December 2009 - Pki-users - Dogtag Pki List Archives

Re: [Pki-users] Tpsclient - error enrolling token generated keys

by John Magne

Try setting the following CS.cfg parameter as a workaround: general.verifyProof=0 ----- Original Message ----- From: "Alan Mikolajczuk" <Alan.Mikolajczuk(a)gdc4s.com> To: pki-users(a)redhat.com Sent: Monday, December 21, 2009 11:56:02 AM GMT -08:00 US/Canada Pacific Subject: [Pki-users] Tpsclient - error enrolling token generated keys Tpsclient - error enrolling token generated keys All, I have CS 8.0 GA installed and I am trying to use the tpsclient tool for testing the TPS. When enrolling a user there are 2 keys, (signing and ID) generated on the card and the encryption key is generated server side. When the tpsclient enrollment is complete it states "Success - Operation 'ra_enroll' Success". But looking into the tps-error log it states that: [2009-12-21 11:41:01] a6b19c50 CertEnroll::verifyProof - VFY_CreateContext() failed [2009-12-21 11:41:01] a6b19c50 CertEnroll::ParsePublicKeyBlob - verify proof failed [2009-12-21 11:41:01] a6b19c50 RA_Enroll_Processor::DoEnrollment - Failed to parse public key [2009-12-21 11:41:01] a6b19c50 CertEnroll::verifyProof - VFY_CreateContext() failed [2009-12-21 11:41:01] a6b19c50 CertEnroll::ParsePublicKeyBlob - verify proof failed [2009-12-21 11:41:01] a6b19c50 RA_Enroll_Processor::DoEnrollment - Failed to parse public key These errors are not seen when enrolling with a SafeNet 330J. My tpsclint script is below. Is there are way to use the tpsclient and have keys generated on the fake token verified successfully? op=var_set name=ra_host value=tps op=var_set name=ra_port value=7888 op=var_set name=ra_uri value=/nk_service op=token_set cuid=00000000000000000003 op=token_set msn=01020304 op=token_set app_ver=499dc06c op=token_set key_info=0101 op=token_set major_ver=1 op=token_set minor_ver=4 op=token_set auth_key=404142434445464748494a4b4c4d4e4f op=token_set mac_key=404142434445464748494a4b4c4d4e4f op=token_set kek_key=404142434445464748494a4b4c4d4e4f op=ra_enroll uid=frederick.c.meyer pwd=aixAeiYZnhhnbzBB num_threads=1 new_pin=not4long keygen=true op=exit Thanks, Alan Mikolajczuk _______________________________________________ Pki-users mailing list Pki-users(a)redhat.com https://www.redhat.com/mailman/listinfo/pki-users

13 years, 9 months

1
0
0 / 0

Tpsclient - error enrolling token generated keys

by Mikolajczuk, Alan

All, I have CS 8.0 GA installed and I am trying to use the tpsclient tool for testing the TPS. When enrolling a user there are 2 keys, (signing and ID) generated on the card and the encryption key is generated server side. When the tpsclient enrollment is complete it states "Success - Operation 'ra_enroll' Success". But looking into the tps-error log it states that: [2009-12-21 11:41:01] a6b19c50 CertEnroll::verifyProof - VFY_CreateContext() failed [2009-12-21 11:41:01] a6b19c50 CertEnroll::ParsePublicKeyBlob - verify proof failed [2009-12-21 11:41:01] a6b19c50 RA_Enroll_Processor::DoEnrollment - Failed to parse public key [2009-12-21 11:41:01] a6b19c50 CertEnroll::verifyProof - VFY_CreateContext() failed [2009-12-21 11:41:01] a6b19c50 CertEnroll::ParsePublicKeyBlob - verify proof failed [2009-12-21 11:41:01] a6b19c50 RA_Enroll_Processor::DoEnrollment - Failed to parse public key These errors are not seen when enrolling with a SafeNet 330J. My tpsclint script is below. Is there are way to use the tpsclient and have keys generated on the fake token verified successfully? op=var_set name=ra_host value=tps op=var_set name=ra_port value=7888 op=var_set name=ra_uri value=/nk_service op=token_set cuid=00000000000000000003 op=token_set msn=01020304 op=token_set app_ver=499dc06c op=token_set key_info=0101 op=token_set major_ver=1 op=token_set minor_ver=4 op=token_set auth_key=404142434445464748494a4b4c4d4e4f op=token_set mac_key=404142434445464748494a4b4c4d4e4f op=token_set kek_key=404142434445464748494a4b4c4d4e4f op=ra_enroll uid=frederick.c.meyer pwd=aixAeiYZnhhnbzBB num_threads=1 new_pin=not4long keygen=true op=exit Thanks, Alan Mikolajczuk

