January 2016 - Pki-users - Dogtag PKI List Archives

Unable to spawn CA when using HSM
by Lionel Beard 22 Jul '16

22 Jul '16

Hi, I'm trying to create a CA with a Atos/Bull HSM backend. I have created a configuration file default_hsm.cfg with hsm options enabled and configured, and I have set HSM token and password. When I run the command: # pkispawn -s CA -f /etc/pki/default_hsm.cfg -vvv I get the error: pkispawn : DEBUG ........... <?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><State>0</State><Type>CA</Type><Status>running</Status><Version>10.2.6-13.fc23</Version></XMLResponse> pkispawn : INFO ....... constructing PKI configuration data. pkispawn : INFO ....... executing 'certutil -R -d /root/.dogtag/pki-tomcat/ca/alias -s cn=PKI Administrator,e=caadmin(a)cls.fr ,o=cls.fr Security Domain -k rsa -g 2048 -z /root/.dogtag/pki-tomcat/ca/alias/noise -f /root/.dogtag/pki-tomcat/ca/password.conf -o /root/.dogtag/pki-tomcat/ca/alias/admin_pkcs10.bin' pkispawn : INFO ....... rm -f /root/.dogtag/pki-tomcat/ca/alias/noise pkispawn : INFO ....... BtoA /root/.dogtag/pki-tomcat/ca/alias/admin_pkcs10.bin /root/.dogtag/pki-tomcat/ca/alias/admin_pkcs10.bin.asc pkispawn : INFO ....... configuring PKI configuration data. pkispawn : ERROR ....... Exception from Java Configuration Servlet: 400 Client Error: Bad Request for url: https://freeipa-ca.cls.fr:8443/ca/rest/installer/configure pkispawn : ERROR ....... ParseError: not well-formed (invalid token): line 1, column 0: {"Attributes":{"Attribute":[]},"ClassName":"com.netscape.certsrv.base.BadRequestException","Code":400,"Message":"*Invalid Token provided. No such token*."} pkispawn : DEBUG ....... Error Type: ParseError pkispawn : DEBUG ....... Error Message: not well-formed (invalid token): line 1, column 0 pkispawn : DEBUG ....... File "/usr/sbin/pkispawn", line 597, in main rv = instance.spawn(deployer) File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 116, in spawn json.dumps(data, cls=pki.encoder.CustomTypeEncoder)) File "/usr/lib/python2.7/site-packages/pki/server/deployment/pkihelper.py", line 3872, in configure_pki_data root = ET.fromstring(e.response.text) File "/usr/lib64/python2.7/xml/etree/ElementTree.py", line 1300, in XML parser.feed(text) File "/usr/lib64/python2.7/xml/etree/ElementTree.py", line 1642, in feed self._raiseerror(v) File "/usr/lib64/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror raise err Installation failed. Just after pki service restart. I don't know which "Token" is it talking about, not sure it is HSM token. HSM is working fine because it is previously added to database with modutil: # modutil -list -dbdir /etc/pki/pki-tomcat/alias -nocertdb Bull TrustWay Proteccio NetHSM 2.4 Configuration read from /etc/proteccio//proteccio.rc Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificate Services token: NSS Certificate DB 2. nethsm library name: /usr/lib64/libnethsm.so slots: 8 slots attached status: loaded slot: Trustway Crypto Engine Slot token: nethsm1_V1 slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: slot: Trustway Crypto Engine Slot token: ----------------------------------------------------------- Of course, I have updated default_hsm.cfg file according to Redhat documentation to enable HSM et put HSM token name and password: # grep hsm /etc/pki/default_hsm.cfg pki_audit_signing_token=nethsm1_V1 pki_hsm_enable=True pki_hsm_libfile=/usr/lib64/libnethsm.so pki_hsm_modulename=nethsm pki_ssl_server_token=nethsm1_V1 pki_subsystem_token=nethsm1_V1 pki_token_name=nethsm1_V1 pki_storage_token=nethsm1_V1 pki_transport_token=nethsm1_V1 I have tried with interactive installation (so with no HSM), and it is working fine. Does anyone can help me? Thanks!

