October 2008 - Pki-users - Dogtag Pki List Archives

CMCEnroll: java.io.IOException: Internal Error - java.io.IOException: Sequence tag error 9

by Jan Meijer

Hi! I'm trying to get CMC signed enrollment to work. What I want to do is create certificate requests via a web based tool on one server, and ship them to the CA for auto-vetting. It looks like in my situation using signed CMC is the most simple solution. I *think* I have set everything up correctly but, when I try to test my assumption by using either CMCEnroll or CMCRequest to create a CMC request I get the following error: [root@ebbe test]# CMCEnroll -d "/root/test/cmc-agent/" -n "cmc" -r "/root/test/test3.csr" -p "bla" cert/key prefix = path = /root/test/cmc-agent/ java.io.IOException: Internal Error - java.io.IOException: Sequence tag error 9 at com.netscape.cmstools.CMCEnroll.getCMCBlob(CMCEnroll.java:133) at com.netscape.cmstools.CMCEnroll.main(CMCEnroll.java:412) and the same error comes when using CMCRequest. Now, this is NOT an error with the CA setup, as the CA doesn't come in play yet, no? Unfortunately I haven't debugged enough Java problems yet to understand what the error means. Maybe there's some library/class missing somewhere? If anyone could help out that would be great :) I'm running Fedora 9 and DogTag 1.00, package list is below: [root@ebbe test]# yum list | grep pki pki-ca.noarch 1.0.0-6.fc9 installed pki-ca-ui.noarch 1.0.0-1.fc9 installed pki-common.noarch 1.0.0-8.fc9 installed pki-common-ui.noarch 1.0.0-2.fc9 installed pki-console.noarch 1.0.0-4.fc9 installed pki-console-ui.noarch 1.0.0-1.fc9 installed pki-java-tools.noarch 1.0.0-1.fc9 installed pki-native-tools.i386 1.0.0-1.fc9 installed pki-ra.noarch 1.0.0-2.fc9 installed pki-ra-ui.noarch 1.0.0-1.fc9 installed pki-setup.noarch 1.0.0-2.fc9 installed pki-util.noarch 1.0.0-2.fc9 installed krb5-pkinit-openssl.i386 1.6.3-10.fc9 fedora pki-common-javadoc.noarch 1.0.0-8.fc9 pki pki-java-tools-javadoc.noarch 1.0.0-1.fc9 pki pki-kra.noarch 1.0.0-2.fc9 pki pki-kra-ui.noarch 1.0.0-2.fc9 pki pki-manage.noarch 1.0.0-1.fc9 pki pki-migrate.noarch 1.0.0-1.fc9 pki pki-ocsp.noarch 1.0.0-2.fc9 pki pki-ocsp-ui.noarch 1.0.0-1.fc9 pki pki-silent.noarch 1.0.0-1.fc9 pki pki-tks.noarch 1.0.0-2.fc9 pki pki-tks-ui.noarch 1.0.0-1.fc9 pki pki-tps.i386 1.0.0-2.fc9 pki pki-tps-ui.noarch 1.0.0-2.fc9 pki pki-util-javadoc.noarch 1.0.0-2.fc9 pki The contents of test3.csr: [root@ebbe test]# cat test3.csr Certificate request generated by Netscape certutil Phone: (not specified) Common Name: test4 Email: (not specified) Organization: (not specified) State: (not specified) Country: (not specified) -----BEGIN NEW CERTIFICATE REQUEST----- MIIBTzCBuQIBADAQMQ4wDAYDVQQDEwV0ZXN0NDCBnzANBgkqhkiG9w0BAQEFAAOB jQAwgYkCgYEA5wv8VPSNH7HH0Nsdr2/3xu3fqglDbQUz8CxhFvFHXm26a1DlyC+l pqZXCgozJzpb1N5EXDR/Wg1VVbcJNnKyvJOa4XqOqqAPFKLfH5GhAijOIIQRuLL/ WHlUeY2LUHcLCZ257b9QEOTrR6iVZPp74r2l7CBkXQ3zvx4PRfX2eY8CAwEAAaAA MA0GCSqGSIb3DQEBBQUAA4GBAB6R3Gf4koSXucYifCIFri3vTSt2ThK7GpKrYe86 JLYOTk4aNdaL/wZDNBLnnw8if8Gv2y/LcpR7Qvto52uckCA2+rRWEYmHhDs8NF6U q0HuaYaUgN1kdOqrzjGFaZxG5eSJkLnmFpKlp+9OsnNfz43v9zzeomzqSdRHpPEZ pmFM -----END NEW CERTIFICATE REQUEST----- The contents of the certificate database that's used for the CMC agent: [root@ebbe test]# certutil -L -d /root/test/cmc-agent Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CMC Agent - NetherNordic SLCS u,u,u cmc u,u,u ca c,c,c -- Jan

