Re: [Pki-users] Questions on customizing certificate profiles

I am sorry to read this, Kevin. It suggests that RedHat has forgotten its open-source roots and what made it a billion dollar company in the first place. We are all familiar with the **** that companies put up with when buying some commercial products. Open-source was meant to be an answer to that problem - that quality could be vastly improved in software when there were many eyes looking at the source - not because some people just like the idea of seeing the source-code of the products they use. That RedHat was making money on services off of open-source products was perfectly acceptable - there is real value in services. But, when the open-source company starts differentiating its open-source products from its commercial products, it subverts the whole notion of open-source and what it stands for. If the fix did not exist and it was up to the open-source community to prioritize the fix, that's one thing. But when the fix *does* exist, and has been merged into the commercial branch, but is not merged into the open-source branch - that suggests deliberate manipulation of the trust and goodwill of the open-source community. Arshad Noor StrongAuth, Inc. Kevin Unthank wrote: > Hi Arshad, > > Obviously, there are differences between RHCS8 and the latest release > of Dogtag. Generally, new feature development takes place in dogtag > and some of those features find there way back into RHCS8. Bug fixing > often occurs first in RHCS8 and those fixes are ported to dogtag. > > PKI with only SHA-2 hashes is a fix that was made in the RHCS8 > code tree and released in both source binary form in errata > RHBA-2009-1602. That fix will make it into dogtag builds but I can't > commit to a specific release or date when this will happen. > > Until then it should be possible to work around the problem by using > pkisilent or the renewal method suggested by Andrew. > > Cheers, > Kev > > On 04/08/2010 10:55 AM, Arshad Noor wrote: >> Can someone from the DogTag Engineering team confirm that a PKI >> with only SHA-2 hashes *cannot* be built with the current version >> of the product? >> >> I find this hard to believe given that the RHCS documentation seems >> to indicate that it is possible to do so, and given that the >> underlying code already has SHA-2 support; nevertheless, can someone >> confirm Oliver's finding? Thanks. >> >> Arshad Noor >> StrongAuth, Inc. >> >> P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes >> can be configured at the time the self-signed cert is created, does >> that imply that the commercial RHCS is technologically different from >> the open-source DogTag? And, that it isn't just a question of RedHat >> support? >> >> >> Oliver Burtchen wrote: >>> Hi @ all, >>> >>> I also tried to change from "SHA1withRSA" to "SHA256withRSA" by >>> editing the config files. No luck! >>> >>> I found, this is hard-coded in the sources, for example in: >>> >>> - pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java >>> - >>> pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java >>> >>> Just look for "SHA1withRSA" in the files, I don't think this are just >>> fallbacks. >>> Best regards, >>> Oli >>> >>> >>> >>> Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan: >>>> On 04/06/2010 05:08 PM, Arshad Noor wrote: >>>>> The only option that is visible under Advanced is the key-size >>>>> for each of the certificate-types. The hash algorithm does not >>>>> show up at all. >>>>> >>>>> Even the default, as mentioned by Step 8, is not the default as >>>>> the last 10-12 installs have shown: >>>>> >>>>> * SHA256withRSA (the default) >>>>> >>>>> So, the question is: is the current build of DogTag in the pki >>>>> repository identical to RHCS 8.0 or is it a different version? >>>> It might very well be ... we can look at the svn commits >>>> to be really sure... >>>> >>>>> Arshad Noor >>>>> StrongAuth, Inc. >>>>> >>>>> Chandrasekar Kannan wrote: >>>>>> the installation wizard should provide 'options' under the advanced >>>>>> section for you to be able to select the alg to use. Have you tried >>>>>> doing Step (8) from here ? >>>>>> http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configur >>>>>> >>>>>> >>>>>> ing_a_CA.html >>>> _______________________________________________ >>>> Pki-users mailing list >>>> Pki-users(a)redhat.com >>>> https://www.redhat.com/mailman/listinfo/pki-users >>>> >>> >> >> _______________________________________________ >> Pki-users mailing list >> Pki-users(a)redhat.com >> https://www.redhat.com/mailman/listinfo/pki-users