6:59 a.m.
HI Team,
1. Can you please help, how to generate the certificate using pkcs #12
format??
2. Is there any to validate the certificate with password using Dogtag
PKI ??
Thanks,
Sharath
7:32 a.m.
Hello,
you cannot generate a PKCS12 using a CA alone - the CA handles only the
public key of your certificate, while a PKCS12 contains the private key too.
I usually use openssl to combine those, or custom java code for bulk issued
certificates.
Am Fr., 1. Nov. 2019 um 13:00 Uhr schrieb Sharath <
sharathkumar.gundu(a)tecra.com>:
HI Team,
1. Can you please help, how to generate the certificate using pkcs #12
format??
2. Is there any to validate the certificate with password using Dogtag
PKI ??
Thanks,
Sharath
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
7:36 a.m.
Certifictae validation does not involve passwords. You (or your client,
e.g. Windows) check the following:
- is this certificate signed by a trusted CA (you need to add your CA to
the trusted roots beforehand)
- is the validity period still in range with the current date (= if your
clock is off, this can get a problem)
- if the certificate or the CA's certificate reference a CRL or an OCSP
URI, then that is used for validity checking too.
No password anywhere...
Am Fr., 1. Nov. 2019 um 13:00 Uhr schrieb Sharath <
sharathkumar.gundu(a)tecra.com>:
HI Team,
1. Can you please help, how to generate the certificate using pkcs #12
format??
2. Is there any to validate the certificate with password using Dogtag
PKI ??
Thanks,
Sharath
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
10:29 p.m.
New subject: [Pki-devel] How to generate the certificate in pkcs #12 format using Dogtag PKI
On Fri, Nov 01, 2019 at 05:29:40PM +0530, Sharath wrote:
HI Team,
1. Can you please help, how to generate the certificate using pkcs #12
format??
Hi Sharath,
PKCS #12 is a key and certificate archival format. The main use of
PKCS #12 in Dogtag is retrieving archived keys from the KRA (key
recovery authority).
If you have a certificate and the corresponding private key you can
create a PKCS #12 file using 'openssl pkcs12', or for keys in NSS
databases 'pk12util'.
If provide more context about your use case, we may be able to
provide more assistance :)
2. Is there any to validate the certificate with password using
Dogtag PKI
??
Again, it's not clear what you're trying to do. But with PKI you
never need a passphrase or private key to validate certificate
signatures.
Cheers,
Fraser
Thanks,
Sharath
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
1:09 a.m.
New subject: [Pki-devel] How to generate the certificate in pkcs #12 format using Dogtag PKI
HI Fraser,
I have use case like need to certify the PDF document with "handwritten
user signature with associated certificate and it should be validate
with the password" ??
How can we achieve this using Dogtag PKI??
Thanks,
Sharath
On 04/11/19 9:59 AM, Fraser Tweedale wrote:
On Fri, Nov 01, 2019 at 05:29:40PM +0530, Sharath wrote:
> HI Team,
>
> 1. Can you please help, how to generate the certificate using pkcs #12
> format??
>
Hi Sharath,
PKCS #12 is a key and certificate archival format. The main use of
PKCS #12 in Dogtag is retrieving archived keys from the KRA (key
recovery authority).
If you have a certificate and the corresponding private key you can
create a PKCS #12 file using 'openssl pkcs12', or for keys in NSS
databases 'pk12util'.
If provide more context about your use case, we may be able to
provide more assistance :)
> 2. Is there any to validate the certificate with password using Dogtag PKI
> ??
>
Again, it's not clear what you're trying to do. But with PKI you
never need a passphrase or private key to validate certificate
signatures.
Cheers,
Fraser
> Thanks,
>
> Sharath
>
>
> _______________________________________________
> Pki-devel mailing list
> Pki-devel(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-devel
2:21 p.m.
New subject: [Pki-devel] How to generate the certificate in pkcs #12 format using Dogtag PKI
Hi Sarath,
I think a X509 Certificate with "digital signature" key usage would
suffice based on what I can tell:
- https://helpx.adobe.com/acrobat/using/certificate-based-signatures.html
- https://tools.ietf.org/html/rfc5280#section-4.2.1.3
-
https://access.redhat.com/documentation/en-us/red_hat_certificate_system/...
Per a digicert article on the subject, you might want timestamping as
an extended key usage as well:
- https://www.digicert.com/document-signing/how-to-sign-a-pdf.htm
-
https://access.redhat.com/documentation/en-us/red_hat_certificate_system/...
Details are kinda sparse about what else you'd need, or if those
are sufficient. You might try reading Section 12.7.4.5 "Signature
Fields", Section 12.8 "Digital Signatures", and in particular,
Section 12.8.3.3 "PKCS#7 Signatures as used in ISO 32000" of the
PDF 1.7 specification for more information:
- https://www.adobe.com/content/dam/acom/en/devnet/pdf/pdfs/PDF32000_2008.pdf
You'd probably want to create a certificate profile with this
information at any rate:
-
https://access.redhat.com/documentation/en-us/red_hat_certificate_system/...
Hope that helps,
- Alex
----- Original Message -----
From: "Sharath" <sharathkumar.gundu(a)tecra.com>
To: "Fraser Tweedale" <ftweedal(a)redhat.com>
Cc: pki-users(a)redhat.com, pki-devel(a)redhat.com
Sent: Monday, November 4, 2019 2:09:54 AM
Subject: Re: [Pki-users] [Pki-devel] How to generate the certificate in pkcs #12 format
using Dogtag PKI
HI Fraser,
I have use case like need to certify the PDF document with "handwritten
user signature with associated certificate and it should be validate
with the password" ??
How can we achieve this using Dogtag PKI??
Thanks,
Sharath
On 04/11/19 9:59 AM, Fraser Tweedale wrote:
> On Fri, Nov 01, 2019 at 05:29:40PM +0530, Sharath wrote:
>> HI Team,
>>
>> 1. Can you please help, how to generate the certificate using pkcs #12
>> format??
>>
> Hi Sharath,
>
> PKCS #12 is a key and certificate archival format. The main use of
> PKCS #12 in Dogtag is retrieving archived keys from the KRA (key
> recovery authority).
>
> If you have a certificate and the corresponding private key you can
> create a PKCS #12 file using 'openssl pkcs12', or for keys in NSS
> databases 'pk12util'.
>
> If provide more context about your use case, we may be able to
> provide more assistance :)
>
>> 2. Is there any to validate the certificate with password using Dogtag PKI
>> ??
>>
> Again, it's not clear what you're trying to do. But with PKI you
> never need a passphrase or private key to validate certificate
> signatures.
>
> Cheers,
> Fraser
>
>> Thanks,
>>
>> Sharath
>>
>>
>> _______________________________________________
>> Pki-devel mailing list
>> Pki-devel(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/pki-devel
>
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
1819
days inactive
1825
days old
5 comments
4 participants
participants (4)
-
Alex Scheel -
Alexander Jung -
Fraser Tweedale -
Sharath