16 years, 1 month

5
7
0 / 0

Re: [Pki-users] failed Administrator logon

by Klaus Heyden

Hello, i've checked it, the CA is trusted (Firefox Browser). I have also the problem that the Logon with pkiconsole now crashed. The login-window came up after username/password the pkiconsole exits. Tomorrow i will look for the debug-log what happens and also uses the IE for testing. regards Klaus Heyden > -----Ursprüngliche Nachricht----- > Von: "Marc Sauton" <msauton(a)redhat.com> > Gesendet: 29.10.08 20:38:09 > An: Klaus (Allianz ASIC)" <KLAUS.HEYDEN(a)ALLIANZ.DE> > CC: pki-users(a)redhat.com > Betreff: Re: [Pki-users] failed Administrator logon > Heyden, Klaus (Allianz ASIC) wrote: > > Hello, > > > > i have the problem the the CA don't accept the Administrator login. > > Either on HTTPS-interface or via pkiconsole. It's a new installation > > and the Admin-Certificate exists in the Browser with secret key. The > > problem ist that the CA first dor thier job normal. When i now try to > > login i got a catalina error like this. i dont reconfigure the CA only > > restart. I also configured an HSM (Luna) but dont use key's inside the > > HSM. > You may want to collect the ca debug log when you try to do client auth > in your browser against the https agent pages. > Or review the debug log during the ca instance configuration, near the > key generation for the ca instance or when you selected either a > software token or hsm, for any errors. > I suppose the ca instance was restarted after the web based wizard > configuration was successfully completed. > It is always possible to use another client certificate for an agent or > admin user of the certificate system. > You may want to verify the browser has and trust the issuer of the agent > cert you try to use. > > -------------------catalina.out---------------------------------- > > Oct 29, 2008 5:43:55 PM org.apache.catalina.core.ApplicationContext log" > > INFO: caListRequests: You did not provide a valid certificate for this > > operation > > ---------------------------------------------------------------------- > > > > the debug-file shows: > > ---------------------debug---------------------------------------- > > [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet:service() > > uri = /ca/agent/header > > [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet::service() > > param name='selected' value='ca' > > [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet: caheader > > start to service. > > [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet.java: > > renderTemplate > > [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet: curDate=Wed > > Oct 29 18:15:07 CET 2008 id=caheader time=0 > > [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet:service() > > uri = /ca/agent/ca/listRequests.html > > [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet: > > caListRequests start to service. > > [29/Oct/2008:18:15:07][http-9443-Processor21]: DisplayHtmlServlet > > about to service > > [29/Oct/2008:18:15:07][http-9443-Processor21]: IP: 10.94.112.222 > > [29/Oct/2008:18:15:07][http-9443-Processor21]: AuthMgrName: > > certUserDBAuthMgr > > [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet: retrieving > > SSL certificate > > [29/Oct/2008:18:15:07][http-9443-Processor21]: > > SignedAuditEventFactory: create() > > message=[AuditEvent=AUTH_FAIL][SubjectID=$Unidentified$][Outcome=Failure][AuthMgr=$Unidentified$][AttemptedCred=$Unidentified$] > > authentication failure > > [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: getConn: mNumConns > > now 2 > > [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: > > ObjectStreamMapper:mapObjectToLDAPAttributeSet revokedCerts size=84 > > [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: > > ObjectStreamMapper:mapObjectToLDAPAttributeSet unrevokedCerts size=84 > > [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: > > ObjectStreamMapper:mapObjectToLDAPAttributeSet expiredCerts size=84 > > [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: returnConn: > > mNumConns now 3 > > ---------------------------------------------------------------------- > > > > certutil -L -d . shows me: > > ---------------------------------------------------------------------- > > Certificate Nickname Trust > > Attributes > > > > SSL,S/MIME,JAR/XPI > > ocspSigningCert cert-ca4-1 u,u,u > > subsystemCert cert-ca4-1 u,u,u > > caSigningCert cert-ca4-1 CTu,Cu,Cu > > Server-Cert cert-ca4-1 u,u,u > > Allianz Group Root CA II - Allianz Group CT,C,C > > ---------------------------------------------------------------------- > > > > > > reagards > > Klaus Heyden > > > > > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > Pki-users mailing list > > Pki-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/pki-users > > > > _______________________________________________ > Pki-users mailing list > Pki-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/pki-users > _________________________________________________________________________ In 5 Schritten zur eigenen Homepage. Jetzt Domain sichern und gestalten! Nur 3,99 EUR/Monat! http://www.maildomain.web.de/?mc=021114

