositories will be hierarchical OUs in LDAP so that it will be straightforward to search all certificates, or just those that were issued by a particular [sub-]CA. Details are in the document. Look forward to your feedback, Fraser

6 21

[PATCH] 0018 Fix ECC curve name typos
by Fraser Tweedale 31 Oct '14

31 Oct '14

2 2

[PATCH] 534 Fixed incorrect Python API docs format.
by Endi Sukma Dewata 28 Oct '14

28 Oct '14

The Python API docs in some classes/methods have been fixed to remove the errors and warnings generated by python-sphinx. https://fedorahosted.org/pki/ticket/1157 -- Endi S. Dewata

1 0

[PATCH] pki-core-issuerDN-encoding.patch
by Christina Fu 27 Oct '14

27 Oct '14

Attached please find the fix for the following ticket: https://fedorahosted.org/pki/ticket/1190 CA: issuer DN encoding not preserved at issuance with signing cert signed by an external CA thanks in advance for a review. Christina

2 4