April 2015 - Pki-users - Dogtag Pki List Archives

by pki tech

Hi all, Good day to you all. What is the process to renew all the four system certificates (SubsystemCert, ServerCert, ocspSigningCert and AuditsigningCert) when those existing certificates are currently expired. I cant access the pkiconsole also as the system is not up and running. I have used the certutil to generate the certificate requests and get it signed by the CA. But it didn't work as expected. I believe the procedure that i have followed to request generation or the signing profiles used for the generation, may have some issues. Cheers. Regards, Mark

7 years, 9 months

3
2
0 / 0

base64 CMC Request format

by Elliott William C OSS sIT

Hi all, Can Dogtag (in this case v. 9.0.3-30.el6 ) be coerced into accepting base64-encoded CMC requests? Is there a parameter somewhere? Or would it require reprogramming? We have a (smart-)card management system (runs under Windows) which sends the requests and expects the responses to both be base64 encoded. Thanks and best regards, William Elliott s IT Solutions Open System Services

7 years, 9 months

4
6
0 / 0

Re: [Pki-users] confused about access control list

by Christina Fu

Hi, I was looking for an exact aci syntax example you tried that failed so I could help you better with. Did you do something like: resourceACLS: certServer.ee.request.enrollment:submit:allow (submit) user!="someBody" && group="Agents":All Agents other than someBody may submit an enrollment request I got the syntax info from the link I gave you. Let me know if that's what you tried. Christina On 04/24/2015 11:14 AM, Ali Khalidi wrote: > In my test, I've added an user to CM and assigned him Agent group > permissions. > now, I want to deny this user enrollment submission, so there are two > default and pre-existing ACLs of relevance: > certServer.ca.request.enrollment and certServer.ee.request.enrollment > in both I tried the following to the submit right: > change the submit right from allow to deny -> the user can still > submit and enroll a certificate > change back to allow, then added a deny rule with the username > specified -> the user can still submit and enroll a certificate > > these were just experiments to understand how ACLs work. > > my end goal, if possible with dogtag, and I would appreciate if you > point me to the right direction is: > restrict an agent to submit and execute and enrollment based on a > specific certificate profile. > > having said the latter, the user_origreq looked promising for that > matter, but I have no clue how to create a new ACL with it. help is > appreciated in the area as well. > > > Thanks, > > Ali > > > > > > > > On Fri, Apr 24, 2015 at 7:31 PM, Christina Fu <cfu(a)redhat.com > <mailto:cfu@redhat.com>> wrote: > > > On 04/22/2015 02:17 AM, Ali Khalidi wrote: >> I've tried a simple example of using the ACL to block profile >> listing and it works. however, I want to disable a CA agent from >> submitting/approving or executing any enrollment requests. I've >> went through all the ACLs, and whenever I encountered a submit >> right, I flipped to deny. despite that the agent still is able to >> submit and enroll certificates. >> > information on access control can be found here: > https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/... > > It would help if you give us an acl example that you tried that > does not work? > >> >> another aspect, I was looking into the user_orgreq ACL plugin. >> can someone provide and an example on how this can be used in the >> context of ACLs? > > The user_origreq is an access evaluator plugin for the > UserOrigReqAccessEvaluator. Its primary purpose is for access > control during renewal. It checks to see the the authenticated > user and the original request ownership match. > > Hope this helps. > >> >> thanks, >> >> >> _______________________________________________ >> Pki-users mailing list >> Pki-users(a)redhat.com <mailto:Pki-users@redhat.com> >> https://www.redhat.com/mailman/listinfo/pki-users > > > _______________________________________________ > Pki-users mailing list > Pki-users(a)redhat.com <mailto:Pki-users@redhat.com> > https://www.redhat.com/mailman/listinfo/pki-users > >