13 years, 9 months

1
0
0 / 0

Problem with install RA (pki-ra)

by Rafał Kamiński

Hi all, I installed two Fedora and two pki-ca. Pki-ca works great, and pki-ca1 which is clone on pki-ca works great two. Now I want to install pki-ra to use it with pki-ca1. Installation is compleat, but i have problem with configuration. First site - click Next. Second site - Join an Existing Security Domain and write https://pki-ca1:9445. Click Next. Third site - show me Certificate Chain. Click Next. And I see: --- Internal Server Error The server encountered an internal error or misconfiguration and was unable to complete your request. Please contact the server administrator, you(a)example.com and inform them of the time the error occurred, and anything you might have done that may have caused the error. More information about this error may be available in the server error log. --- And in pki-ra.log: --- [Tue Dec 01 05:36:08 2009] [error] [client 192.168.6.243] Could not find httpd.xml in /usr/sbin/ at /var/lib/pki-ra/lib/perl/PKI/RA/DisplayCertChainPanel.pm line 228\n, referer: https://ra.vpn.ca:12890/ra/admin/console/config/wizard --- I can't find anywhere that file - httpd.xml Can somebody help me? Why does it happens? Br, Rafal K

13 years, 9 months

5
10
0 / 0

Dogtag autoenrollment from an embedded Linux device

by Craig Zeller - SysAdmin

We have been testing pki-ra-1.2.0-2 on Fedora 11 via SSCEP as a possible solution. Our problem is that we need to be able to automatically deploy certificates to thousands of embedded Linux devices, each equipped with a common initial shared-secret or cert. Each needs to be able to enroll, recover an initial individual cert based on the system's serial number, and renew the cert... all over a dial-up connection. SSCEP seems to be falling out of the solution based on the requirement for one-time PINs and manual approval of the requests. Although the web interface works beautifully, we can't seem to get SSCEP working. We've looked at the CMCEnroll tool, but that requires Java which is not part of the embedded software. This is an embedded flash rom based system that does not have the memory available. Any suggestions? I'd hate to have to cave-in to those that want a Microsoft solution. Craig Zeller <czeller(a)sjm.com> This communication, including any attachments, may contain information that is proprietary, privileged, confidential or legally exempt from disclosure. If you are not a named addressee, you are hereby notified that you are not authorized to read, print, retain a copy of or disseminate any portion of this communication without the consent of the sender and that doing so may be unlawful. If you have received this communication in error, please immediately notify the sender via return e-mail and delete it from your system.

13 years, 9 months

4
3
0 / 0

Notification of "pki.fedoraproject.org" downtime . . .

by Matthew Harmsen

========================================== NOTICE OF 'pki.fedoraproject.org' DOWNTIME ========================================== This outage will begin at 5:30am MST on 12/12. Every effort will be taken to minimize downtime. Please note that 'pki.fedoraproject.org' will be back online no later than 5pm on 12/13, although if all goes as planned 'pki.fedoraproject.org' should be online before the evening of 12/12.

13 years, 9 months

1
0
0 / 0

Re: [Pki-users] Centos Repo PKI

by Kashyap Chamarthy

On 12/08/2009 03:07 PM, Rafał Kamiński wrote: >> For instance, to configure RA successfully(assuming you already have >> CA up and running), see here >> http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configuri... > > > Nice Tutorial! > > But ... when I configure on Fedora RA, after I "Join an Existing > Security Domain" I see: > > --CUT-- > Internal Server Error > > The server encountered an internal error or misconfiguration and was > unable to complete your request. > > Please contact the server administrator, you(a)example.com and inform them > of the time the error occurred, and anything you might have done that > may have caused the error. > > More information about this error may be available in the server error log. check in your RA error and debug logs, if there is anything interesting. location( if your RA instance name is pki-ra) error log: /var/lib/pki-ra/error_log debug log: /var/lib/pki-ra/debug /kashyap > --END-- > > Because I want to install PKI-RA on Centos to check is that problem > exist on Centos - which I have on Fedora. > > BR, > > Rafal Kaminski - Kamyk > >

13 years, 9 months

2
1
0 / 0

Centos Repo PKI

by Rafał Kamiński

Hello all, I have one questions - can somebody write me good Centos Repo? Where is package pki (dogtag)? I found to Fedora but not to Centos. I try use that Fedora packages, but it didn't work :( I have Centos 5.4 and 5.3 BR, Rafal Kaminski - Kamyk

13 years, 9 months

2
1
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Pki-users December 2009