May 2020 - Pki-devel - Dogtag PKI List Archives

ACME Support: Error issuing certificate
by Jesse L Van hill 29 Jun '20

29 Jun '20

Hi - My team is adding ACME 2.0 client support to the Open Liberty application server and wanted to test against Dogtag PKI's ACME server. My intention is to containerize the ACME server and drive it through the same functional tests we run against other ACME CA servers (i.e. - Pebble and Boulder for instance) to verify compatibility. The first error I hit was an issue with using JSS 4.7 and I understand that will be fixed by PR https://github.com/dogtagpki/jss/pull/532 . 2020-05-04 22:15:53 [http-nio-8080-exec-5] SEVERE: Unable to validate HTTP-01 challenge: Unable to get SunJSSE provider for TLS: SSLContextImpl is not initialized java.lang.RuntimeException: Unable to get SunJSSE provider for TLS: SSLContextImpl is not initialized at org.mozilla.jss.provider.javax.net.JSSContextSpi.engineGetSocketFactory (JSSContextSpi.java:118) at javax.net.ssl.SSLContext.getSocketFactory (SSLContext.java:294) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.<init> (SSLConnectionSocketFactory.java:292) at org.apache.http.impl.client.HttpClientBuilder.build (HttpClientBuilder.java:978) at org.apache.http.impl.client.HttpClients.createDefault (HttpClients.java:56) at org.dogtagpki.acme.validator.HTTP01Validator.getResponse (HTTP01Validator.java:112) at org.dogtagpki.acme.validator.HTTP01Validator.validateChallenge (HTTP01Validator.java:63) at org.dogtagpki.acme.server.ACMEChallengeService.handlePOST (ACMEChallengeService.java:99) ... To move past this error, I was advised to move down to JSS 4.6.2. Upon doing so, I made it past the initial error but now hit the following error: 2020-05-05 18:36:08 [http-nio-8080-exec-7] SEVERE: Servlet.service() for servlet [Resteasy] in context with path [/acme] threw exception org.jboss.resteasy.spi.UnhandledException: org.apache.commons.lang.NotImplementedException: Code is not implemented at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException (ExceptionHandler.java:78) at org.jboss.resteasy.core.ExceptionHandler.handleException (ExceptionHandler.java:222) ... Caused by: org.apache.commons.lang.NotImplementedException: Code is not implemented at org.dogtagpki.acme.issuer.ACMEIssuer.generateCertificate (ACMEIssuer.java:61) at org.dogtagpki.acme.issuer.ACMEIssuer.issueCertificate (ACMEIssuer.java:73) at org.dogtagpki.acme.server.ACMEFinalizeOrderService.handlePOST (ACMEFinalizeOrderService.java:79) ... I can see in the ACME server's trace that it does indeed authorize my ownership of the domain and then try to issue the certificate. Examining the AcmeIssuer class shows that this class has several methods that are not implemented. https://github.com/dogtagpki/pki/blob/master/base/acme/src/main/java/org/do… Is this expected or is it possible I have a misconfiguration? I assume I am testing too early and need to wait until the implementation is further along, but I wanted to test early enough that if there were issues I could detect them earlier rather than later. If it matters, I am testing the with the image from @pki/master on a Fedora 30 docker container. Jesse Van Hill Websphere Identity Management Architect & Dev Lead WebSphere Application Server & Open Liberty https://openliberty.io/ 507-513-6234 jlvanhil(a)us.ibm.com

3 5

Re: [Pki-devel] Configuration of Friendly Name and Country
by Dinesh Prasanth Moluguwan Krishnamoorthy 02 Jun '20

