Re: [Pki-users] getting NEED_TO_NOTIFY_ISSUED_SAVE_FAILED with dogtag-submit
On Tue, Apr 07, 2015 at 02:37:12PM -0500, Steve Neuharth wrote:
Yes, very observant. I noticed that as well. The difference was that
client.pem had some bag information in it:
*Bag Attributes friendlyName: PKI Administrator for test.org
<http://test.org> localKeyID: 4F E5 46 3D foo 64 1F
E4subject=/O=test.org <http://test.org> Security
Domain/emailAddress=caadmin(a)test.org/CN=PKI
<http://caadmin@test.org/CN=PKI> Administratorissuer=/O=test.org
<http://test.org> Security Domain/CN=CA Signing Certificate*
while cert.pem does not. otherwise, they contain the same cert data.
Right, you mentioned that you'd pulled the key and certificate out of a
PKCS#12 bundle, so it makes sense that that'd show up there.
I'm actually planning on using automatically approved certs
eventually and
so it is my desire to use either username/password or cert/key
authentication to facilitate that. I just noticed that the dogtag-submit
does not seem to use my cert/key pair when I specify them.
Does certificate authentication work for you in dogtag-submit?
It does, but I'd been using an NSS database (-d and -n flags) rather
than PEM-formatted keys and certificates. And -i to point to a
PEM-format certificate, and the -p flag, so it looked like this:
/usr/libexec/certmonger/dogtag-submit -E http://machete.bos.redhat.com:9180/ca/ee/ca -A
https://machete.bos.redhat.com:9443/ca/agent/ca -d /etc/httpd/alias -n ipaCert -i
/etc/ipa/ca.crt -p /etc/httpd/alias/pwdfile.txt
When I used "openssl pkcs12 -in /root/ca-agent.p12 -nodes -nokeys -out
/etc/pki/tls/certs/agent.cert" to extract the certificates, I had to
prune out everything but the agent certificate itself, and the agent key
itself, to avoid getting SSL connect errors, though that may only be
necessary with the older version of NSS's PEM module that my test system
has. The working invocation I ended up with looks like this:
/usr/libexec/certmonger/dogtag-submit -E http://machete.bos.redhat.com:9180/ca/ee/ca -A
https://machete.bos.redhat.com:9443/ca/agent/ca -k /etc/pki/tls/private/agent.key -c
/etc/pki/tls/certs/agent.cert -i /etc/ipa/ca.crt
I'm not sure if you're in SELinux enforcing mode, but if you are, the
daemon (and the helpers that it starts) may not be able to read the
files under /tmp/test unless they're labeled to allow it.
HTH,
Nalin