Re: [Pki-users] Generating certificates with DSA signatures
Hi Fraser,
The CA does not need to be DSA. It can be RSA and sign a DSA cert for
you. You just need to generate a CSR with DSA key.
For example, you can use certutil to generate a DSA CSR:
# certutil -d . -R -k dsa -s "CN=cfuTestDSA" -a -o cfuDSA.req.b64
# cat cfuDSA.req.b64
MIICFjCCAdYCAQAwFTETMBEGA1UEAxMKY2Z1VGVzdERTQTCCAbYwggErBgcqhkjO
OAQBMIIBHgKBgQCY7zqucJibRNs1hsG2wkd8tP+Z6K5E8uvDviMPZdBMBIKQp51K
yJN/Qd/4gGsLaH+v5Ki1spnDafs/5xvQD6l6SgS/UJ4iM7iJUyQQ+Wh3ra8QaLjT
aF2jw+tyO6ALc2XF0fqMwH2qUik0RAG/EiX+GArIP8FgSNutk7ZhZ9eoLQIVALWw
hItEKfYzWaE8vtJ/NaF2JwOBAoGABA6DafHNfeUMeJPWSW8ABE4ObDeqOCJH0ljs
gxKV+Zzx9Cf/15lXNcZkTMBHEjFQgjwqBwMB7zAJiYJBdnHanleLdjg3X6XNMoRF
jUwXVCtdwmu6PqB7ldcAQvcIuIOHYOHl9BpUwiDaODrRthD0yzXal5KH1qU3YrST
ShUhpRADgYQAAoGAKDm/ww3NZTM+Npdc1WnZZlebT78BcKQVUfMMHvqG+TJRrkjZ
RwhUKeNoYeRxPt0bJ8QUtRDG/ihQ+mH22bOJkhogXuf/GdGbKTRjInnXho6NEaQo
sSY3CJ/865RXvPXDBleYoF1WzAntEQtWY+9/uSGZD20uubrKUopNioNTD86gADAJ
BgcqhkjOOAQDAy8AMCwCFD59mJXc3EnJWY8N66DhCoKeg8yGAhQpYqFI14WFTk39
CXfwXSsLE5qSfw==
Paste that into "Other Certificate Enrollment" at the CA EE page, submit
Go to CA agent and approve it and I see:
<snip>
Subject Public Key Info:
Algorithm: DSA - 1.2.840.10040.4.1
<snip>
Hope this helps,
Christina
On 09/11/2014 12:22 AM, Fraser Tweedale wrote:
Hi all,
Is there some documentation somewhere about how to set up /
configure a CA subsystem such that it can sign requests with DSA
rather than RSA?
I guess that you need to spawn an instance with a DSA signing key or
somehow configure one after the spawning, but I'm not sure how to do
this.
Cheers,
Fraser
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users