November 2015 - Pki-devel - Dogtag PKI List Archives

[PATCH] 0051 Lightweight CAs: lookup correct issuer for OCSP responses
by Fraser Tweedale 03 Mar '16

03 Mar '16

Hi all, The attached patch makes sure that the right authority is used to create OCSP responses. Note that OCSP requests may ask about certs from more than one issuer - even though this is crazy the heuristic used is to simply use issuer of the first CertID in the request. Note that OCSP response validation of certificates issued by sub-CAs currently fails due to a separate issue[1]. [1] https://fedorahosted.org/pki/ticket/1632

2 5

[PATCH] 0054 Lightweight CAs: add audit events
by Fraser Tweedale 02 Mar '16

02 Mar '16

The attached patch adds audit events for lightweight CA administration, fixing https://fedorahosted.org/pki/ticket/1590. Cheers, Fraser

2 3

[PATCH] 0052 Lightweight CAs: enrol cert via profile subsystem
by Fraser Tweedale 22 Feb '16

22 Feb '16

The attached patch fixes: - #1624 generate lightweight CAs via profile subsystem - #1632 ensure CA certs bear correct Authority Key Identifier Thanks, Fraser

2 2

[PATCH] 0050 Lightweight CAs: ensure disabled CA cannot create sub-CA
by Fraser Tweedale 22 Feb '16

22 Feb '16

The attached patch (which replaces an earlier patch 0050) fixes https://fedorahosted.org/pki/ticket/1628. Cheers, Fraser

2 3

[PATCH] 0055 Allow encoded slashes in HTTP paths
by Fraser Tweedale 21 Jan '16

21 Jan '16

The attached patch fixes GET-based OCSP requests, https://fedorahosted.org/pki/ticket/1658 Cheers, Fraser

2 4

[PATCH 0042] Fix escaping of password fields to prevent interpolation
by Christian Heimes 07 Jan '16

07 Jan '16

Some password and pin fields are missing from the no_interpolation list. One entry is misspelled. A '%' in password field such as pki_clone_pkcs12_password causes an installation error. https://fedorahosted.org/pki/ticket/1703 https://bugzilla.redhat.com/show_bug.cgi?id=1283631

2 3

[PATCH] 0056 Avoid superfluous ConfigStore commit during profile creation
by Fraser Tweedale 25 Nov '15

25 Nov '15

The attached patch is a drive-by improvement during analysis of https://fedorahosted.org/pki/ticket/1700. Thanks, Fraser

2 2

[PATCH] 660 Updated pki-cert and pki-server-subsystem man pages.
by Endi Sukma Dewata 25 Nov '15

25 Nov '15

The pki-cert and pki-server-subsystem man pages have been updated to include recent changes. https://fedorahosted.org/pki/ticket/456 -- Endi S. Dewata

1 1

[PATCH 0043] sslget must set Host HTTP header
by Christian Heimes 25 Nov '15

25 Nov '15

The sslget tool sends a TLS SNI header. Apache doesn't like server name indication without a matching HTTP header. Requests without a Host header are refused with HTTP/1.1 400 Bad Request Hostname example.org provided via SNI, but no hostname provided in HTTP request sslget now sets a Host HTTP header for all requests. https://fedorahosted.org/pki/ticket/1704

1 1

[PATCH] 657 Refactored CA certificate generation.
by Endi Sukma Dewata 25 Nov '15

25 Nov '15

The CA certificate request and signing processes have been moved from the configuration servlet into the deployment scriptlet. This way the admin will have the option to: * generate self-signed CA certificate * import externally-signed CA certificate * import existing CA certificate before the server is started for the first time. https://fedorahosted.org/pki/ticket/456 Note: This is a preliminary patch. There are some unfinished works. -- Endi S. Dewata

3 8