May 2014 - Pki-users - Dogtag PKI List Archives

base64 CMC Request format
by Elliott William C OSS sIT 13 Jul '16

13 Jul '16

Hi all, Can Dogtag (in this case v. 9.0.3-30.el6 ) be coerced into accepting base64-encoded CMC requests? Is there a parameter somewhere? Or would it require reprogramming? We have a (smart-)card management system (runs under Windows) which sends the requests and expects the responses to both be base64 encoded. Thanks and best regards, William Elliott s IT Solutions Open System Services

4 6

Enable next update with CA built-in responder?
by Jamil Nimeh 29 May '14

29 May '14

Hello all, I have a Dogtag 9.0.20 system where I've been playing around with the built-in OCSP responder and have been unable to find the right setting in CS.cfg to enable the nextUpdate field in OCSP responses. I see docs that cover how to do it via console and CS.cfg for the stand-alone OCSP responder, but similar settings (or variants on it) in the CA's CS.cfg don't seem to have any effect. Does the CA's built-in responder have tunables similar to the stand-alone responder - in particular something like the ocsp.store.defStore.inclueNextUpdate parameter? Thank you, Jamil Nimeh

1 0

How to generate cert from command line...
by Ricardo Alexander Perez Ricardez 23 May '14

23 May '14

Hi, I'm trying to create a certificate to install in my apache server or Internet Information Service, I follow the steps in this direction URL: http://pki.fedoraproject.org/wiki/Apache_Cert_Enrollment Some simple steps are listed here on how to proceed to enroll a server certificate for an apache webserver with Dogtag. STEP ONE: Generate a Key/CSR: openssl genrsa -des3 -out www.mydomain.com.key 1024 openssl req -new -key www.mydomain.com.key -out www.mydomain.com.csr Fill out all the prompts here including CountryName,State,Locality,Organization Name, Organizational Unit Name, Common Name. Sample CSR from the above commands: -----BEGIN CERTIFICATE REQUEST----- MIIBqDCCARECAQAwaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEx FTATBgNVBAcTDE1vdW50YWluVmlldzEPMA0GA1UEChMGUmVkSGF0MQwwCgYDVQQL EwNJRE0xDjAMBgNVBAMTBWEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB gQDMbwtFUZNzlfWRI19nuxKsbhJ1/5A/rrXQkH7+K1uqxmzytm6b57lkGK9YUC7B qSKpJ4zzOnVqwRZsE9oJ5CSv+eQUie1NTz4KEL9ZOsN4p2zn0JFaKqze/vxZ3Rux BKnAz34KxOKZxGTiychOTytWS6V4lDzKBvgTgf0EZfOcfwIDAQABoAAwDQYJKoZI hvcNAQEEBQADgYEAxRGViyX5MxedhfSOja3XmvCcTOZL+btT7u4zztGBz71qSGhz yLcFCHCOMngsfiHxySBUIjZdGAOjrwcwT04ig/C2TE8mTamDp7d8/zQ6k9De/9Dp Q+C7PZuTYQkDf417IxbalEWhhNQ2AE6pMxfWwWAhjP1jAFLdKQZtEVNG9AQ= -----END CERTIFICATE REQUEST----- STEP TWO: Submit this CSR to the "Server Certificate Enrollment" profile of the Dogtag CA and get it approved. STEP THREE: Download the Cert and the CA and get them installed in apache. I have problems in step three, when I click on the option "Import Your Certificate" from the web console Dogtag Certificate Manager, I receive the following message: "This certificate cannot staff be installed Because you do not own the Corresponding private key" Searching in google I found this: When I try to download my issued certificate, I get an “Accept in PKCS7” error message. If you are getting the “Error in accept PKCS7″ message that means that the Microsoft OS/Internet Explorer cannot find the private key(s) for those certificates. (Please note that this does not necessarily mean that the private key(s) are not there, just that the MS system cannot find them.) This happens because: - the request was done under a different log-in profile (you are logged on under a different username/password) than when the request was made - or the request was made with a different browser (for example, Firefox) - or the request was made on a different computer than the one you are trying to import it on - or something was done to the machine (like an update to the operating system - a Windows update, profile change, computer re-imaged, etc.) You will only be able to import the issued certificate onto the same computer, same log-in profile, and using the same web browser as when you made the on-line request. (i.e. as when you got the “Print this form” web page). Well now!, I have the certificate in Base 64 format, Dogtag console shows me the following information: Installing this certificate in a server The Following format can be used to install this certificate into a server. Base 64 encoded certificate In this picture I deleted some lines deliberately, but my certificate is complete. Base 64 encoded certificate with CA certificate chain in pkcs7 format In this picture I deleted some lines deliberately, but my certificate is complete. Well now!, what I do with this information?, How I generated my certificate with this plane format? Since in my web browser from the console does not allow me to import the certificate. How I can generate my certificate from the command line? How I can generate my certificates in .cer, .crt, .pfx, .p12? What format should I use?

2 1

Java Crypto Libraries and CMC
by Elliott William C OSS sIT 22 May '14

22 May '14

Hello, Could someone recommend Java libraries for creating CMC Requests? I'm not a programmer, but it doesn't look as if JCE provides the necessary tools. The only one I found that might is Bouncy Castle - it does CMS, but I'm not sure if it's enough to form CMC requests. Can agent authenticated CMC enrollment in Dogtag support more than one certificate profile? Could the CMC servlet be "duplicated" and renamed in the web.xml and connected to a second certificate profile? Thanks in advance for any tips! best regards, William Elliott s IT Solutions Open System Services s IT Solutions AT Spardat GmbH mailto:william.elliott@s-itsolutions.at www.s-itsolutions.com<http://www.s-itsolutions.com/> Head Office: Vienna Commercial Register No.: 152289f Commercial Court of Vienna This message and any attached files are confidential and intended solely for the addressee(s). Any publication, transmission or other use of the information by a person or entity other than the intended addressee is prohibited. If you receive this in error please contact the sender and delete the material. The sender does not accept liability for any errors or omissions as a result of the transmission.

