December 2015 - Pki-users - Dogtag PKI List Archives

Renew expired OCSP system certificates
by pki tech 19 Jul '16

19 Jul '16

Hi all, Good day to you all. What is the process to renew all the four system certificates (SubsystemCert, ServerCert, ocspSigningCert and AuditsigningCert) when those existing certificates are currently expired. I cant access the pkiconsole also as the system is not up and running. I have used the certutil to generate the certificate requests and get it signed by the CA. But it didn't work as expected. I believe the procedure that i have followed to request generation or the signing profiles used for the generation, may have some issues. Cheers. Regards, Mark

3 2

base64 CMC Request format
by Elliott William C OSS sIT 13 Jul '16

13 Jul '16

Hi all, Can Dogtag (in this case v. 9.0.3-30.el6 ) be coerced into accepting base64-encoded CMC requests? Is there a parameter somewhere? Or would it require reprogramming? We have a (smart-)card management system (runs under Windows) which sends the requests and expects the responses to both be base64 encoded. Thanks and best regards, William Elliott s IT Solutions Open System Services

4 6

CRL Distribution point
by Sam Elliott 04 Jan '16

04 Jan '16

Hi, I maybe missing something here, but I have configured CRL distribution point within the certificate profile, and this shows up within generated certificates, but when I setup the CRL issuing distribution point it doesn't seem to have any affect. I have enabled it, configured pointType to DirectoryName and then pointName to crl/master.crl, after revoking some certs I try downloading the CRL but get a 404, not sure if I am missing something with the configuration? Regards, Sam -- opencredo.com <http://www.opencredo.com/> . Twitter <https://twitter.com/OpenCredo> . LinkedIn <https://www.linkedin.com/company/opencredo> OpenCredo Ltd -- Excellence in Enterprise Application Development Registered Office: 5-11 Lavington Street, London, SE1 0NZ Registered in UK. No 3943999

2 1

pki cli default CA Admin Unauthorized
by Alex Harrison 22 Dec '15

22 Dec '15

I've set up a new installation of the dogtag CA and I'm trying to approve requests using the default ca admin created at install using the commands from the wiki: http://pki.fedoraproject.org/wiki/CA_Admin_Setup When I try to approve, I simply get an "Unauthorized" response. It seems I receive this any time I perform either an admin or agent command. Any idea what steps I am missing? Thanks

2 5

CA/SSL certs customization
by Cho Chan 15 Dec '15

15 Dec '15

Hello all, I am trying to build internal PKI - two levels CA (Root and Intermediate) with dogtag 10.1.2 on CentOS 7.1. When I use pkispawn to create the first CA (Root) the certificates are created with predefined validity, signature algorithm, CN name, X509v3 extensions and etc. I searched for options/parameters which I can use with pkispawn and deployment config but I manage to find only this: https://fedorapeople.org/cgit/edewata/public_git/pki-dev.git/tree/scripts/c… Are there such options/parameters to customize the validity, CN, algorithm and etc during the build process with pkispawn? Or if not what are my options? Maybe I have to edit the some of the cfg in /usr/share/pki/ca/conf ? Much appreciate if someone can give me hints or help! Thank you in advance! Cho

2 1

SAN:howt is it possible to sign certificate requests with DNS alias names?
by Carsten Grzemba 09 Dec '15

09 Dec '15

I try to sign certificate requests with SAN extension to have DNS alias names, but with no success. I see that there are subjectAltNameExt in the profile but my policyset.serverCertSet.9.default.params.subjAltExtPattern_0=$request.req_san_pattern_0$ is always null, although I have input.i3.name=subjectAltNameExtInputImpl for the inputs. What I am doing wrong?

2 1