02 Jun '20

Nadeera, (CC'ing pki-devel) Setting the number of intermediate CAs can be achieved by using "Basic Constraints Extension" [1] and setting the PathLen= to the required value. You need to set this extension on a CA profile and then issue a CA signing cert. You can't modify this value on an already issued CA cert. Read more on how to add this constraint to a profile here [2] [1] https://access.redhat.com/documentation/en-us/red_hat_certificate_system/9/… [2] https://access.redhat.com/documentation/en-us/red_hat_certificate_system/9/… Regards, --Dinesh On Fri, May 22, 2020 at 8:57 AM Nadeera Galagedara < nadeeragalagedara(a)yahoo.com> wrote: > Dear Dinesh, > > I want another help from you. How can I change the "Maximum number of > intermediate CAs: unlimited" value. > On Friday, May 22, 2020, 10:57:45 AM GMT+5:30, Nadeera Galagedara < > nadeeragalagedara(a)yahoo.com> wrote: > > > Dear Dinesh, > > That is a great explanation. That problem that problem is also solved. > Again thank you. > > On Wednesday, May 20, 2020, 08:27:56 PM GMT+5:30, Dinesh Prasanth > Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com> wrote: > > > Hi Nadeera, > > I'm glad I could resolve your issues. > > As for the friendly/nickname, these names are customizable based on the > system you use and are not specified during the certificate issuance. > > For instance, when you specified " > *pki_ca_signing_nickname=mycompany_nickname"* this nickname was used to > import the CA system certificate in your PKI server's NSSDB. You can view > this by doing `certutil -L -d /etc/pki/pki-tomcat/alias` and you should see > the *mycompany_nickname* listed. > > I have very limited knowledge of handling certificates in windows. From > Googling around: you can try to *right-click on the certificate -> > Properties -> "general" tab -> Set "Friendly Name"*. > > HTH > > Regards, > --Dinesh > > On Wed, May 20, 2020 at 3:28 AM Nadeera Galagedara < > nadeeragalagedara(a)yahoo.com> wrote: > > Dear Dinesh, > > Thank you for your support and it is been very helpful. I am using Centos > 7 and the version came with it is 10.5. I am using that version. I think I > have corrected the country (with c=LK). But I still have a problem with the > nickname. > > I used the *pki_ca_signing_nickname=mycompany_nickname* line but still > the friendly name show on windows PC (I have imported the issued > certificate to a windows PC) format like <Common Name>'s <Organisation> ID. > My requirement is to show the the Friendly Name (shows as in Windows PC) as > "*mycompany_nickname* " I have attached a screenshot also. Please tell me > what did I do wrong. > > > [image: Inline image] > > > The full config is mentioned below > > > *Step 1* > > *[CA]* > *pki_admin_email=mycompany(a)abc.lk <mycompany(a)abc.lk>* > *pki_admin_name=caadmin* > *pki_admin_nickname=caadmin* > *pki_admin_password=Secret.123* > *pki_admin_uid=caadmin* > > *pki_client_database_password=Secret.123* > *pki_client_database_purge=False* > *pki_client_pkcs12_password=Secret.123* > > *pki_ds_base_dn=dc=issueca,dc=mycompany,dc=lk* > *pki_ds_database=ca2* > *pki_ds_password=Secret.123* > > *pki_security_domain_name=mycompany_domain* > *pki_token_password=Secret.123* > > *pki_external=True* > *pki_external_step_two=False* > > > *pki_ca_signing_subject_dn=cn=mycompany_cn,ou=mycompany_ou,o=mycompany_o,c=LK* > *pki_ca_signing_csr_path=ca_signing.csr* > > *pki_ca_signing_nickname=mycompany_nickname* > > *pki_default_ocsp_uri=http://ocsp.mycompany.lk <http://ocsp.mycompany.lk>* > > > > *Step 2* > > *[CA]* > *pki_admin_email=mycompany(a)abc.lk <mycompany(a)abc.lk>* > *pki_admin_name=caadmin* > *pki_admin_nickname=caadmin* > *pki_admin_password=Secret.123* > *pki_admin_uid=caadmin* > > *pki_client_database_password=Secret.123* > *pki_client_database_purge=False* > *pki_client_pkcs12_password=Secret.123* > > *pki_ds_base_dn=dc=issueca,dc=mycompany,dc=lk* > *pki_ds_database=ca2* > *pki_ds_password=Secret.123* > > *pki_security_domain_name=mycompany_domain* > *pki_token_password=Secret.123* > > *pki_external=True* > *pki_external_step_two=True* > > *pki_ca_signing_csr_path=ca_signing.csr* > *pki_ca_signing_cert_path=ca_signing.crt* > > *pki_ca_signing_nickname=mycompany_nickname* > > *pki_default_ocsp_uri=http://ocsp.mycompany.lk <http://ocsp.mycompany.lk>* > > > > > Thank you and best regards, > Nadeera. > > > > > > On Wednesday, May 20, 2020, 03:29:15 AM GMT+5:30, Dinesh Prasanth > Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com> wrote: > > > Hi Nadeera, > > What version of dogtag PKI are you trying to install? You are referring to > PKI 10.5 docs. The latest release is 10.8.3 > > If you are using the latest packages, our docs are available in our > upstream repo: https://github.com/dogtagpki/pki/tree/v10.8/docs > > (see inline reply) > > On Tue, May 19, 2020 at 9:22 AM Nadeera Galagedara < > nadeeragalagedara(a)yahoo.com> wrote: > > Dear all, > > I am new to dogtag and I am installing a sub ca using the method > described in > https://www.dogtagpki.org/wiki/PKI_10.5_Installing_CA_with_External_CA_Sign… > . I want to know. > > 1) What is the parameter to change the *Friendly Name* > > We do not use "Friendly Name". Instead, we use "nickname" > To configure the nickname for CA signing certificate use: > pki_ca_signing_nickname= > > 2) What is the parameter to change the *Country/Locality* > > This is set using subject dn. So, in your case specify the Country using > this attribute: pki_ca_signing_subject_dn= > > > 3) Where (a page link ) I can find details about each of this > configuration parameters. > > I don't have a page that explains all the config parameters. But, I do > have a page that can give you a list of parameters that you can use (since > you mentioned 10.5, I'm listing the contents of 10.5 branch. Refer to the > appropriate branch for an updated list) > > https://github.com/dogtagpki/pki/blob/DOGTAG_10_5_BRANCH/base/server/etc/de… > > HTH > > Regards, > --Dinesh > > > > > Thank you. > > _______________________________________________ > Pki-devel mailing list > Pki-devel(a)redhat.com > https://www.redhat.com/mailman/listinfo/pki-devel > >

