DogTAG PKI - crlDistributionPoints cert profile: Type_0 : URIName error
by Frederic d'Huart
Hello Pki users,
Section B.1.4. of the RH admin guide refers to the following acceptable
values
for crlDistributionPoint Type:
DirectoryName
URIName
RelativeToIssuer
Using PKIConsole, I have added to the caUserCert profile a policy for
include a CDP as follow:
policyset.userCertSet.13.default.name=CRL Distribution Points Extension
Default
policyset.userCertSet.13.default.params.crlDistPointsCritical=false
policyset.userCertSet.13.default.params.crlDistPointsEnable_0=true
policyset.userCertSet.13.default.params.crlDistPointsPointType_0=URIName
policyset.userCertSet.13.default.params.crlDistPointsPointName_0=http://xxx.xxx.xxx/crl/xxx.crl
policyset.userCertSet.13.default.params.crlDistPointsReasons_0=
after profile re-activated, and new request generated, I get the
following error on the agent interface:
The Certificate System has encountered an unrecoverable error.
Error Message:
/java.lang.ClassCastException: netscape.security.x509.Extension cannot
be cast to netscape.security.x509.CRLDistributionPointsExtension/
Please contact your local administrator for assistance.
Any Ideas what could be wrong ?
Thank you.
13 years, 2 months
Re: [Pki-users] Rotating debug logs.
by Jerry McCarthy
Replying to my own post for others edification.
I changed the logrotate to:
/var/log/pki-ca/debug /var/log/pki-kra/debug /var/log/pki-ocsp/debug
/var/log/pki-ra/debug {
copytruncate
weekly
rotate 5
notifempty
missingok
}
And now my logs are rotating fine.
Regards,
Jerry McCarthy
CPMG
-----Original Message-----
From: Jerry McCarthy [mailto:jerry@cpmg.com]
Sent: Sunday, October 03, 2010 12:12 PM
To: 'pki-users(a)redhat.com'
Subject: Rotating debug logs.
Some of my debug logs (/var/log/pki-*/debug) are getting large. I tried
adding:
/var/log/pki-ca/debug /var/log/pki-kra/debug /var/log/pki-ocsp/debug
/var/log/pki-ra/debug {
weekly
rotate 5
notifempty
missingok
}
To /etc/logrotate.d But that didn't appear to do anything. Can anybody give
me some suggestions as to how to setup the debug logs for auto rotation?
Regards,
Jerry McCarthy
CPMG
13 years, 6 months
PKI Console - Publishing Acl Error
by Frederic d'Huart
Hello Pki Users,
I have an problem to access the DogTAG Publishing tab of the PKIConsole.
I want to enable a new CRL File publishing object as described into the
section 8.2.1 of the admin guide.
but I receive the error "You are not allowed to perform this operation"
anytime I'm trying to access the
publishing tab and subObjects.
The ca_log show this error
___
/var/log/pki-ca/debug
[10/Oct/2010:11:06:52][http-9445-Processor24]:
LdapBoundConnFactory.java:391:returnConn() returnConn: mNumConns now 3
[10/Oct/2010:11:06:52][http-9445-Processor24]:
AAclAuthz.java:643:evaluateExpressions() evaluated expression:
group="Registration Manager Agents" to be true
[10/Oct/2010:11:06:52][http-9445-Processor24]:
SignedAuditEventFactory.java:78:create() SignedAuditEventFactory:
create()
message=[AuditEvent=AUTHZ_FAIL][SubjectID=admin][Outcome=Failure][aclResource=<null>][Op=<null>]
authorization failure
[10/Oct/2010:11:06:52][http-9445-Processor24]:
LdapBoundConnFactory.java:343:getConn() getConn: mNumConns now 2
[10/Oct/2010:11:06:52][http-9445-Processor24]:
LdapBoundConnFactory.java:391:returnConn() returnConn: mNumConns now 3
[10/Oct/2010:11:06:52][http-9445-Processor24]:
SignedAuditEventFactory.java:78:create() SignedAuditEventFactory:
create()
message=[AuditEvent=ROLE_ASSUME][SubjectID=admin][Outcome=Failure][Role=Certificate
Manager Agents, Registration Manager Agents, Trusted Managers,
Administrators, Security Domain Administrators, Enterprise CA
Administrators, Enterprise KRA Administrators, Enterprise OCSP
Administrators, Enterprise TKS Administrators, Enterprise RA
Administrators, Enterprise TPS Administrators] assume privileged role
I have checked everywhere in the PKIConsole ACL's tab, but I didn't find
anything ...
Does somebody would have an idea how to fix it ?
Thank you ..
13 years, 6 months
Rotating debug logs.
by Jerry McCarthy
Some of my debug logs (/var/log/pki-*/debug) are getting large. I tried
adding:
/var/log/pki-ca/debug /var/log/pki-kra/debug /var/log/pki-ocsp/debug
/var/log/pki-ra/debug {
weekly
rotate 5
notifempty
missingok
}
To /etc/logrotate.d But that didn't appear to do anything. Can anybody give
me some suggestions as to how to setup the debug logs for auto rotation?
Regards,
Jerry McCarthy
CPMG
13 years, 6 months
how to use remote LDAP user auth with dogtag CA/RA?
by James Kinney
I would like to use a remote ldap connection for user authentication at
the CA for user certs. However, the ldap in use requires non-anonymous
bind connections and the UidPwdDirAuth plugin does not provide for any
connection type other than anonymous.
There is a UidPwdPinDirAuth plugin that does provide binddn fields but
that seems to not use them since the autotest that happens only returns
an error from the server "connections failed. Anonymous connections not
allowed" (or something similar).
--
James "Jim" Kinney
(404) 407-7967
GTRI
13 years, 7 months
