December 2015 - Pki-users - Dogtag Pki List Archives

by pki tech

Hi all, Good day to you all. What is the process to renew all the four system certificates (SubsystemCert, ServerCert, ocspSigningCert and AuditsigningCert) when those existing certificates are currently expired. I cant access the pkiconsole also as the system is not up and running. I have used the certutil to generate the certificate requests and get it signed by the CA. But it didn't work as expected. I believe the procedure that i have followed to request generation or the signing profiles used for the generation, may have some issues. Cheers. Regards, Mark

8 years

3
2
0 / 0

base64 CMC Request format

by Elliott William C OSS sIT

Hi all, Can Dogtag (in this case v. 9.0.3-30.el6 ) be coerced into accepting base64-encoded CMC requests? Is there a parameter somewhere? Or would it require reprogramming? We have a (smart-)card management system (runs under Windows) which sends the requests and expects the responses to both be base64 encoded. Thanks and best regards, William Elliott s IT Solutions Open System Services

8 years

4
6
0 / 0

CRL Distribution point

by Sam Elliott

Hi, I maybe missing something here, but I have configured CRL distribution point within the certificate profile, and this shows up within generated certificates, but when I setup the CRL issuing distribution point it doesn't seem to have any affect. I have enabled it, configured pointType to DirectoryName and then pointName to crl/master.crl, after revoking some certs I try downloading the CRL but get a 404, not sure if I am missing something with the configuration? Regards, Sam -- opencredo.com <http://www.opencredo.com/> . Twitter <https://twitter.com/OpenCredo> . LinkedIn <https://www.linkedin.com/company/opencredo> OpenCredo Ltd -- Excellence in Enterprise Application Development Registered Office: 5-11 Lavington Street, London, SE1 0NZ Registered in UK. No 3943999

8 years, 6 months

2
1
0 / 0

pki cli default CA Admin Unauthorized

by Alex Harrison

I've set up a new installation of the dogtag CA and I'm trying to approve requests using the default ca admin created at install using the commands from the wiki: http://pki.fedoraproject.org/wiki/CA_Admin_Setup When I try to approve, I simply get an "Unauthorized" response. It seems I receive this any time I perform either an admin or agent command. Any idea what steps I am missing? Thanks

8 years, 7 months

2
5
0 / 0

CA/SSL certs customization

by Cho Chan

Hello all, I am trying to build internal PKI - two levels CA (Root and Intermediate) with dogtag 10.1.2 on CentOS 7.1. When I use pkispawn to create the first CA (Root) the certificates are created with predefined validity, signature algorithm, CN name, X509v3 extensions and etc. I searched for options/parameters which I can use with pkispawn and deployment config but I manage to find only this: https://fedorapeople.org/cgit/edewata/public_git/pki-dev.git/tree/scripts... Are there such options/parameters to customize the validity, CN, algorithm and etc during the build process with pkispawn? Or if not what are my options? Maybe I have to edit the some of the cfg in /usr/share/pki/ca/conf ? Much appreciate if someone can give me hints or help! Thank you in advance! Cho

8 years, 7 months

2
1
0 / 0

SAN:howt is it possible to sign certificate requests with DNS alias names?

by Carsten Grzemba

I try to sign certificate requests with SAN extension to have DNS alias names, but with no success. I see that there are subjectAltNameExt in the profile but my policyset.serverCertSet.9.default.params.subjAltExtPattern_0=$request.req_san_pattern_0$ is always null, although I have input.i3.name=subjectAltNameExtInputImpl for the inputs. What I am doing wrong?

8 years, 7 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Pki-users December 2015