May 2016 - Pki-devel - Dogtag Pki List Archives

[PATCH] 0105 Add pki-server ca-cert-db-upgrade command

by Fraser Tweedale

Hi all, The following patch adds a pki-server subcommand for updating certificate records to add the issuerName attribute. It is for #1667 (Database upgrade script to add issuerName attribute to all cert entries). Follow-up question: should I (and if so, how should I) also add an upgrade scriptlet to perform the upgrade for Dogtag CA subsystem on the host? Is there a precedent for invoking pki-server (or subroutines thereof) from pki-server-upgrade scriptlets? Cheers, Fraser

8 years, 6 months

3
7
0 / 0

[PATCH] 747 Fixed pki-server subsystem-cert-validate command.

by Endi Sukma Dewata

The system certificate validation command has been modified to check for both 'internal' and 'Internal Key Storage Token' since both are valid names for the internal token. Additional checks have been added to validate the certificate parameters in CS.cfg. The output of the command has been modified to be more consistent with other pki-server commands. The pki client-cert-validate invocation has been fixed to use -C option to specify the NSS database password file. https://fedorahosted.org/pki/ticket/2043 -- Endi S. Dewata

8 years, 6 months

1
0
0 / 0

0119-Ticket-2303-Key-recovery-fails-with-KRA-on-lunaSA.patch

by Christina Fu

One patch for JSS one patch for KRA These patches should address the KRA unwrap issues when the keys are on lunaSA. the KRA patch will required the JSS patch to function. It is also required for the lunaSA to be of the following model: CKE – Key Export Models Christina

8 years, 6 months

2
2
0 / 0

[PATCH] 0108 Lightweight CAs: add issuer DN and serial to AuthorityData

by Fraser Tweedale

Hi team, Attached patch implements https://fedorahosted.org/pki/ticket/1618 (Lightweight CAs: include Issuer DN and Serial in AuthorityData). If ACKed and we want to kick off builds of 10.3.0, please go ahead and merge it, otherwise I'll merge it on Monday morning. Cheers, Fraser

8 years, 6 months

2
1
0 / 0

[PATCH] 746 Added log messages for pre-op mode.

by Endi Sukma Dewata

To help troubleshooting the code has been modified to log more detailed information in pre-op mode. https://fedorahosted.org/pki/ticket/1654 -- Endi S. Dewata

8 years, 6 months

2
2
0 / 0

[PATCH] 740-742 Added token status UNFORMATTED.

by Endi Sukma Dewata

A new token status UNFORMATTED has been added for new tokens added via UI/CLI and for TERMINATED tokens that are to be reused. The token status READY has been renamed to FORMATTED for clarity. -- Endi S. Dewata

8 years, 6 months

2
2
0 / 0

[PATCH] 0103 Reject cert request if resultant subject DN is invalid

by Fraser Tweedale

The attached patch fixes https://fedorahosted.org/pki/ticket/2317. It will result in better error messages and help users to diagnose bad profile configurations (especially with IPA). Thanks, Fraser

8 years, 6 months

1
1
0 / 0

[PATCH] Added Chrome keygen warning

by Matthew Harmsen

While testing chrome, we discovered that (a) keygen would soon not be supported: * https://groups.google.com/a/chromium.org/forum/#!topic/security-dev/pX5Nb... (b) although keygen is still supported, it has been disabled by default with a workaround provided to re-enable it: * https://support.quovadisglobal.com/kb/a470/deprecation-of-keygen-tag-in-c... Please review the attached patch which supplies a warning message and instructions on how to re-enable keygen on Chrome browsers that support this: * PKI TRAC #2323 - Firefox Warning appears in EE page launched from within Chrome <https://fedorahosted.org/pki/ticket/2323> Additionally, an attempt was made to identify the case when KeyGen would not be available on Firefox and Chrome. -- Matt

8 years, 6 months

2
2
0 / 0

[pki-devel][PATCH] 0066-TPS-auth-special-characters-fix.patch

by John Magne

TPS auth special characters fix. Ticket #1636. Smartcard token enroll/format fails when the ldap user has special characters in userid or password Tested with both esc and tpsclient. The problem was when using a real card because the client uri encodes the authentication creds and the server needs to decode them.

8 years, 6 months

2
2
0 / 0

[pki-devel][PATCH]0061-Enhance-tkstool-for-capabilities-and-security.patch

by John Magne

Enhance tkstool for capabilities and security This simple ticket is to fix tkstool to allow it to create the master key with the proper flags to make the key data private such that it can't be easily viewed when using tools to print out sym keys on the token. Fix tested on the "internal" token by trying the various tkstool cmds to make sure having the key private does not cause issues. Also tried a simple key changeover operation with tpsclient to make sure that symkey can still do what it needs to do witht the master key. Further testing with a full hsm will be required. The goal was the create the key with the same flags that are used with the previous "PK11_GenKeyOnToken" (name approx) is used. This version had no flags and created a default set. This fix uses the version With flags and does what the old one did, but made sure the key is private and sensitive. Master key can be tested by using the tool: /usr/lib64/nss/unsupported-tools/symkeyutil -d ./ -L

8 years, 6 months

2
2
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Pki-devel May 2016