Re: [Pki-users] Questions on customizing certificate profiles

I will give this a shot, Kevin - although I wonder how much time it will take to get the Build environment right to get through all the compiles vs. doing a "renewal" of the certs. However, to follow up on the other issue - the documentation on RHBA-2009-1602 suggests that only the SHA-2 algorithm issue can be fixed. Am I still stuck with the renewal method to get the other certificate extensions fixed - the keyUsages, AIA, OCSPNoCheck, etc?

Arshad Noor StrongAuth, Inc. Kevin Unthank wrote: > Hi Arshad, > > We most certainly have not forgotten our open-source roots. > > In response to customer demand for this SHA2 functionality, Red Hat > engineers implemented it and released it as an enhancement errata > for RHCS8. At the very same time, the source code for that > enhancement was made available, freely, to everyone in the dogtag > community. > > You can checkout that codewith SVN > svn co > https://pki.fedoraproject.org/svn/pki/branches/PKI_8_0_ERRATA_BRANCH > Merge it with the dogtag source and compile your own dogtag > packages with the desired functionality. > > As I stated in my earlier response we absolutely intend to > take the code from the open-source CS8 branch, and add it to the > open-source dogtag tip but that work has not been scheduled yet. > I will see if I can get the priority bumped up. > > I strongly encourage you to create your own dogtag build > environment so you can get access to the latest code checkins. > There are instructions for doing this on the dogtag wiki and > I know some of the community members have already done this. > > There is no manipulation of the trust and goodwill of the > open-source community going on here. > > Cheers, > Kev > > On 04/08/2010 03:25 PM, Arshad Noor wrote: >> I am sorry to read this, Kevin. It suggests that RedHat has >> forgotten its open-source roots and what made it a billion >> dollar company in the first place. >> >> We are all familiar with the **** that companies put up with >> when buying some commercial products. Open-source was meant >> to be an answer to that problem - that quality could be vastly >> improved in software when there were many eyes looking at the >> source - not because some people just like the idea of seeing >> the source-code of the products they use. >> >> That RedHat was making money on services off of open-source >> products was perfectly acceptable - there is real value in >> services. But, when the open-source company starts >> differentiating its open-source products from its commercial >> products, it subverts the whole notion of open-source and what >> it stands for. >> >> If the fix did not exist and it was up to the open-source >> community to prioritize the fix, that's one thing. But when >> the fix *does* exist, and has been merged into the commercial >> branch, but is not merged into the open-source branch - that >> suggests deliberate manipulation of the trust and goodwill of >> the open-source community. >> >> Arshad Noor >> StrongAuth, Inc. >> >> >> Kevin Unthank wrote: >>> Hi Arshad, >>> >>> Obviously, there are differences between RHCS8 and the latest release >>> of Dogtag. Generally, new feature development takes place in dogtag >>> and some of those features find there way back into RHCS8. Bug fixing >>> often occurs first in RHCS8 and those fixes are ported to dogtag. >>> >>> PKI with only SHA-2 hashes is a fix that was made in the RHCS8 >>> code tree and released in both source binary form in errata >>> RHBA-2009-1602. That fix will make it into dogtag builds but I can't >>> commit to a specific release or date when this will happen. >>> >>> Until then it should be possible to work around the problem by using >>> pkisilent or the renewal method suggested by Andrew. >>> >>> Cheers, >>> Kev >>> >>> On 04/08/2010 10:55 AM, Arshad Noor wrote: >>>> Can someone from the DogTag Engineering team confirm that a PKI >>>> with only SHA-2 hashes *cannot* be built with the current version >>>> of the product? >>>> >>>> I find this hard to believe given that the RHCS documentation seems >>>> to indicate that it is possible to do so, and given that the >>>> underlying code already has SHA-2 support; nevertheless, can someone >>>> confirm Oliver's finding? Thanks. >>>> >>>> Arshad Noor >>>> StrongAuth, Inc. >>>> >>>> P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes >>>> can be configured at the time the self-signed cert is created, does >>>> that imply that the commercial RHCS is technologically different from >>>> the open-source DogTag? And, that it isn't just a question of RedHat >>>> support? >>>> >>>> >>>> Oliver Burtchen wrote: >>>>> Hi @ all, >>>>> >>>>> I also tried to change from "SHA1withRSA" to "SHA256withRSA" by >>>>> editing the config files. No luck! >>>>> >>>>> I found, this is hard-coded in the sources, for example in: >>>>> >>>>> - >>>>> pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java >>>>> - >>>>> pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java >>>>> >>>>> >>>>> Just look for "SHA1withRSA" in the files, I don't think this are >>>>> just >>>>> fallbacks. >>>>> Best regards, >>>>> Oli >>>>> >>>>> >>>>> >>>>> Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan: >>>>>> On 04/06/2010 05:08 PM, Arshad Noor wrote: >>>>>>> The only option that is visible under Advanced is the key-size >>>>>>> for each of the certificate-types. The hash algorithm does not >>>>>>> show up at all. >>>>>>> >>>>>>> Even the default, as mentioned by Step 8, is not the default as >>>>>>> the last 10-12 installs have shown: >>>>>>> >>>>>>> * SHA256withRSA (the default) >>>>>>> >>>>>>> So, the question is: is the current build of DogTag in the pki >>>>>>> repository identical to RHCS 8.0 or is it a different version? >>>>>> It might very well be ... we can look at the svn commits >>>>>> to be really sure... >>>>>> >>>>>>> Arshad Noor >>>>>>> StrongAuth, Inc. >>>>>>> >>>>>>> Chandrasekar Kannan wrote: >>>>>>>> the installation wizard should provide 'options' under the >>>>>>>> advanced >>>>>>>> section for you to be able to select the alg to use. Have you >>>>>>>> tried >>>>>>>> doing Step (8) from here ? >>>>>>>> http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configur >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> ing_a_CA.html >>>>>> _______________________________________________ >>>>>> Pki-users mailing list >>>>>> Pki-users(a)redhat.com >>>>>> https://www.redhat.com/mailman/listinfo/pki-users >>>>>> >>>>> >>>> >>>> _______________________________________________ >>>> Pki-users mailing list >>>> Pki-users(a)redhat.com >>>> https://www.redhat.com/mailman/listinfo/pki-users _______________________________________________ Pki-users mailing list Pki-users(a)redhat.com https://www.redhat.com/mailman/listinfo/pki-users