2 2

Renew expired OCSP system certificates
by pki tech 19 Jul '16

19 Jul '16

Hi all, Good day to you all. What is the process to renew all the four system certificates (SubsystemCert, ServerCert, ocspSigningCert and AuditsigningCert) when those existing certificates are currently expired. I cant access the pkiconsole also as the system is not up and running. I have used the certutil to generate the certificate requests and get it signed by the CA. But it didn't work as expected. I believe the procedure that i have followed to request generation or the signing profiles used for the generation, may have some issues. Cheers. Regards, Mark

3 2

base64 CMC Request format
by Elliott William C OSS sIT 13 Jul '16

13 Jul '16

Hi all, Can Dogtag (in this case v. 9.0.3-30.el6 ) be coerced into accepting base64-encoded CMC requests? Is there a parameter somewhere? Or would it require reprogramming? We have a (smart-)card management system (runs under Windows) which sends the requests and expects the responses to both be base64 encoded. Thanks and best regards, William Elliott s IT Solutions Open System Services

4 6

Fedora 22 - ESC Error
by Thornton, Neill R. CIV 29 Jan '16

29 Jan '16

All, I am hoping someone can help me out with a green field Dogtag install. We have installed all of the correct subsystems, and wanted to try and provision a hardware smart card. We are using Axalto Cyberflex 64k cards for testing. This is on Fedora 22, both the Dogtag server and the enrollment workstation have been updated using dnf to the latest packages. pcsc_scan on the enrollment station reports the following: PC/SC device scanner V 1.4.23 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau(a)free.fr> Compiled with PC/SC lite version: 1.8.13 Using reader plug'n play mechanism Scanning present readers... 0: SCM Microsystems Inc. SCR 355 [CCID Interface] 00 00 Tue Jan 26 17:42:20 2016 Reader 0: SCM Microsystems Inc. SCR 355 [CCID Interface] 00 00 Card state: Card inserted, Shared Mode, ATR: 3B 95 95 40 FF AE 01 03 00 00 defined(@array) is deprecated at /usr/lib64/perl5/vendor_perl/Chipcard/PCSC.pm l ine 69. (Maybe you should just omit the defined()?) ATR: 3B 95 95 40 FF AE 01 03 00 00 + TS = 3B --> Direct Convention + T0 = 95, Y(1): 1001, K: 5 (historical bytes) TA(1) = 95 --> Fi=512, Di=16, 32 cycles/ETU 125000 bits/s at 4 MHz, fMax for Fi = 5 MHz => 156250 bits/s TD(1) = 40 --> Y(i+1) = 0100, Protocol T = 0 ----- TC(2) = FF --> Work waiting time: 960 x 255 x (Fi/F) + Historical bytes: AE 01 03 00 00 Category indicator byte: AE (proprietary format) Possibly identified card (using /usr/share/pcsc/smartcard_list.txt): 3B 95 95 40 FF AE 01 03 00 00 Axalto - Cyberflex 64K Gemalto TOP IM FIPS CY2 (product code HWP115291A) -- However, when we start esc, either as root or as a user, the GUI will start and display no smart cards. When the "Diagnostics" button is pressed, an error dialog appears saying "coolkey.GetAvailableCoolKeys() failed! Undefined(undefined)". After pressing OK, the diagnostic window displays, confirming 0 smart cards are detected. System versions are listed as: Smart Card Manager Version: null System Versions: Mozilla/5.0 (x11; linux x86_64; rv:38.0) gecko/20100101 esc/1.1.0-24 Any insight to our problem would be greatly appreciated! Thanks, Neill -- Neill Thornton Chief Information Officer - Medical Treatment Facility USNS Mercy 619-235-3857 - Desk 619-206-5426 - Cell neill.thornton(a)mercy.navy.mil / neill.thornton(a)mercy.navy.smil.mil

2 4

(no subject)
by Pascal Jakobi 27 Jan '16

27 Jan '16

I am surely doing something wrong but can't figure out what... Context : FC22. PKI version : 10.2.6 Running pkispawn fails at startup. Is this still the procedure ? Anywway, the error is : No connection - exception thrown: 404 Client Error: Not Found for url: https://w530.jakobi.fr:8443/ca/admin/ca/getStatus -- *Pascal Jakobi* 116 rue de Stalingrad 93100 Montreuil, France *+33 6 87 47 58 19*Pascal.Jakobi(a)gmail.com

2 3

Extension cannot be cast to netscape.security.x509.CRLDistributionPointsExtension
by Aleksey Chudov 25 Jan '16

