April 2014 - Pki-users - Dogtag PKI List Archives

base64 CMC Request format
by Elliott William C OSS sIT 13 Jul '16

13 Jul '16

Hi all, Can Dogtag (in this case v. 9.0.3-30.el6 ) be coerced into accepting base64-encoded CMC requests? Is there a parameter somewhere? Or would it require reprogramming? We have a (smart-)card management system (runs under Windows) which sends the requests and expects the responses to both be base64 encoded. Thanks and best regards, William Elliott s IT Solutions Open System Services

4 6

Backward Compatibility discussion meeting result
by Christina Fu 23 Apr '14

23 Apr '14

http://pki.fedoraproject.org/wiki/Dogtag_Future_Directions#Backward_Compati…

1 0

Setting up a CA for the first time: Import CA's Certificate Chain
by Sam Fakhreddine 09 Apr '14

09 Apr '14

Hello, I have setup my CA and was going through the CA setup wizard. However when I get to: Import CA's Certificate Chain part of the wizard, it just SPINS in Chrome and throws a 1b6 error in Internet explorer. Are there any work arounds? Sam Fakhreddine Site Systems Administrator Ledcor Industries Inc., Information Services 7008 Roper Road NW, Edmnoton, AB T6B 3H2 p 780-395-5455 | c 780-996-0763 www.ledcor.com<http://www.ledcor.com> FORWARD. TOGETHER.

1 0

Disable the cipher RC4 for the web interface
by Thibaut Pouzet 04 Apr '14

04 Apr '14

Hi, I am currently using pki-ca v9.0.3-32 with FreeIPA v3.0.0.-37 on a CentOS 6.5 machine. I am scanning my internal networks in order to find vulnerabilities, and trying to fix anything I find. I have found that the HTTPS pki-ca administration interfaces listening on ports 9444 and 9445 were accepting what might be considered as weak ciphers (RC4) for data encryption. I removed those ciphers from /etc/pki-ca/server.xml, and then restarded the daemon, but this had no effects whatsoever on the ciphers availables on these SSL ports. I searched a bit around /etc/pki-ca/ and /var/lib/pki-ca/ but could not find where to make my changes in order to disable RC4 ciphers for those administration interfaces. I also searched on the Internet & asked on the IRC channel about this issue, with no succes, so here I am. Has anyone already found a way to do this ? Regards, -- Thibaut Pouzet

3 7

Dangling jss4.jar symlink on Fedora 20, pkispawn aborts on ipa-server-install
by e-s-g-r＠t-online.de 02 Apr '14

02 Apr '14

Hi, I recently tried to install a testing version of freeipa on fedora 20 and ran into the exact same problem as described here https://bugzilla.redhat.com/show_bug.cgi?id=919476 and https://bugzilla.redhat.com/show_bug.cgi?id=974535 that should (as far as I understand it) already have been solved. What is the best way to fix that manually? The installed versions are: dogtag-pki-server-theme.noarch 10.1.1-1.fc20 @updates-testing pki-server.noarch 10.1.1-1.fc20 @updates-testing Regards ---------------------------------------------------------------- Speicherplatz voll? Spam im Postfach? Jetzt E-Mail-Adresse @t-online.de sichern und sofort sorgenfrei kommunizieren. www.t-online.de/email-kostenlos

2 1

Announcing the release of Dogtag 10.1.1
by Matthew Harmsen 01 Apr '14

01 Apr '14

The Dogtag team is proud to announce the first errata build for Dogtag 10.1. Builds are available for Fedora 20. == Build Versions == dogtag-pki-10.1.1-1 dogtag-pki-theme-10.1.1-1 pki-console-10.1.1-1 pki-core-10.1.1-1 pki-ra-10.1.1-1 pki-tps-10.1.1-1 == Upgrade Notes == Simply use yum to update existing packages. == Highlights since Dogtag 10.1.0 == * This errata fixes four issues found in Dogtag 10.1.0: * PKI TRAC Ticket #840 - pkispawn requires policycoreutils-python Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python Added this runtime dependency to the pki-core package. * PKI TRAC Ticket #868 - REST API get certs links missing segment Fixed links to generate proper URLs (attempted to future-proof this to avoid any issues that might be caused by future re-factoring). * PKI TRAC Ticket #869 - f19 ipa-server-install fails at step 6/22 of cert sys install - systemctl start pki-tomcatd.target fails Fixed problem by adding a 'daemon-reload' method and calling it prior to starting the 'pki-tomcatd' target. * PKI TRAC Ticket #816 - pki-tomcat cannot be started after installation of ipa replica with ca IPA replica installation was failing due to encoding errors when generating the SSL server certificate. To avoid these errors, Dogtag CA clones were fixed by requiring that their SSL server certificates mustalways be signed by the associated Dogtag CA master. == Detailed Changes since Dogtag 10.1.0 == alee(1): #868 REST API get certs links missing segment cfu(1): #816 Sign CA clone sslserver certificate using CA master mharmsen(2): #840 pkispawn requires policycoreutils-python #869 Added 'daemon-reload' method

1 0

Announcing the release of Dogtag 10.0.7
by Matthew Harmsen 01 Apr '14

01 Apr '14

The Dogtag team is proud to announce the seventh errata build for Dogtag 10.0. Builds are available for Fedora 19. == Build Versions == dogtag-pki-10.0.7-1 dogtag-pki-theme-10.0.7-1 pki-console-10.0.7-1 pki-core-10.0.7-1 pki-ra-10.0.7-1 pki-tps-10.0.7-1 == Upgrade Notes == Simply use yum to update existing packages. == Highlights since Dogtag 10.0.6 == * This errata fixes three bugs found in Dogtag 10.0.6: * PKI TRAC Ticket #803 - avc generated for useradd in pkispawn scripts Fixed so that useradd does not generate an AVC by closing file descriptors prior to invoking useradd. * PKI TRAC Ticket #868 - REST API get certs links missing segment Fixed links to generate proper URLs (attempted to future-proof this to avoid any issues that might be caused by future re-factoring). * PKI TRAC Ticket #869 - f19 ipa-server-install fails at step 6/22 of cert sys install - systemctl start pki-tomcatd.target fails Fixed problem by adding a 'daemon-reload' method and calling it prior to starting the 'pki-tomcatd' target. == Detailed Changes since Dogtag 10.0.6 == alee (2): #743 Fixed useradd in pkispawn to not generate AVC #868 REST API get certs links missing segment mharmsen(1): #869 Added 'daemon-reload' method

1 0