Re: [Pki-devel] Enterprise CA Architecture

Thanks Jack, That did it.  I'll add some "Lessons Learned" as well. 1.) You must first disable the profile you want to edit in CA Agent.  Then open pkiconsole to edit the actual Certificate Profile.      -This step is easily missed! 2.) If you don't know what profile you're trying to edit, from CA Agent -> List Requests -> Show all requests.     -Since I'm working with SCEP, I needed to find out what profile was being used, so I could modify it with the correct OCSP URI. For the remaining questions: Q1. Q2.Q3, and Q6 are not valid.  I had incorrectly assumed that the OCSP relayed requests or pulled the CRL, thus being the initiator.  This is not the case.  When the OCSP registers with the CA, the CA creates a OCSPPublisher that is setup to publish the CRL to the OCSP.  ***Note:  Each OCSP you register over writes the prior.  If all of your OCSPs are cloned from a single instance, this does not cause an issue.  If they are clones of a single OCSP instance, LDAP handles the replication for the group.  If you have multiple OCSP clusters, this causes an issue though.  You will need to manually go into pkiconsole and create a new OCSPPublisher and Publishing Rule for the previous OCSP. Example:  OCSP1 registers Master with CA1  ->  OCSPPublisher=OCSP1 OCSP2 Clone of OCSP1 registers with CA1  ->  OCSPPublisher=OCSP2  (Still works because OCSP1 and OCSP2 have LDAP replication.) OCSP3 registers Master with CA1  ->  OCSPPublisher=OCSP3  (OCSP1 and 2 no longer get CRL.  OCSP3 gets it.) OCSP4 Clone of OCSP3 registers with CA1  ->  OCSPPublisher=OCSP4  (OCSP1 and 2 no longer get CRL.  OCSP4 gets it and LDAP replicates it to OCSP3.) Solution: Register OCSPPublisher1 as a new Publisher and create a Publishing Rule for it. Ensure you have 1 OCSPPublisher for each cluster of OCSPs. Solution Enhancement:  Automatically name the OCSPPublisher the name of the OCSP Server, if it's not a Clone of an existing OCSP instance and create the appropriate Publishing Rule. Thank you Paul ----- Original Message ----- From: John Magne <jmagne(a)redhat.com&gt; To: orrious(a)yahoo.com Cc: pki-users(a)redhat.com; pki-devel(a)redhat.com Sent: Wednesday, August 28, 2013 1:37 PM Subject: Re: [Pki-devel] Enterprise CA Architecture As for your OCSP query, try this: Use the console to edit the certificate profile you are using. I'm assuming it is caUserCert You can also do this with config files if you want. Look in /var/lib/pki-ca/profiles/ca/caUserCert.cfg Anyway, there is an entry of the AIA extension that looks like this in the file: policyset.userCertSet.5.default.class_id=authInfoAccessExtDefaultImpl policyset.userCertSet.5.default.name=AIA Extension Default policyset.userCertSet.5.default.params.authInfoAccessADEnable_0=true policyset.userCertSet.5.default.params.authInfoAccessADLocationType_0=URIName policyset.userCertSet.5.default.params.authInfoAccessADLocation_0= policyset.userCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1 policyset.userCertSet.5.default.params.authInfoAccessCritical=false policyset.userCertSet.5.default.params.authInfoAccessNumADs=1 Either using editor or the console, put something in there for this setting: policyset.userCertSet.5.default.params.authInfoAccessADLocation_0=blah-url Restart the server and try to issue a cert with this profile. Also, when the agent approves the cert request, it has the chance to change this setting on that page as well. For your load balancer issue. Just as a quick test you might venture into your OCSP's conf/CS.cfg file and observe the entries that are pointing you to the CA. I haven't not tried this but it might be possible to change one of those settings to your LB and see what happens. If there is a more elegant way to do this, others can chime in. thanks, jack ----- Original Message -----