July 2014 - Pki-users - Dogtag PKI List Archives

base64 CMC Request format
by Elliott William C OSS sIT 13 Jul '16

13 Jul '16

Hi all, Can Dogtag (in this case v. 9.0.3-30.el6 ) be coerced into accepting base64-encoded CMC requests? Is there a parameter somewhere? Or would it require reprogramming? We have a (smart-)card management system (runs under Windows) which sends the requests and expects the responses to both be base64 encoded. Thanks and best regards, William Elliott s IT Solutions Open System Services

4 6

How to populate manual aproval form for server certificate with subjectAltName of type DNSName from request.
by J. David Rye of Roadtech 30 Jul '14

30 Jul '14

I can not believe that I am in a unique position. I needed a PKI setup for a development environment that develops Highly Available services. Production environment uses commercial certificates, with multiple DNSName type SubjectAltName fields. On first sight and test DogTag looked like it would do everything I want. so I have a box with Fedora 20 and Dogtag installed. Installed Packages dogtag-pki.noarch 10.1.1-1.fc20 dogtag-pki-console-theme.noarch 10.1.1-1.fc20 dogtag-pki-server-theme.noarch 10.1.1-1.fc20 pki-base.noarch 10.1.1-1.fc20 pki-ca.noarch 10.1.1-1.fc20 pki-console.noarch 10.1.1-1.fc20 pki-javadoc.noarch 10.1.1-1.fc20 pki-kra.noarch 10.1.1-1.fc20 pki-ocsp.noarch 10.1.1-1.fc20 pki-ra.noarch 10.1.1-1.fc20 pki-server.noarch 10.1.1-1.fc20 pki-symkey.x86_64 10.1.1-1.fc20 pki-tks.noarch 10.1.1-1.fc20 pki-tools.x86_64 10.1.1-1.fc20 pki-tps.x86_64 10.1.1-1.fc20 I also have a deployment script that generates a certificate request with the required alternate DNS names. In the current case 7 servers with 4 alternate names each. I then discovered that while it gives no errors or warnings the policy /var/lib/pki/pki-tomcat/ca/profiles/ca/caServerCert.cfg silently ignores subjectaltName from the request. Following various sets of notes found on line, I have a hacked version caServerCertAlt.cfg along with chnages to /etc/pki/pki-tomcat/ca/registry.cfg and /etc/pki/pki-tomcat/ca/CS.cfg this provides a box to enter the alternate names while approving the certificate request. To that extent it works, however it does not initialise the form with the values from the request. Insted they get initialised to "DNSName: $request.SAN1$" Most of the on line notes seam to be linking back to Example B1 in the Red_Hat_Certificate_System 8.0 Admin Guide https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.… Searching this list returned a message from August 2012 https://www.redhat.com/archives/pki-users/2012-August/msg00006.html Which suggests that the manual is wrong, or at leased wrong for DogTag. Can anyone help with a working example, or point me to a page with the correct information.

1 0

DogTag not show images
by Ricardo Alexander Perez Ricardez 18 Jul '14

18 Jul '14

On the client side --> Windows 7 When I browse to dogtag certificate server url from Internet Explorer I can't see images

1 0

Doghat on Ubuntu
by Abha Jain 07 Jul '14

07 Jul '14

Hi All, I see that Doghat is supported on Fedora and RHEL. Is it possible to run Doghat on Ubuntu host? Has anyone tried it and any thoughts on how to make Doghat work on Ubuntu? Thanks for your help! Abha

4 6

Request Rejected
by Ricardo Alexander Perez Ricardez 03 Jul '14

03 Jul '14

When I send a request of Certificate Profile - Manual User Dual-Use Certificate Enrollment On subject name If "UID" value is empty I get this error: Certificate Profile Sorry, your request has been rejected. The reason is "Request Rejected - {0}" Your request ID is 7.