2 2

[CRON] Errored: dogtagpki/pki-nightly-test#732 (master - 2a95153)
by Travis CI 31 May '20

31 May '20

Build Update for dogtagpki/pki-nightly-test ------------------------------------- Build: #732 Status: Errored Duration: 14 mins and 3 secs Commit: 2a95153 (master) Author: Dinesh Prasanth M K Message: Remove EOL F29 from matrix and add support for v10.8 branch Signed-off-by: Dinesh Prasanth M K <dmoluguw(a)redhat.com> View the changeset: https://github.com/dogtagpki/pki-nightly-test/compare/1cec22733aad03cad1e58… View the full build log and details: https://travis-ci.org/github/dogtagpki/pki-nightly-test/builds/693133175?ut… -- You can unsubscribe from build emails from the dogtagpki/pki-nightly-test repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=20325727&u…. Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notificati…. Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

1 0

[CRON] Errored: dogtagpki/pki-nightly-test#731 (master - 2a95153)
by Travis CI 30 May '20

30 May '20

Build Update for dogtagpki/pki-nightly-test ------------------------------------- Build: #731 Status: Errored Duration: 19 mins and 44 secs Commit: 2a95153 (master) Author: Dinesh Prasanth M K Message: Remove EOL F29 from matrix and add support for v10.8 branch Signed-off-by: Dinesh Prasanth M K <dmoluguw(a)redhat.com> View the changeset: https://github.com/dogtagpki/pki-nightly-test/compare/1cec22733aad03cad1e58… View the full build log and details: https://travis-ci.org/github/dogtagpki/pki-nightly-test/builds/692877061?ut… -- You can unsubscribe from build emails from the dogtagpki/pki-nightly-test repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=20325727&u…. Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notificati…. Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

1 0

[CRON] Errored: dogtagpki/pki-nightly-test#730 (master - 2a95153)
by Travis CI 29 May '20

29 May '20

Build Update for dogtagpki/pki-nightly-test ------------------------------------- Build: #730 Status: Errored Duration: 14 mins and 3 secs Commit: 2a95153 (master) Author: Dinesh Prasanth M K Message: Remove EOL F29 from matrix and add support for v10.8 branch Signed-off-by: Dinesh Prasanth M K <dmoluguw(a)redhat.com> View the changeset: https://github.com/dogtagpki/pki-nightly-test/compare/1cec22733aad03cad1e58… View the full build log and details: https://travis-ci.org/github/dogtagpki/pki-nightly-test/builds/692557367?ut… -- You can unsubscribe from build emails from the dogtagpki/pki-nightly-test repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=20325727&u…. Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notificati…. Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

1 0

[CRON] Errored: dogtagpki/pki-nightly-test#728 (master - 2a95153)
by Travis CI 27 May '20