16 years, 1 month

2
1
0 / 0

failed Administrator logon

by Heyden, Klaus (Allianz ASIC)

Hello, i have the problem the the CA don't accept the Administrator login. Either on HTTPS-interface or via pkiconsole. It's a new installation and the Admin-Certificate exists in the Browser with secret key. The problem ist that the CA first dor thier job normal. When i now try to login i got a catalina error like this. i dont reconfigure the CA only restart. I also configured an HSM (Luna) but dont use key's inside the HSM. -------------------catalina.out---------------------------------- Oct 29, 2008 5:43:55 PM org.apache.catalina.core.ApplicationContext log" INFO: caListRequests: You did not provide a valid certificate for this operation ---------------------------------------------------------------------- the debug-file shows: ---------------------debug---------------------------------------- [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet:service() uri = /ca/agent/header [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet::service() param name='selected' value='ca' [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet: caheader start to service. [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet.java: renderTemplate [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet: curDate=Wed Oct 29 18:15:07 CET 2008 id=caheader time=0 [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet:service() uri = /ca/agent/ca/listRequests.html [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet: caListRequests start to service. [29/Oct/2008:18:15:07][http-9443-Processor21]: DisplayHtmlServlet about to service [29/Oct/2008:18:15:07][http-9443-Processor21]: IP: 10.94.112.222 [29/Oct/2008:18:15:07][http-9443-Processor21]: AuthMgrName: certUserDBAuthMgr [29/Oct/2008:18:15:07][http-9443-Processor21]: CMSServlet: retrieving SSL certificate [29/Oct/2008:18:15:07][http-9443-Processor21]: SignedAuditEventFactory: create() message=[AuditEvent=AUTH_FAIL][SubjectID=$Unidentified$][Outcome=Failure][AuthMgr=$Unidentified$][AttemptedCred=$Unidentified$] authentication failure [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: getConn: mNumConns now 2 [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: ObjectStreamMapper:mapObjectToLDAPAttributeSet revokedCerts size=84 [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: ObjectStreamMapper:mapObjectToLDAPAttributeSet unrevokedCerts size=84 [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: ObjectStreamMapper:mapObjectToLDAPAttributeSet expiredCerts size=84 [29/Oct/2008:18:15:08][CRLIssuingPoint-MasterCRL]: returnConn: mNumConns now 3 ---------------------------------------------------------------------- certutil -L -d . shows me: ---------------------------------------------------------------------- Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI ocspSigningCert cert-ca4-1 u,u,u subsystemCert cert-ca4-1 u,u,u caSigningCert cert-ca4-1 CTu,Cu,Cu Server-Cert cert-ca4-1 u,u,u Allianz Group Root CA II - Allianz Group CT,C,C ---------------------------------------------------------------------- reagards Klaus Heyden

16 years, 1 month

2
1
0 / 0

Failure to clone a CA

by Klaus Heyden

Hello, i've found that the replication in the directory server was incorrect. The Master Server say's that there is a duplicate Replica ID. But there is no other replication configured ?

