Post the existing Root CA certificate and the new DogTag SubCA certificate (in Base64-encoded format) to the forum. Without looking at the certificates, its hard to debug the issue. Also, do you have the current Root CA's certificate stored as a trusted CA within DogTag's cert-store, and within the web-server with which you are trying to establish an SSL connection? Arshad Noor StrongAuth, Inc. Michael StJohns wrote:
Hi -
One of my customers has an existing root key pair and CA cert that exists outside of Dogtag. I want to create a CA immediately subordinate to that root CA and use Dogtag for it.
After numerous attempts to adopt Dogtag to an external CA, I admit to defeat. I've tried this with and without a PKCS7 chain, I've tried various extensions and formats for the new CA cert, etc.
The CA system comes up, looks good, but looking at the SSL hand shake with "openssl s_client" shows that the server isn't providing the entire chain, only the certificate for the server itself.
Taking all of the certs in the chain from root through server and running them through the Java cert path checking routines seems to indicate the certs are fine.
If I build a system from scratch - with a new root cert and key pair in one CA and then build a subordinate CA under that in the same domain it works perfectly.
Has anyone else tried this? If so, can you give me a step-by-step please?
Help!
Mike
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users