27 May '20

Build Update for dogtagpki/pki-nightly-test ------------------------------------- Build: #728 Status: Errored Duration: 13 mins and 56 secs Commit: 2a95153 (master) Author: Dinesh Prasanth M K Message: Remove EOL F29 from matrix and add support for v10.8 branch Signed-off-by: Dinesh Prasanth M K <dmoluguw(a)redhat.com> View the changeset: https://github.com/dogtagpki/pki-nightly-test/compare/1cec22733aad03cad1e58… View the full build log and details: https://travis-ci.org/github/dogtagpki/pki-nightly-test/builds/691741522?ut… -- You can unsubscribe from build emails from the dogtagpki/pki-nightly-test repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=20325727&u…. Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notificati…. Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

1 0

[CRON] Errored: dogtagpki/pki-nightly-test#727 (master - 2a95153)
by Travis CI 26 May '20

26 May '20

Build Update for dogtagpki/pki-nightly-test ------------------------------------- Build: #727 Status: Errored Duration: 13 mins and 47 secs Commit: 2a95153 (master) Author: Dinesh Prasanth M K Message: Remove EOL F29 from matrix and add support for v10.8 branch Signed-off-by: Dinesh Prasanth M K <dmoluguw(a)redhat.com> View the changeset: https://github.com/dogtagpki/pki-nightly-test/compare/1cec22733aad03cad1e58… View the full build log and details: https://travis-ci.org/github/dogtagpki/pki-nightly-test/builds/691304296?ut… -- You can unsubscribe from build emails from the dogtagpki/pki-nightly-test repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=20325727&u…. Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notificati…. Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

1 0

[CRON] Errored: dogtagpki/pki-nightly-test#726 (master - 2a95153)
by Travis CI 25 May '20

25 May '20

Build Update for dogtagpki/pki-nightly-test ------------------------------------- Build: #726 Status: Errored Duration: 14 mins and 34 secs Commit: 2a95153 (master) Author: Dinesh Prasanth M K Message: Remove EOL F29 from matrix and add support for v10.8 branch Signed-off-by: Dinesh Prasanth M K <dmoluguw(a)redhat.com> View the changeset: https://github.com/dogtagpki/pki-nightly-test/compare/1cec22733aad03cad1e58… View the full build log and details: https://travis-ci.org/github/dogtagpki/pki-nightly-test/builds/690938801?ut… -- You can unsubscribe from build emails from the dogtagpki/pki-nightly-test repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=20325727&u…. Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notificati…. Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

1 0

[CRON] Errored: dogtagpki/pki-nightly-test#725 (master - 2a95153)
by Travis CI 24 May '20

24 May '20

Build Update for dogtagpki/pki-nightly-test ------------------------------------- Build: #725 Status: Errored Duration: 14 mins and 30 secs Commit: 2a95153 (master) Author: Dinesh Prasanth M K Message: Remove EOL F29 from matrix and add support for v10.8 branch Signed-off-by: Dinesh Prasanth M K <dmoluguw(a)redhat.com> View the changeset: https://github.com/dogtagpki/pki-nightly-test/compare/1cec22733aad03cad1e58… View the full build log and details: https://travis-ci.org/github/dogtagpki/pki-nightly-test/builds/690606022?ut… -- You can unsubscribe from build emails from the dogtagpki/pki-nightly-test repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=20325727&u…. Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notificati…. Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

1 0

[CRON] Errored: dogtagpki/pki-nightly-test#724 (master - 2a95153)
by Travis CI 23 May '20

23 May '20

Build Update for dogtagpki/pki-nightly-test ------------------------------------- Build: #724 Status: Errored Duration: 13 mins and 51 secs Commit: 2a95153 (master) Author: Dinesh Prasanth M K Message: Remove EOL F29 from matrix and add support for v10.8 branch Signed-off-by: Dinesh Prasanth M K <dmoluguw(a)redhat.com> View the changeset: https://github.com/dogtagpki/pki-nightly-test/compare/1cec22733aad03cad1e58… View the full build log and details: https://travis-ci.org/github/dogtagpki/pki-nightly-test/builds/690353858?ut… -- You can unsubscribe from build emails from the dogtagpki/pki-nightly-test repository going to https://travis-ci.org/account/preferences/unsubscribe?repository=20325727&u…. Or unsubscribe from *all* email updating your settings at https://travis-ci.org/account/preferences/unsubscribe?utm_medium=notificati…. Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

1 0