On Wed, Apr 08, 2015 at 09:35:31AM -0500, Steve Neuharth wrote:
> yes, I have indeed set SELinux to permissive to eliminate any potential
> security collisions.
>
> If I configure my 'DogtagAuto' CA in /var/lib/certmonger/cas without the '-T
> caAgentServerCert', the certmonger daemon dies as soon as I request a
> certificate using that CA. Other than that, it looks like I'm using the
> same flags as you.
Well, it shouldn't be dying at least. If you can get a coredump or a
backtrace out of it, that'll help track it down. I'm not really sure
how the use (or not) of the -T flag with the helper could be affecting
that, though, as when I tried obtaining a certificate using it and the
caServerCert profile, it succeeded.
I got an authentication error attempting to specify the
caAgentServerCert profile, which makes some sense since the helper
submits the request using using the end-entity services interface and
only uses the agent creds when it goes back to approve it using the
agent services interface.
> when I run dogtag-submit this way manually (without the template), I see
> that it reutrns: results = "<?xml version="1.0" encoding="UTF-8"
> standalone="no"?><XMLResponse><Status>2</Status><Error>Request Deferred -
> {0}</Error><RequestId> 70</RequestId></XMLResponse>"
> 0
> state=approve&requestId=70
>
> I find it strange that this response would crash certmonger. Also, wouldn't
> I need to specify a template if I need to automatically sign the cert and
> get the cert immediately?
The helper hard-codes a default of "caServerCert" if the flag isn't
used, and that looks like a pretty normal delay-and-state-cookie output
value to me, so a backtrace would be really helpful in diagnosing what's
happening when you try it.
HTH,
Nalin