3:38 p.m.
On Wed, Oct 24, 2012 at 04:02:53PM -0400, Rob Crittenden wrote:
I assume he'd have to modify a profile to do this?
There are two signatures when you're talking about using a CSR to
request a certificate from an external CA.
There's the digest used for the signature that the issuer includes in
the certificate. In Dogtag, I believe that the allowed types are
enumerated (by a signingAlgConstraint) in the profile, and the default
is specified (as "ca.signing.defaultSigningAlgorithm") in the CA's
CS.cfg file.
Someone please correct me if I'm looking at the wrong places there.
Then there's the digest used for the self-signature that the client
includes in the CSR. The IPA installs script uses certutil, and it
looks like certutil uses SHA1 by default. That's fine for this user,
but I'll note that we can apparently use certutil's (undocumented?) -Z
flag to switch that to something like SHA256.
HTH,
Nalin
4:09 p.m.
On 10/24/2012 01:38 PM, Nalin Dahyabhai wrote:
On Wed, Oct 24, 2012 at 04:02:53PM -0400, Rob Crittenden wrote:
> I assume he'd have to modify a profile to do this?
There are two signatures when you're talking about using a CSR to
request a certificate from an external CA.
There's the digest used for the signature that the issuer includes in
the certificate. In Dogtag, I believe that the allowed types are
enumerated (by a signingAlgConstraint) in the profile, and the default
is specified (as "ca.signing.defaultSigningAlgorithm") in the CA's
CS.cfg file.
You can also specify default signing algorithm in the profile without
changing CA's default signing algorithm.
IPA's profile could but it does not specify default signing algorithm.
See caIPAserviceCert.cfg:
policyset.serverCertSet.8.default.params.signingAlg=-
To specify default signing algorithm in the IPA profile, modify above
line by including signing algorithm from the constraint list.
See caIPAserviceCert.cfg:
policyset.serverCertSet.8.constraint.params.signingAlgsAllowed=. . .
Someone please correct me if I'm looking at the wrong places there.
Then there's the digest used for the self-signature that the client
includes in the CSR. The IPA installs script uses certutil, and it
looks like certutil uses SHA1 by default. That's fine for this user,
but I'll note that we can apparently use certutil's (undocumented?) -Z
flag to switch that to something like SHA256.
HTH,
Nalin
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
4:31 p.m.
Does this also changes the value of "Subject Key Identifier" and "Auth
Key Identifier" extensions?
I am getting inconsistent results, but not sure if the algorithm should
be same as the one used to sign the certificate.
- dhiva
On 10/24/12 2:09 PM, Andrew Wnuk wrote:
On 10/24/2012 01:38 PM, Nalin Dahyabhai wrote:
> On Wed, Oct 24, 2012 at 04:02:53PM -0400, Rob Crittenden wrote:
>> I assume he'd have to modify a profile to do this?
> There are two signatures when you're talking about using a CSR to
> request a certificate from an external CA.
>
> There's the digest used for the signature that the issuer includes in
> the certificate. In Dogtag, I believe that the allowed types are
> enumerated (by a signingAlgConstraint) in the profile, and the default
> is specified (as "ca.signing.defaultSigningAlgorithm") in the CA's
> CS.cfg file.
You can also specify default signing algorithm in the profile without
changing CA's default signing algorithm.
IPA's profile could but it does not specify default signing algorithm.
See caIPAserviceCert.cfg:
policyset.serverCertSet.8.default.params.signingAlg=-
To specify default signing algorithm in the IPA profile, modify above
line by including signing algorithm from the constraint list.
See caIPAserviceCert.cfg:
policyset.serverCertSet.8.constraint.params.signingAlgsAllowed=. . .
>
> Someone please correct me if I'm looking at the wrong places there.
>
> Then there's the digest used for the self-signature that the client
> includes in the CSR. The IPA installs script uses certutil, and it
> looks like certutil uses SHA1 by default. That's fine for this user,
> but I'll note that we can apparently use certutil's (undocumented?) -Z
> flag to switch that to something like SHA256.
>
> HTH,
>
> Nalin
>
> _______________________________________________
> Pki-devel mailing list
> Pki-devel(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-devel
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
9:07 a.m.
Nalin Dahyabhai wrote:
On Wed, Oct 24, 2012 at 04:02:53PM -0400, Rob Crittenden wrote:
> I assume he'd have to modify a profile to do this?
There are two signatures when you're talking about using a CSR to
request a certificate from an external CA.
There's the digest used for the signature that the issuer includes in
the certificate. In Dogtag, I believe that the allowed types are
enumerated (by a signingAlgConstraint) in the profile, and the default
is specified (as "ca.signing.defaultSigningAlgorithm") in the CA's
CS.cfg file.
Someone please correct me if I'm looking at the wrong places there.
Then there's the digest used for the self-signature that the client
includes in the CSR. The IPA installs script uses certutil, and it
looks like certutil uses SHA1 by default. That's fine for this user,
but I'll note that we can apparently use certutil's (undocumented?) -Z
flag to switch that to something like SHA256.
The CSR is generated by dogtag. I'm not sure if it forks out to certutil
or not but I'd suspect it doesn't.
Can someone from the CS team confirm that changing the
defaultSigningAlgorithm is the right thing to do here?
rob
12:55 p.m.
On 10/25/2012 07:07 AM, Rob Crittenden wrote:
Nalin Dahyabhai wrote:
> On Wed, Oct 24, 2012 at 04:02:53PM -0400, Rob Crittenden wrote:
>> I assume he'd have to modify a profile to do this?
>
> There are two signatures when you're talking about using a CSR to
> request a certificate from an external CA.
>
> There's the digest used for the signature that the issuer includes in
> the certificate. In Dogtag, I believe that the allowed types are
> enumerated (by a signingAlgConstraint) in the profile, and the default
> is specified (as "ca.signing.defaultSigningAlgorithm") in the CA's
> CS.cfg file.
>
> Someone please correct me if I'm looking at the wrong places there.
>
> Then there's the digest used for the self-signature that the client
> includes in the CSR. The IPA installs script uses certutil, and it
> looks like certutil uses SHA1 by default. That's fine for this user,
> but I'll note that we can apparently use certutil's (undocumented?) -Z
> flag to switch that to something like SHA256.
The CSR is generated by dogtag. I'm not sure if it forks out to
certutil or not but I'd suspect it doesn't.
Can someone from the CS team confirm that changing the
defaultSigningAlgorithm is the right thing to do here?
Andrew is correct that you can also just change the following line in
the profile (the "-" is telling the server to use the CA's default one
from the CS.cfg) so it will only affect that particular profile:
policyset.serverCertSet.8.constraint.params.signingAlgsAllowed=-
to
policyset.serverCertSet.8.constraint.params.signingAlgsAllowed=SHA1withRSA
rob
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
3:46 p.m.
Is the question on how to sign a CSR with SHA1 signing algorithm? You
select that with whatever tool you use to generate the CSR. Or, is the
question on how to get the CA to sign your certificate with a SHA1
signing algorithm? In that case, you will have to find out from this
"external CA" on how to do it. With Dogtag/RHCS, you will have to
modify the profile as well as the CS.cfg
(ca.signing.defaultSigningAlgorithm).
Christina
On 10/24/2012 01:02 PM, Rob Crittenden wrote:
I assume he'd have to modify a profile to do this?
rob
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
4441
days inactive
4442
days old
6 comments
5 participants
participants (5)
-
Andrew Wnuk -
Christina Fu -
Dhiva -
Nalin Dahyabhai -
Rob Crittenden