3 5

Sorry, your request is not submitted. The reason is "invalid request".
by Ricardo Alexander Perez Ricardez 21 May '14

21 May '14

Hi, I try to create a certificate by following these steps: Some simple steps are listed here on how to proceed to enroll a server certificate for an apache webserver with Dogtag. * Generate a Key/CSR: o openssl genrsa -des3 -out www.mydomain.com.key 1024 o openssl req -new -key www.mydomain.com.key -out www.mydomain.com.csr § Fill out all the prompts here including CountryName,State,Locality,Organization Name, Organizational Unit Name, Common Name. * Sample CSR from the above commands: -----BEGIN CERTIFICATE REQUEST----- MIIBqDCCARECAQAwaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEx FTATBgNVBAcTDE1vdW50YWluVmlldzEPMA0GA1UEChMGUmVkSGF0MQwwCgYDVQQL EwNJRE0xDjAMBgNVBAMTBWEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB gQDMbwtFUZNzlfWRI19nuxKsbhJ1/5A/rrXQkH7+K1uqxmzytm6b57lkGK9YUC7B qSKpJ4zzOnVqwRZsE9oJ5CSv+eQUie1NTz4KEL9ZOsN4p2zn0JFaKqze/vxZ3Rux BKnAz34KxOKZxGTiychOTytWS6V4lDzKBvgTgf0EZfOcfwIDAQABoAAwDQYJKoZI hvcNAQEEBQADgYEAxRGViyX5MxedhfSOja3XmvCcTOZL+btT7u4zztGBz71qSGhz yLcFCHCOMngsfiHxySBUIjZdGAOjrwcwT04ig/C2TE8mTamDp7d8/zQ6k9De/9Dp Q+C7PZuTYQkDf417IxbalEWhhNQ2AE6pMxfWwWAhjP1jAFLdKQZtEVNG9AQ= -----END CERTIFICATE REQUEST----- * Submit this CSR to the "Server Certificate Enrollment" profile of the Dogtag CA and get it approved. * Download the Cert and the CA and get them installed in apache. >From this URL: http://pki.fedoraproject.org/wiki/Apache_Cert_Enrollment * The .key and .csr files correctly generated, when I get to this step: * * Submit this CSR to the "Server Certificate Enrollment" profile of the Dogtag CA and get it approved. * * I get the following error in the web administration console DogTag: * Sorry, your request is not submitted. The reason is invalid request.

2 1

Sorry, your request is not submitted. The reason is "invalid request" (SOLVED)
by Ricardo Alexander Perez Ricardez 21 May '14

21 May '14

Solve this problem as follows: When generating the CSR, please do not enter an email address, challenge password, or an optional company name. For some reason when some of these data is entered, the server indicates that the CSR is invalid.

1 0

pkispawn Change default CA Name
by Ricardo Alexander Perez Ricardez 19 May '14

19 May '14

Hi, pkispawn use this file: etc/pki/default.cfg This file contains the value: pki_ca_signing_subject_dn=cn=CA Signing Certificate,o=%(pki_security_domain_name)s It's possible change the name "CA Signing Certificate" for other?

3 2

blog post: certificate profiles (part 1)
by Fraser Tweedale 12 May '14

12 May '14

Hi all, I've been encouraged to blog my learnings/development of FreeIPA/Dogtag. Without further ado, I present my first post, which is on the topic of certificate profiles and the certificate request process. In particular I examine the relationship between the PKCS #10 CSR format and the Dogtag Enrolment Request process, including what can cause summary rejection, and information in a CSR that are ignored by Dogtag. I'd appreciate a quick skim by those familiar with the profile system (to make sure I'm on the right track / not telling gigantic lies) as well as any general feedback. Link: http://blog-ftweedal.rhcloud.com/2014/05/dogtag-certificate-profiles-certif… Cheers, Fraser P.S. Better CSS coming soon ^_^

1 0

HTTP 500 - CS server is not ready to serve (SOLVED)
by Ricardo Alexander Alexander Perez Ricardez 11 May '14

11 May '14

I recieve this error: Estado HTTP 500 - CS server is not ready to serve. -------------------------------------------------------------------------------- type Informe de Excepción mensaje CS server is not ready to serve. descripción El servidor encontró un error interno que hizo que no pudiera rellenar este requerimiento. excepción java.io.IOException: CS server is not ready to serve. com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:443) javax.servlet.http.HttpServlet.service(HttpServlet.java:728) sun.reflect.GeneratedMethodAccessor31.invoke(Unknown Source) sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) java.lang.reflect.Method.invoke(Method.java:606) org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277) org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274) java.security.AccessController.doPrivileged(Native Method) javax.security.auth.Subject.doAsPrivileged(Subject.java:536) org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309) org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:169) nota La traza completa de la causa de este error se encuentra en los archivos de diario de Apache Tomcat/7.0.47. --------------------------------------------------------------------------------------------------------------------- Solution: Start LDAP 389 Directory Server systemctl start dirsrv.target

1 0

Error signing documents (SOLVED)
by Ricardo Alexander Perez Ricardez 10 May '14

10 May '14

Solve this problem On the client side: 1 - Using Internet explorer 8 2 - Import and install, CA Certificate Chain 3 - Import and install, Certificate Revocation List On the server side: After approve an application for registration certificate Update Certificate Revocation List (CRL) After doing this, I could import my certificates and sign word documents and pdf without problems. He was using DogTag Certificate System 1.3, I have now installed the version 10.

1 0