8 years, 11 months

2
2
0 / 0

US Government SmartCard question

by Nordgren, Bryce L -FS

Hi, I'm trying to set up smart card logins on Linux using a clean Fedora 21 install following the instructions at [1]. My main objective is to use my USDA-issued LincPass (the USDA brand of the USAccess card) for login to local accounts on linux machines that are not joined to the domain and which are outside the firewall. Essentially, I have control over a handful of machines, but no control over issuing the smart cards. I'll try to get you relevant debugging info, but I don't know much about smart card internals. My setup (card info from ActivClient on Windows): Card Reader: SCR3310 v2.0 "smartOS powered" Smart Card Mfr: Oberthur Technologies Smart Card Model: ID-One Cosmo v7.0 with Oberthur PIV Applet Suite 2.3.2 The problem: following instructions at [1], "pkcs11_inspect debug" results in "no token available" and the light on the reader never comes on. Googling, I saw that US government cards may require CACKey instead of coolkey, so I downloaded/compiled/installed the version at [2] and modified the pam_pkcs11.conf file. Reboot. Improvement. The light comes on. Repeating the "pkcs11_inspect debug" prompts for a PIN for token, and fails immediately afterward with "pkcs11_pass_login() failed: pkcs11_login() failed". I entered the PIN I enter on Windows. Any insights are appreciated. Thanks, Bryce [1] https://docs.fedoraproject.org/en-US/Fedora/19/html/Security_Guide/sect-S... [2] https://github.com/Conservatory/CACKey

8 years, 12 months

3
12
0 / 0

renew expired admin certificate

by Kamal Perera

Dear All, I'm in the process of regaining one of the old CA systems which was not being used for a long time. In the root CA, administrator certificate is expired and cannot access the agent interface. In order to renew it, i would need the access to the agent interface. Please help me to proceed with the login in to the agent interface. Regards, Kamal

9 years

1
0
0 / 0

SCEP directory authentication

by Emily Stemmerich

Hi, I am still trying to get Dogtag 10.2.1 on Fedora 21 working to allow for router identity certificates obtained by Cisco Routers via SCEP to be auto-renewing. I have found that the one-time pin model doesn’t work for auto-renewal. I was pointed to the RedHat document below that discusses using directory-based auth in Section 8.2.1, but I’m having issues with getting it to work. https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/... I’m not certain what to put in the dnpattern attribute and there are no examples I can find and am wondering if it is the reason attempts show uid and credentials as null from the router – details of the setup later on in this email. * dnpattern. Specifies a string representing a subject name pattern to formulate from the directory attributes and entry DN. ------------------------------------------ >From my CS.conf (RouterAuth is then referenced in the caRouterCert.cfg instead of flatfile): auths.instance.RouterAuth.pluginName=UidPwdDirAuth auths.instance.RouterAuth.ldap.basedn=ou=RouterID,dc=auth,dc=sample,dc=com auths.instance.RouterAuth.ldap.ldapconn.host=localhost auths.instance.RouterAuth.ldap.ldapconn.port=389 auths.instance.RouterAuth.ldap.ldapconn.secureConn=false ------------------------------------------ I’ve created a hierarchy outside of dogtag for doing router auth: ou=RouterID,dc=auth,dc=sample,dc=com ------------------------------------------ Test User Account (I am not sure what objectClass to use, so I found one with uid and password as options and used that): dn: uid=172.18.240.11,ou=RouterID,dc=auth,dc=sample,dc=com uid: 172.18.240.11 objectClass: inetUser userPassword: testpass ------------------------------------------ Router config. For flatfile auth it ends up using the wan IP and the password and password in the identity section, however for LDAP auth I don’t know what things would map to: crypto ca identity SAMPLE enrollment url http://172.21.4.239:8080/ca/cgi-bin revocation-check none fqdn emilyvpn.sample.com serial-number none ip-address none hash sha256 password testpass rsakeypair MEVO 2048 auto-enroll 75 crl optional exit crypto ca authenticate SAMPLE ------------------------------------------ When I try and get a cert from the Cisco Router I get output like the following in the debug file that lists both UID and credential as null: [24/Apr/2015:16:31:18][http-bio-8080-exec-7]: Got authenticator=com.netscape.cms.authentication.UidPwdDirAuthentication [24/Apr/2015:16:31:18][http-bio-8080-exec-7]: LdapAnonConnFactory::getConn [24/Apr/2015:16:31:18][http-bio-8080-exec-7]: LdapAnonConnFactory.getConn(): num avail conns now 4 [24/Apr/2015:16:31:18][http-bio-8080-exec-7]: Authenticating UID=null [24/Apr/2015:16:31:19][http-bio-8080-exec-7]: returnConn: mNumConns now 4 [24/Apr/2015:16:31:19][http-bio-8080-exec-7]: operation failure - Authentication credential for uid is null. [24/Apr/2015:16:31:19][http-bio-8080-exec-7]: Output PKIOperation response: Thanks for any assistance, -Emily

