June 2016 - Pki-users - Dogtag Pki List Archives

by Lionel Beard

Hi, I'm trying to create a CA with a Atos/Bull HSM backend. I have created a configuration file default_hsm.cfg with hsm options enabled and configured, and I have set HSM token and password. When I run the command: # pkispawn -s CA -f /etc/pki/default_hsm.cfg -vvv I get the error: pkispawn : DEBUG ........... <?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><State>0</State><Type>CA</Type><Status>running</Status><Version>10.2.6-13.fc23</Version></XMLResponse> pkispawn : INFO ....... constructing PKI configuration data. pkispawn : INFO ....... executing 'certutil -R -d /root/.dogtag/pki-tomcat/ca/alias -s cn=PKI Administrator,e=caadmin(a)cls.fr ,o=cls.fr Security Domain -k rsa -g 2048 -z /root/.dogtag/pki-tomcat/ca/alias/noise -f /root/.dogtag/pki-tomcat/ca/password.conf -o /root/.dogtag/pki-tomcat/ca/alias/admin_pkcs10.bin' pkispawn : INFO ....... rm -f /root/.dogtag/pki-tomcat/ca/alias/noise pkispawn : INFO ....... BtoA /root/.dogtag/pki-tomcat/ca/alias/admin_pkcs10.bin /root/.dogtag/pki-tomcat/ca/alias/admin_pkcs10.bin.asc pkispawn : INFO ....... configuring PKI configuration data. pkispawn : ERROR ....... Exception from Java Configuration Servlet: 400 Client Error: Bad Request for url: https://freeipa-ca.cls.fr:8443/ca/rest/installer/configure pkispawn : ERROR ....... ParseError: not well-formed (invalid token): line 1, column 0: {"Attributes":{"Attribute":[]},"ClassName":"com.netscape.certsrv.base.BadRequestException","Code":400,"Message":"*Invalid Token provided. No such token*."} pkispawn : DEBUG ....... Error Type: ParseError pkispawn : DEBUG ....... Error Message: not well-formed (invalid token): line 1, column 0 pkispawn : DEBUG ....... File "/usr/sbin/pkispawn", line 597, in main rv = instance.spawn(deployer) File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 116, in spawn json.dumps(data, cls=pki.encoder.CustomTypeEncoder)) File "/usr/lib/python2.7/site-packages/pki/server/deployment/pkihelper.py", line 3872, in configure_pki_data root = ET.fromstring(e.response.text) File "/usr/lib64/python2.7/xml/etree/ElementTree.py", line 1300, in XML parser.feed(text) File "/usr/lib64/python2.7/xml/etree/ElementTree.py", line 1642, in feed self._raiseerror(v) File "/usr/lib64/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror raise err Installation failed. Just after pki service restart. I don't know which "Token" is it talking about, not sure it is HSM token. HSM is working fine because it is previously added to database with modutil: # modutil -list -dbdir /etc/pki/pki-tomcat/alias -nocertdb Bull TrustWay Proteccio NetHSM 2.4 Configuration read from /etc/proteccio//proteccio.rc Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificate Services token: NSS Certificate DB 2. nethsm library name: /usr/lib64/libnethsm.so slots: 8 slots attached status: loaded slot: Trustway Crypto Engine Slot token: nethsm1_V1 slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: ----------------------------------------------------------- Of course, I have updated default_hsm.cfg file according to Redhat documentation to enable HSM et put HSM token name and password: # grep hsm /etc/pki/default_hsm.cfg pki_audit_signing_token=nethsm1_V1 pki_hsm_enable=True pki_hsm_libfile=/usr/lib64/libnethsm.so pki_hsm_modulename=nethsm pki_ssl_server_token=nethsm1_V1 pki_subsystem_token=nethsm1_V1 pki_token_name=nethsm1_V1 pki_storage_token=nethsm1_V1 pki_transport_token=nethsm1_V1 I have tried with interactive installation (so with no HSM), and it is working fine. Does anyone can help me? Thanks!

8 years, 5 months

2
2
0 / 0

Renew expired OCSP system certificates

by pki tech

Hi all, Good day to you all. What is the process to renew all the four system certificates (SubsystemCert, ServerCert, ocspSigningCert and AuditsigningCert) when those existing certificates are currently expired. I cant access the pkiconsole also as the system is not up and running. I have used the certutil to generate the certificate requests and get it signed by the CA. But it didn't work as expected. I believe the procedure that i have followed to request generation or the signing profiles used for the generation, may have some issues. Cheers. Regards, Mark

8 years, 5 months

3
2
0 / 0

base64 CMC Request format

by Elliott William C OSS sIT

Hi all, Can Dogtag (in this case v. 9.0.3-30.el6 ) be coerced into accepting base64-encoded CMC requests? Is there a parameter somewhere? Or would it require reprogramming? We have a (smart-)card management system (runs under Windows) which sends the requests and expects the responses to both be base64 encoded. Thanks and best regards, William Elliott s IT Solutions Open System Services

8 years, 5 months

4
6
0 / 0

Intermediate CA

by Carlos Barrabes

Hello, Im trying to create an intermediate CA so I can issue certificates with a trust path pointing to our RootCA but I'm facing some issues while following the documentation in the project's site. Once I'm done with step two, you import the external and ca-signing certificates into a users NSS db and then the wiki says you have to import the CA admin certificate and key but the problem is there is no such thing after starting the instance via custom config file or I simply cannot find them. Any suggestions? Thanks for your time! I am running Dogtag 10.2.6-12 on a Fedora 22 server machine and the prodecure Im following is this one: http://pki.fedoraproject.org/wiki/Installing_CA_with_Externaly-Signed_CA_...

8 years, 5 months

2
2
0 / 0

install dogtag with exist private key

by anater dembelov

Good afternoon! Help me please. I have a private key, packages generate openssl. I have dogtag 10.3 installation to introduce my private key, as the root signing certificate. What need to do? Thank you so much.

8 years, 5 months

3
10
0 / 0

pki-ocsp dependency conflict

by Sergio Pereira

Hi guys, I am trying to install all dogtag subsystems on rhel 7.2. So far so good until try to install pki-ocsp subsystem. It asks for pki-server-10.1.2-7.el7 but all others use pki-server-10.2.5-10.el7. How do I resolve this dependency conflict? Thx, sp

8 years, 6 months

1
0
0 / 0

Announcing the Release of Dogtag 10.3.1

by Matthew Harmsen

The Dogtag team is proud to announce the release of Dogtag 10.3.1. Builds are available for Fedora 24. == Build Versions == * dogtag-pki-10.3.1-1 <http://koji.fedoraproject.org/koji/packageinfo?packageID=9999> * dogtag-pki-theme-10.3.1-1 <http://koji.fedoraproject.org/koji/packageinfo?packageID=11475> * pki-console-10.3.1-1 <http://koji.fedoraproject.org/koji/packageinfo?packageID=9863> * pki-core-10.3.1-1 <http://koji.fedoraproject.org/koji/packageinfo?packageID=11434> == Upgrade Notes == Simply use dnf to update existing packages.

8 years, 6 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Pki-users June 2016