June 2015 - Pki-users - Dogtag PKI List Archives

Renew expired OCSP system certificates
by pki tech 19 Jul '16

19 Jul '16

Hi all, Good day to you all. What is the process to renew all the four system certificates (SubsystemCert, ServerCert, ocspSigningCert and AuditsigningCert) when those existing certificates are currently expired. I cant access the pkiconsole also as the system is not up and running. I have used the certutil to generate the certificate requests and get it signed by the CA. But it didn't work as expected. I believe the procedure that i have followed to request generation or the signing profiles used for the generation, may have some issues. Cheers. Regards, Mark

3 2

base64 CMC Request format
by Elliott William C OSS sIT 13 Jul '16

13 Jul '16

Hi all, Can Dogtag (in this case v. 9.0.3-30.el6 ) be coerced into accepting base64-encoded CMC requests? Is there a parameter somewhere? Or would it require reprogramming? We have a (smart-)card management system (runs under Windows) which sends the requests and expects the responses to both be base64 encoded. Thanks and best regards, William Elliott s IT Solutions Open System Services

4 6

Configure externally acquired private key and certificate
by Jain, Mahendra 01 Jul '15

01 Jul '15

Hi, I’ve DogTag 10.1.2 setup with externally signed CA (using the steps outline in the link below) and the setup works perfectly fine: http://man.sourcentral.org/f18/8+pkispawn I would like to know if DogTag also supports configuring externally acquired private key and certificate. In other words, If I generate the private key and CSR using openssl and submit CSR to CA for certificate. Once the CA issued the certificate, I would like to setup DogTag using the existing private key (created using openssl) and certificate. Thanks, Mahendra “This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed, and may contain information that is non-public, proprietary, privileged, confidential and exempt from disclosure under applicable law or may be constituted as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this message in error, notify sender immediately and delete this message immediately.”

2 10

Re: [Pki-users] Configure Dogtag using externally acquired private key and certificate
by Jain, Mahendra 30 Jun '15

30 Jun '15

Any suggestions? Thanks you, Mahendra From: <Jain>, "Jain, Mahendra" <majain(a)verisign.com<mailto:majain@verisign.com>> Date: Monday, June 29, 2015 at 10:32 AM To: Christina Fu <cfu(a)redhat.com<mailto:cfu@redhat.com>>, "pki-users(a)redhat.com<mailto:pki-users@redhat.com>" <pki-users(a)redhat.com<mailto:pki-users@redhat.com>> Subject: Re: [Pki-users] Configure externally acquired private key and certificate Hi Christina, Here’s some detailed information: I’m planning to setup intermediate CA with DogTag and issue SSL server certs. I’m trying 2 options with DogTag setup: Option 1: Installing an externally signed CA I followed the steps outlined in http://man.sourcentral.org/f18/8+pkispawn and this setup works perfectly fine with no issues. This option involves following steps: 1. Generate a certificate signing request (CSR) for the signing certificate in DogTag setup phase 1 2. Submit the CSR to the external CA (Ex: Symantec) 3. Obtain the resulting intermediate certificate and certificate chain 4. Continue with DogTag setup phase 2 Option 2: Installing an externally signed CA (One time setup of keys/CSR) The desired steps are as follows: 1. Generate a certificate signing request (CSR) for the signing certificate using OpenSSL 2. Submit the CSR to the external CA (Ex: Symantec) 3. Obtain the resulting intermediate certificate and certificate chain 4. Store private key and certificate obtained in above steps in secured media so that it can be used later 5. Setup DogTag using the private key (generated in step #1) and intermediate CA certificate (acquired in step #3) The desired expectation in option #2 is to perform step 1-3 below once and then setup DogTag (or recreate VM) as many times I need using private key and certificate obtained earlier. This will prevent us from regenerating CSR and get it signed with external CA (Ex: Symantec). Please let me know if you have any questions. Thanks, Mahendra From: <Jain>, "Jain, Mahendra" <majain(a)verisign.com<mailto:majain@verisign.com>> Date: Friday, June 26, 2015 at 12:22 PM To: Christina Fu <cfu(a)redhat.com<mailto:cfu@redhat.com>>, "pki-users(a)redhat.com<mailto:pki-users@redhat.com>" <pki-users(a)redhat.com<mailto:pki-users@redhat.com>> Subject: Re: [Pki-users] Configure externally acquired private key and certificate Hi Christina, Sorry for the confusion. Let me rephrase the steps below if it is supported: 1. Generate private key and CSR for intermediate CA using openssl 2. Submit the CSR to external CA (Ex: Symantec) for signing 3. Receive the signed certificate from CA 4. Setup DogTag with the private key (generated in step #1) and intermediate CA certificate (acquired in step #3) I’m hoping this approach allows me to perform step 1-3 once and then setup DogTag as many times I need using the existing private key and certificate on any host. Please let me know if you need further clarification. Thanks, Mahendra From: Christina Fu <cfu(a)redhat.com<mailto:cfu@redhat.com>> Date: Friday, June 26, 2015 at 12:03 PM To: "pki-users(a)redhat.com<mailto:pki-users@redhat.com>" <pki-users(a)redhat.com<mailto:pki-users@redhat.com>> Subject: Re: [Pki-users] Configure externally acquired private key and certificate On 06/25/2015 11:23 AM, Jain, Mahendra wrote: Hi, I’ve DogTag 10.1.2 setup with externally signed CA (using the steps outline in the link below) and the setup works perfectly fine: http://man.sourcentral.org/f18/8+pkispawn I would like to know if DogTag also supports configuring externally acquired private key and certificate. In other words, If I generate the private key and CSR using openssl and submit CSR to CA for certificate. Once the CA issued the certificate, I would like to setup DogTag using the existing private key (created using openssl) and certificate. Hi, I'm sorry I read your questions a few times and I'm not certain what you wish to do. What would you like to use this certificate for? For example, is this an SSL server cert, or CA signing cert? etc. And you mean in another new Dogtag instance, or are you talking about replacing certain system cert of the CA you just set up? Thanks, Mahendra “This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed, and may contain information that is non-public, proprietary, privileged, confidential and exempt from disclosure under applicable law or may be constituted as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this message in error, notify sender immediately and delete this message immediately.” _______________________________________________ Pki-users mailing list Pki-users(a)redhat.com<mailto:Pki-users@redhat.com>https://www.redhat.com/mailman/listinfo/pki-users