9 years

1
0
0 / 0

Rest API to renew server certificate

by Jain, Mahendra

Hello All, I’m using Dogtag Certificate System to manage certificates. I have successfully submitted the server certificate request and got it approved using following REST APIs: @POST @Path("certrequests") @ClientResponseType(entityType=CertRequestInfos.class) public Response enrollCert(CertEnrollmentRequest data); @POST @Path("agent/certrequests/{id}/approve") @ClientResponseType(entityType=Void.class) @ACLMapping("certrequests") @AuthMethodMapping("certrequests") public Response approveRequest(@PathParam("id") RequestId id, CertReviewResponse data); While I can renew the server certificate via Web interface, I did not find any REST API to renew the server cert. Do I need to submit certificate enrollment request again with original CSR and set the renewal flag to true? Since I already have certificate serial number, is there a REST API to renew server cert using serial number alone? Thanks, Mahendra “This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed, and may contain information that is non-public, proprietary, privileged, confidential and exempt from disclosure under applicable law or may be constituted as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this message in error, notify sender immediately and delete this message immediately.”

9 years

1
0
0 / 0

confused about access control list

by Ali Khalidi

I've tried a simple example of using the ACL to block profile listing and it works. however, I want to disable a CA agent from submitting/approving or executing any enrollment requests. I've went through all the ACLs, and whenever I encountered a submit right, I flipped to deny. despite that the agent still is able to submit and enroll certificates. another aspect, I was looking into the user_orgreq ACL plugin. can someone provide and an example on how this can be used in the context of ACLs? thanks,

9 years

2
1
0 / 0

Problems with OCSP

by Ricardo Alexander Alexander Perez Ricardez

How to validate if the OCSP is working correctly on the client side ? I'm using Digital Signatures In Adobe reader, When I enable the option: "Require certificate revocation checking to verify signatures wherever possible" I recieve this message: "OCSP Response Signing invalid"

9 years

2
1
0 / 0

getting NEED_TO_NOTIFY_ISSUED_SAVE_FAILED with dogtag-submit

by Steve Neuharth

Hello, I'm using the following configuration with certmonger: *id=Dogtagca_aka=Dogtag (certmonger 0.76.8)ca_is_default=0ca_type=EXTERNALca_external_helper=/usr/libexec/certmonger/dogtag-submit -E https://dogtag.test.org:8443/ca/ee/ca <https://dogtag.test.org:8443/ca/ee/ca> -A https://dogtag.test.org:8443/ca/agent/ca <https://dogtag.test.org:8443/ca/agent/ca> -i /root/ca.crt* I'm able to submit a request like this: *getcert request -k /tmp/getcert.key -f /tmp/getcert.crt -c Dogtag -D foo.bar.org <http://foo.bar.org>* but after I refresh the cert requests, it's in NEED_TO_NOTIFY_ISSUED_SAVE_FAILED status and occasionally shows START_SAVING_CERT status. *Request ID '20150403093236': status: NEED_TO_NOTIFY_ISSUED_SAVE_FAILED stuck: no key pair storage: type=FILE,location='/tmp/getcert.key' certificate: type=FILE,location='/tmp/getcert.crt' CA: Dogtag issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes* selinux is set to 'permissive' and the perms on /tmp are 777. I cant thonk of any other reason it would fail to save the cert. --steve

9 years

3
13
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Pki-users April 2015