16 years, 1 month

3
4
0 / 0

Cannot write to MasterCRL at CA startup

by Adewumi, Julius-p99373

Is anyone familiar with this problem: I configured Ldap-Publishing on Friday and after the weekend, Whenever the CA attempts to publish into tne MasterCRL it couldn't and also The Directory Server dies. This is Redhat Dirsrv. Anyone aware of a fix for this? Julius

16 years, 2 months

2
4
0 / 0

Failure to clone a CA

by Klaus Heyden

Hello, I've got a Problem at the Cloning of a CA. At the Web GUI when I import the CA Certificate file (savepkcs12) the WebGui showed me an error like "PKI not active" In the debug-file there are the following entries: [20/Oct/2008:18:32:11][http-9443-Processor21]: WizardServlet: process [20/Oct/2008:18:32:11][http-9443-Processor21]: WizardServlet:serice() uri = /ca/admin/console/config/wizard [20/Oct/2008:18:32:11][http-9443-Processor21]: CMSServlet::service() param name='password' value='xxxxxxxx' [20/Oct/2008:18:32:11][http-9443-Processor21]: CMSServlet::service() param name='path' value='/tmp/savepkcs12' [20/Oct/2008:18:32:11][http-9443-Processor21]: CMSServlet::service() param name='p' value='5' [20/Oct/2008:18:32:11][http-9443-Processor21]: CMSServlet::service() param name='op' value='next' [20/Oct/2008:18:32:11][http-9443-Processor21]: WizardServlet: op=next [20/Oct/2008:18:32:11][http-9443-Processor21]: WizardServlet: size=19 [20/Oct/2008:18:32:11][http-9443-Processor21]: WizardServlet: in next 5 [20/Oct/2008:18:32:11][http-9443-Processor21]: RestoreKeyCertPanel: this is the clone subsystem [20/Oct/2008:18:32:11][http-9443-Processor21]: RestoreKeyCertPanel update: clone does not have all the certificates. [20/Oct/2008:18:32:11][http-9443-Processor21]: panel no=5 [20/Oct/2008:18:32:11][http-9443-Processor21]: panel name=restorekeys [20/Oct/2008:18:32:11][http-9443-Processor21]: total number of panels=19 I have bypass it by importing the Certificates with the pk12util at the same time. What can be the Problem because of not reading the file. The contains all necessary certificate (CA, Subsystem and OCSP). This was the export file of the generation of the first instance. The next Problem which I can't avoid, is that the Clone can't finish the LDAP configuration. The Debug-File shows the following: [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel createChangeLog: Changelog entry has already used [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel enableReplication: replicadn: cn=replica,cn="dc=linux1.tampam.de-ca-master",cn=mapping tree,cn=config [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel enableReplication: Successfully create cn=replica,cn="dc=linux1.tampam.de-ca-master",cn=mapping tree,cn=config entry. [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel enableReplication: replicadn: cn=replica,cn="dc=linux1.tampam.de-ca-master",cn=mapping tree,cn=config [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel enableReplication: Successfully create cn=replica,cn="dc=linux1.tampam.de-ca-master",cn=mapping tree,cn=config entry. [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel setupReplication: Finished enabling replication [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel createReplicationAgreement: dn: cn=masterAgreement1-linux2.tampam.de-ca-clone2,cn=replica,cn="dc=linux1.tamp am.de-ca-master",cn=mapping tree,cn=config [20/Oct/2008:19:23:51][http-9443-Processor19]: About to set description attr to masterAgreement1-linux2.tampam.de-ca-clone2 [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel createReplicationAgreement: Successfully create replication agreement masterAgreement1-linux2.tampam.de-ca-clone2 [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel createReplicationAgreement: dn: cn=cloneAgreement1-linux2.tampam.de-ca-clone2,cn=replica,cn="dc=linux1.tampa m.de-ca-master",cn=mapping tree,cn=config [20/Oct/2008:19:23:51][http-9443-Processor19]: About to set description attr to cloneAgreement1-linux2.tampam.de-ca-clone2 [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel createReplicationAgreement: Successfully create replication agreement cloneAgreement1-linux2.tampam.de-ca-clone2 [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel initializeConsumer: initializeConsumer dn: cn=masterAgreement1-linux2.tampam.de-ca-clone2,cn=replica,cn="dc=linux1.tamp am.de-ca-master",cn=mapping tree,cn=config [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel initializeConsumer: initializeConsumer host: linux1.tampam.de port: 389 [20/Oct/2008:19:23:51][http-9443-Processor19]: DatabasePanel initializeConsumer: start modifying [20/Oct/2008:19:23:52][http-9443-Processor19]: DatabasePanel initializeConsumer: Finish modification. [20/Oct/2008:19:23:52][http-9443-Processor19]: DatabasePanel initializeConsumer: thread sleeping for 5 seconds. [20/Oct/2008:19:23:57][http-9443-Processor19]: DatabasePanel initializeConsumer: finish sleeping. [20/Oct/2008:19:23:57][http-9443-Processor19]: DatabasePanel initializeConsumer: Successfully initialize consumer [20/Oct/2008:19:23:57][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries checking ou=people,dc=linux1.tampam.de-ca-master [20/Oct/2008:19:23:57][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries ou=people,dc=linux1.tampam.de-ca-master not found, let's wait! [20/Oct/2008:19:24:02][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries checking ou=people,dc=linux1.tampam.de-ca-master [20/Oct/2008:19:24:02][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries ou=people,dc=linux1.tampam.de-ca-master not found, let's wait! [20/Oct/2008:19:24:07][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries checking ou=people,dc=linux1.tampam.de-ca-master [20/Oct/2008:19:24:07][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries ou=people,dc=linux1.tampam.de-ca-master not found, let's wait! [20/Oct/2008:19:24:13][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries checking ou=people,dc=linux1.tampam.de-ca-master [20/Oct/2008:19:24:13][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries ou=people,dc=linux1.tampam.de-ca-master not found, let's wait! [20/Oct/2008:19:24:18][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries checking ou=people,dc=linux1.tampam.de-ca-master [20/Oct/2008:19:24:18][http-9443-Processor19]: DatabasePanel comparetAndWaitEntries ou=people,dc=linux1.tampam.de-ca-master not found, let's wait! etc. at the last entries it repeats ever 5 seconds and the WebGUI "Internal Database" stops there waiting.. Perhaps some can help me Regard Klaus Heyden