1 0

Re: [Pki-users] Resolvable CRL Distribution Points in the certificate
by Jain, Mahendra 26 Jun '15

26 Jun '15

I’m able to resolve this by following steps outlined in the link below: https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.… - Mahendra From: <Jain>, "Jain, Mahendra" <majain(a)verisign.com<mailto:majain@verisign.com>> Date: Wednesday, June 24, 2015 at 10:07 AM To: "pki-users(a)redhat.com<mailto:pki-users@redhat.com>" <pki-users(a)redhat.com<mailto:pki-users@redhat.com>> Subject: [Pki-users] Resolvable CRL Distribution Points in the certificate Hi, I’ve DogTag 10.1.2 setup in my environment. I updated the caServerCert profile to support CRL Distribution Points configuration via pkiconsole. After I issued the new server cert, the CRL Distribution Points are included in the cert as expected shown below: ---------------------------------------------------------------------------- …. Extension: CRL Distribution Points (2.5.29.31) Critical: no URI:http://crl.example-domain.com/master.crl ---------------------------------------------------------------------------- What is the step that needs to be done so that DogTag can publish/generate CRL at the above url so that it can be downloadable/accessible by client? Thanks, Mahendra “This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed, and may contain information that is non-public, proprietary, privileged, confidential and exempt from disclosure under applicable law or may be constituted as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this message in error, notify sender immediately and delete this message immediately.”

2 1

Dogtag ReST Interface Enrollment Java Null Pointer Exception
by Peter P. 24 Jun '15

24 Jun '15

Hi, I have encountered a Java null pointer exception when I try to do an an enrollment using Dogtag 10.2.4's ReST interface. I receive the following response back from Dogtag when I POST to the resource ending in /ca/rest/certrequests. <?xml version="1.0" encoding="UTF-8" standalone="yes"?><PKIException><Attributes/><ClassName>com.netscape.certsrv.base.PKIException</ClassName><Code>500</Code><Message>java.lang.NullPointerException</Message></PKIException>2015/ I understand that there is a new ReST interface that was introduced to Dogtag where enrollment requests should be posted to the resource ending in /pki/request. However, when I do that, I receive a 404 page back in response. I am using Fedora 22 Server 32 bit with just the 389 directory service installed alongside Dogtag 10.2.4. Any guidance would be appreciated. Thanks, Peter

3 6

Resolvable CRL Distribution Points in the certificate
by Jain, Mahendra 24 Jun '15

24 Jun '15

Hi, I’ve DogTag 10.1.2 setup in my environment. I updated the caServerCert profile to support CRL Distribution Points configuration via pkiconsole. After I issued the new server cert, the CRL Distribution Points are included in the cert as expected shown below: ---------------------------------------------------------------------------- …. Extension: CRL Distribution Points (2.5.29.31) Critical: no URI:http://crl.example-domain.com/master.crl ---------------------------------------------------------------------------- What is the step that needs to be done so that DogTag can publish/generate CRL at the above url so that it can be downloadable/accessible by client? Thanks, Mahendra “This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed, and may contain information that is non-public, proprietary, privileged, confidential and exempt from disclosure under applicable law or may be constituted as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this message in error, notify sender immediately and delete this message immediately.”

1 0

Documenting Issues with pkispawn, pkidestroy, pkiconsole
by Ade Lee 11 Jun '15

11 Jun '15

Hi all, I'm editing the troubleshooting chapter in the Installation Guide which currently consists of a series of FAQ of issues that people might/ have run into when running pkispawn/ pkiconsole. I'd like to get input from folks so that we can hopefully help other folks who might run into the same issues. Some of these will show up in the doc and others will be collated on the wiki. I've started an etherpad for folks to add their FAQs. Please add to it so we can improve the docs! Thanks, Ade Etherpad Link: http://piratepad.net/sQurNFFmiT (aargh!)

1 0

RedHat Summit
by Elliott William C OSS sIT 11 Jun '15

11 Jun '15

Hi, Is there anything regarding PKI to watch out for at the summit in Boston? Best regards, William Elliott s IT Solutions Open System Services s IT Solutions AT Spardat GmbH Head Office: Vienna Commercial Register No.: 152289f Commercial Court of Vienna This message and any attached files are confidential and intended solely for the addressee(s). Any publication, transmission or other use of the information by a person or entity other than the intended addressee is prohibited. If you receive this in error please contact the sender and delete the material. The sender does not accept liability for any errors or omissions as a result of the transmission.

3 3