25 Jan '16

Hi, I have the following Dogtag PKI packages installed (rebuild from Fedora src rpms) # rpm -qa 'dogtag*' '*pki*' pki-server-10.2.6-7.el7.centos.noarch pki-tools-10.2.6-7.el7.centos.x86_64 dogtag-pki-server-theme-10.2.6-1.el7.centos.noarch pki-ca-10.2.6-7.el7.centos.noarch pki-base-10.2.6-7.el7.centos.noarch dogtag-pki-console-theme-10.2.6-1.el7.centos.noarch I have enabled CRLDistributionPointsExtension in all profiles and after every PKI restart I can't approve new requests. The following error message is displayed instead of regular certificate approval form --- The Certificate System has encountered an unrecoverable error. Error Message: java.lang.ClassCastException: netscape.security.x509.Extension cannot be cast to netscape.security.x509.CRLDistributionPointsExtension Please contact your local administrator for assistance. --- Full Exception from /var/log/pki/pki-tomcat/localhost.2016-01-25.log Jan 25, 2016 7:42:08 PM org.apache.catalina.core.ApplicationContext log INFO: caProfileReview: java.lang.ClassCastException: netscape.security.x509.Extension cannot be cast to netscape.security.x509.CRLDistributionPointsExtension at com.netscape.cms.profile.def.CRLDistributionPointsExtDefault.getValue(CRLDistributionPointsExtDefault.java:402) at com.netscape.cms.profile.def.EnrollDefault.getValue(EnrollDefault.java:286) at com.netscape.cms.servlet.profile.ProfileReviewServlet.handlePolicy(ProfileReviewServlet.java:425) at com.netscape.cms.servlet.profile.ProfileReviewServlet.process(ProfileReviewServlet.java:248) at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:513) at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) at sun.reflect.GeneratedMethodAccessor65.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:536) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:169) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:297) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at sun.reflect.GeneratedMethodAccessor53.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:536) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:249) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:193) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:607) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:745) I have found bug report https://bugzilla.redhat.com/show_bug.cgi?format=multiple&id=639082. Proposed workaround https://bugzilla.redhat.com/show_bug.cgi?id=639082#c13 works but it is very inconvenient to create / reject new dumb request after every PKI restart. As I have three CA servers I need to create / reject dump request per server. Do you have plans to fix the issue? Or maybe it is already fixed in some commit? Regadrs, Aleksey

1 0

Windows Auto Enrollment Proxy installer
by Roberto Casiano 22 Jan '16

22 Jan '16

Hello, Anybody know where I can download the installer or exe for Windows Auto Enrollment Proxy? The link to http://directory.fedoraproject.org/wiki/Windows_Certificate_Auto_Enrollment is broken. Thanks, Rob This email, and any attachment, is confidential and also privileged. If you have received it in error, please notify me immediately and delete it from your system along with any attachments. You should not copy or use it for any purpose, nor disclose its contents to any other person.

1 0

[dogtag] CA Issuers fields in authinfoaccess extension - how?
by marcin kowalski 15 Jan '16

15 Jan '16

Hi all ; I am running a subordinate ca dogtag instance, and i would like to copy AuthInfoExtension fields from the master ca cert into final certificates signed in dogtag I am struggling to add a few caIssuers fields to authInfoExtension fields in issued certificates the fields in question are to be like so (from openssl output of the master ca certificate) CA Issuers - URI:http://server/name.crt CA Issuers - URI:http://backupserver/name.crt Are there any examples out there so that i can figure this out?

2 2

CRL Distribution point
by Sam Elliott 04 Jan '16

04 Jan '16

Hi, I maybe missing something here, but I have configured CRL distribution point within the certificate profile, and this shows up within generated certificates, but when I setup the CRL issuing distribution point it doesn't seem to have any affect. I have enabled it, configured pointType to DirectoryName and then pointName to crl/master.crl, after revoking some certs I try downloading the CRL but get a 404, not sure if I am missing something with the configuration? Regards, Sam -- opencredo.com <http://www.opencredo.com/> . Twitter <https://twitter.com/OpenCredo> . LinkedIn <https://www.linkedin.com/company/opencredo> OpenCredo Ltd -- Excellence in Enterprise Application Development Registered Office: 5-11 Lavington Street, London, SE1 0NZ Registered in UK. No 3943999

2 1