16 years, 2 months

2
2
0 / 0

TPS --- index.cgi not interpreted by Firefox

by Adewumi, Julius-p99373

Firefox couldn't interprete cgi-bin/home/index.cgi script when attempting to Configure Phone Home feature of TPS. It displayed the text with comment: "This XML file does not appear to have any style information associated with it. The document tree is shown below: <?xml version="1.0" encoding="UTF-8" ?> - <> <ServiceInfo> <IssuerName>Red Hat, Inc.</IssuerName> - <> <Services> <Operation>http://example.com:7888/nk_service</Operation> <UI>http://example.com:7888/cgi-bin/home/enroll.cgi</UI> <EnrolledTokenBrowserURL>http://www.redhat.com</EnrolledTokenBrowserURL> <EnrolledTokenURL /> <TokenType>userKey</TokenType> </Services> </ServiceInfo> Can someone point me in the right direction please. Julius

16 years, 2 months

2
1
0 / 0

Failure to start pki-tps under Fedora9-Live

by Ebbe Hansen

Installed Fedora9-Live (downloaded 8-14-08) on harddisk. Loaded and installed DogTag packages pki-ca, pki-kra, pki-ocsp, pki-tks successfully. However, pki-tps fails to start. Attached error_log indicates "Unknown cipher ecdhe_ecdsa_aes_256_sha". Are there additional "cipher" modules to be installed? Ebbe Hansen @ SPYRUS

16 years, 2 months

1
0
0 / 0

Certificate Authority fixes

by Adewumi, Julius-p99373

FYI only: About RedHat Certificate Systems 7.3 I was having problems configuring DRM, TKS etc after CA was configured. Problems like Error Code SEC_ERROR_REUSED_ISSUER_AND_SERIAL, and in the logfile of CA: CASigningUnit: Object not found. Error org.mozilla.jss.crypto ObjectNotFoundException. I decided to go to redhat.com and download all pertinent patches and updates in their "erratta". Both for firefox browser being used and for CA. After the installs and upgrades, I was able to smoothly create new instances and configure the Subsystems DRM, TKS, TPS. So, the lesson I learn: don't bet on the CD you are delivered, new updates and fixes could be online within weeks after the CD was shipped in this business. Thanks RedHat. Julius Adewumi

16 years, 2 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Pki-users October 2008