9:53 p.m.
This patch documents continued implementation of the PKI Deployment
Framework based upon the revised filesystem layout documented here:
*
http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment#CA_.2F_KRA_.2F_...
This patch must be applied AFTER "[PATCH] PKI Deployment Framework
(20120716)".
The following patch adds/corrects functionality of the existing PKI
Deployment Framework including (but not limited to):
Saved Admin Certificate, imported it into NSS client security
databases, and
exported it to a PKCS #12 file such that it may be imported into a
browser.
TRAC Ticket #221
Dogtag 10: Create a PKCS #12 file containing the Admin Certificate
(https://fedorahosted.org/pki/ticket/221)
To test this patch (presumes a Fedora 17 machine with a pre-installed
directory server and PKI packages with these two patches installed):
As 'root' on 'example.fedora.org':
# (if necessary) pkidestroy -s CA -v -d fedora.org -i foobar
--http_port 8080 --https_port 8443 --ajp_port 8005
# pkispawn -s CA -f /tmp/pki/pkideployment.cfg -vvv -d fedora.org -i
foobar --http_port 8080 --https_port 8443 --ajp_port 8005
# systemctl restart pki-tomcatd(a)fedora.org-foobar.service
# mkdir -p /tmp/pki
# cp /usr/share/pki/deployment/config/pkideployment.cfg /tmp/pki
# cd /tmp/pki
# Edit pkideployment.cfg and add the desired passwords to the
following variables:
* pki_admin_password=
* pki_backup_password= (THIS CAN BE SKIPPED)
* pki_client_pkcs12_password=
* pki_ds_password=
* pki_pkcs12_password=
* pki_security_domain_password=
If necessary, change the default ports on the directory server to
match the installed version
As 'user' on 'example.fedora.org':
* firefox -ProfileManager -no-remote &
* New Profile: example
* http://example.fedora.org:8080/ca/services
* Launches browser tab entitled 'CA Services'
* Select 'SSL End Users Services' in new tab
* Trust this Connection
* Launches browser tab entitled 'CA End-Entity'
* Select "Retrieval" tab
* Select "Import CA Certificate Chain"
* Select "Import the CA certificate chain into your browser"
* Press Submit
* Check all three Trust checkboxes and press OK
* From the Browser's Menu:
* Select Edit | Preferences
* Highlight the Advanced icon
* Select the Encryption tab
* Press the View Certificates button
* Select the "Your Certificates" tab
* Press the Import button
* Go to File System | tmp | fedora.org-foobar_client
* Highlight ca_admin_cert.p12
* Press the Open button
* Type in the PKCS #12 password
* Dismiss the "Success" pop-up by pressing OK
* Dismiss the Encryption tab by pressing OK
* Close Preferences by pressing Close
* From the 'CA Services' tab, select 'Agent Services' in a new tab
* Select the proper cert from the pulldown menu and press OK
* Launches browser tab entitled 'CA Agent'
* Re-select 'CA End-Entity' tab in browser
* Select 'Enrollment/Renewal' tab
* Select Manual User Dual-Use Certificate Enrollment
* Type test in UID field
* Press Submit button
* Re-select 'CA Agent' tab in browser
* Select 'List Requests' on left-hand menu
* Press Find
* Select the cert (e. g. - '7') from the Request Queue
* Scroll to the bottom and press the submit button
* Select 'List Certificates' on left-hand menu
* Press Find
* The new certificate (e. g. - '7') should be displayed