2 1

Queries on Doghat support
by Abha Jain 03 Jul '14

03 Jul '14

Hi All, We are looking at using Doghat CA server with Cisco routers. I had a few questions on the support included in Doghat certificate system. I just started working on PKI, so please excuse if the questions are quite basic. 1. The Doghat system is built on top of NSS (Network Security Services). Does it have any issues working with Cisco routers as clients using SCEP? Would there be any OpenSSL and NSS interactions in this case? 2. Does Doghat support CA Certificate rollover? When CA certificate is about to expire, CA creates a shadow certificate. All the endpoints associated with that CA can then renew their ID certificates (this requires support for SCEP Messages such as GetNextCACert, GetCACaps). Thanks in advance for your help! -Abha

2 2

Re: [Pki-users] Pki-users Digest, Vol 76, Issue 1
by sbernst＠gmail.com 01 Jul '14

01 Jul '14

Christina, Thank you so much for the help! :-) Steven From: pki-users-request(a)redhat.com Sent: ‎Tuesday‎, ‎July‎ ‎1‎, ‎2014 ‎11‎:‎00‎ ‎AM To: pki-users(a)redhat.com Send Pki-users mailing list submissions to pki-users(a)redhat.com To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/pki-users or, via email, send a message with subject or body 'help' to pki-users-request(a)redhat.com You can reach the person managing the list at pki-users-owner(a)redhat.com When replying, please edit your Subject line so it is more specific than "Re: Contents of Pki-users digest..." Today's Topics: 1. Re: ECC entity certificate signing and Dogtag (Christina Fu) ---------------------------------------------------------------------- Message: 1 Date: Mon, 30 Jun 2014 11:15:24 -0700 From: Christina Fu <cfu(a)redhat.com> To: pki-users(a)redhat.com Subject: Re: [Pki-users] ECC entity certificate signing and Dogtag Message-ID: <53B1A93C.5090005(a)redhat.com> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" Hi Steven, NSS softtoken provides ECC on F20 out of box (https://bugzilla.redhat.com/show_bug.cgi?id=1019244 ). During installation, you just want to make sure that you select the right option accordingly. On the client side, the current firefox version supports CRMF key gen with EC. You can try it on one of the enrollment profiles at the EE port. From the CLI, certutil works well. You can do something like the following to get PKCS#10: certutil -d . -R -k ec -q nistp256 -s "CN=test2014" -a -o req.test2014 Christina On 06/27/2014 10:02 AM, sbernst(a)gmail.com wrote: > Hi there... It has been suggested that this is likely a question for > CFU (Christina). > > How and where do I get the libraries to get ECC working on DogTag on > FC20? Specifically looking to sign client side generated PKCS#10 key > blobs. The Dogtag 10 release from 17 Jan 2013 suggested that this > might be supported, but Info from the link below says that, "Certicom > software tokens could not be used because of an issue with malformed > private keys." > https://www.redhat.com/archives/pki-users/2013-January/msg00001.html > > So what all is required to sign ECC generated requests? (not planning > on use of TMS interface at this point). I saw that bug Bug 986831 says > that, "Some tools are broken for ECC with NSS token alone," (from the > 10.1 release announcement from November of last year > https://www.redhat.com/archives/pki-users/2013-November/msg00001.html) > <https://www.redhat.com/archives/pki-users/2013-November/msg00001.html%29> > but I'm not authorized to view its details. (I mention this to > demonstrate that I'm trying to do my homework on this issue before > asking for help.) > > Thank you so much, in advance, for any and all help. > > - Steven > > > _______________________________________________ > Pki-users mailing list > Pki-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/pki-users -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://www.redhat.com/archives/pki-users/attachments/20140630/3e54f20f/att…> ------------------------------ _______________________________________________ Pki-users mailing list Pki-users(a)redhat.com https://www.redhat.com/mailman/listinfo/pki-users End of Pki-users Digest, Vol 76, Issue 1 ****************************************

1 0