10:46 a.m.
Hello All,
When I install the Dogtag Certificate System, the installation creates default PKI
Administrator user (caadmin).
What is the procedure to setup additional PKI Administrator users so that they can also
access agent interface?
Thanks,
Mahendra
“This message (including any attachments) is intended only for the use of the individual
or entity to which it is addressed, and may contain information that is non-public,
proprietary, privileged, confidential and exempt from disclosure under applicable law or
may be constituted as attorney work product. If you are not the intended recipient, you
are hereby notified that any use, dissemination, distribution, or copying of this
communication is strictly prohibited. If you have received this message in error, notify
sender immediately and delete this message immediately.”
11:24 a.m.
Dear Mahendra,
You can get it done through the pkiconsole.
first create a new user via the web interface.
Then open the pkiconsole, go to users and groups and add a new user for the
system. Set the required attributes and add that user to the "Certificate
Manager Agents" group. use the certificate of the new user created via the
web interface.
hope this will help
Regards,
Nalinda
On Mon, Mar 30, 2015 at 9:16 PM, Jain, Mahendra <Majain(a)verisign.com> wrote:
Hello All,
When I install the Dogtag Certificate System, the installation creates
default PKI Administrator user (caadmin).
What is the procedure to setup additional PKI Administrator users so that
they can also access agent interface?
Thanks,
Mahendra
"This message (including any attachments) is intended only for the use of
the individual or entity to which it is addressed, and may contain
information that is non-public, proprietary, privileged, confidential and
exempt from disclosure under applicable law or may be constituted as
attorney work product. If you are not the intended recipient, you are
hereby notified that any use, dissemination, distribution, or copying of
this communication is strictly prohibited. If you have received this
message in error, notify sender immediately and delete this message
immediately."
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
--
Best Regards,
Nalinda
11:24 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/30/2015 09:16 PM, Jain, Mahendra wrote:
Hello All,
When I install the Dogtag Certificate System, the installation creates default PKI
Administrator user (caadmin).
What is the procedure to setup additional PKI Administrator users so that they can also
access agent interface?
If you are on latest dogtag (fedora 20), you could pki user
cli to create user and add him to Certificate Manager Agents Group .
Also use a user profile to generate cert for the new user and add the cert using pki user
cli . Import the cert to browser (including keys).
You could do the same using pkiconsole too.
Thanks,
Mahendra
“This message (including any attachments) is intended only for the use of the
individual or entity to which it is addressed, and may contain
information that is non-public, proprietary, privileged, confidential and
exempt from disclosure under applicable law or may be constituted
as attorney work product. If you are not the intended recipient, you are hereby
notified that any use, dissemination, distribution, or
copying of this communication is strictly prohibited. If you have received this
message in error, notify sender immediately and delete this
message immediately.”
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
- --
Niranjan
irc: mrniranjan
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iKYEARECAGYFAlUZeMRfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl
bnBncC5maWZ0aGhvcnNlbWFuLm5ldEY3OTE3QTg3ODE0RkVCQ0YyNjgyOTRENjJF
RURDNTVGNjA0N0M3QzcACgkQLu3FX2BHx8dsCwCgh14OK+0ZFyFYUWkEt04Idgq0
E4kAoIohPEYgdwXYLXPiMunLSyDhEOQz
=766t
-----END PGP SIGNATURE-----
12:37 p.m.
Hi Nalinda,
Thanks for the quick response.
How do I create a new user via the web interface?
Do you mean submit a 'Manual User Dual-Use Certificate Enrollment’ request via end
user interface and once the request is approved, use that certificate when creating user
via PKIConsole?
Thanks,
Mahendra
From: Nalinda Herath <nali.mrt@gmail.com<mailto:nali.mrt@gmail.com>>
Date: Monday, March 30, 2015 at 12:24 PM
To: "Jain, Mahendra"
<majain@verisign.com<mailto:majain@verisign.com>>
Cc: "pki-users@redhat.com<mailto:pki-users@redhat.com>"
<pki-users@redhat.com<mailto:pki-users@redhat.com>>
Subject: Re: [Pki-users] How to setup PKI Administrator user
Dear Mahendra,
You can get it done through the pkiconsole.
first create a new user via the web interface.
Then open the pkiconsole, go to users and groups and add a new user for the system. Set
the required attributes and add that user to the "Certificate Manager Agents"
group. use the certificate of the new user created via the web interface.
hope this will help
Regards,
Nalinda
On Mon, Mar 30, 2015 at 9:16 PM, Jain, Mahendra
<Majain@verisign.com<mailto:Majain@verisign.com>> wrote:
Hello All,
When I install the Dogtag Certificate System, the installation creates default PKI
Administrator user (caadmin).
What is the procedure to setup additional PKI Administrator users so that they can also
access agent interface?
Thanks,
Mahendra
“This message (including any attachments) is intended only for the use of the individual
or entity to which it is addressed, and may contain information that is non-public,
proprietary, privileged, confidential and exempt from disclosure under applicable law or
may be constituted as attorney work product. If you are not the intended recipient, you
are hereby notified that any use, dissemination, distribution, or copying of this
communication is strictly prohibited. If you have received this message in error, notify
sender immediately and delete this message immediately.”
_______________________________________________
Pki-users mailing list
Pki-users@redhat.com<mailto:Pki-users@redhat.com>
https://www.redhat.com/mailman/listinfo/pki-users
--
Best Regards,
Nalinda
9:22 p.m.
Yes mahendra
On Mar 30, 2015 11:07 PM, "Jain, Mahendra" <Majain(a)verisign.com> wrote:
Hi Nalinda,
Thanks for the quick response.
How do I create a new user via the web interface?
Do you mean submit a 'Manual User Dual-Use Certificate Enrollment' request
via end user interface and once the request is approved, use that
certificate when creating user via PKIConsole?
Thanks,
Mahendra
From: Nalinda Herath <nali.mrt(a)gmail.com>
Date: Monday, March 30, 2015 at 12:24 PM
To: "Jain, Mahendra" <majain(a)verisign.com>
Cc: "pki-users(a)redhat.com" <pki-users(a)redhat.com>
Subject: Re: [Pki-users] How to setup PKI Administrator user
Dear Mahendra,
You can get it done through the pkiconsole.
first create a new user via the web interface.
Then open the pkiconsole, go to users and groups and add a new user for
the system. Set the required attributes and add that user to the
"Certificate Manager Agents" group. use the certificate of the new user
created via the web interface.
hope this will help
Regards,
Nalinda
On Mon, Mar 30, 2015 at 9:16 PM, Jain, Mahendra <Majain(a)verisign.com>
wrote:
> Hello All,
>
> When I install the Dogtag Certificate System, the installation creates
> default PKI Administrator user (caadmin).
> What is the procedure to setup additional PKI Administrator users so that
> they can also access agent interface?
>
> Thanks,
> Mahendra
> "This message (including any attachments) is intended only for the use of
> the individual or entity to which it is addressed, and may contain
> information that is non-public, proprietary, privileged, confidential and
> exempt from disclosure under applicable law or may be constituted as
> attorney work product. If you are not the intended recipient, you are
> hereby notified that any use, dissemination, distribution, or copying of
> this communication is strictly prohibited. If you have received this
> message in error, notify sender immediately and delete this message
> immediately."
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-users
>
--
Best Regards,
Nalinda
1:15 p.m.
Hi Nalinda,
I requested the certificate using 'Manual User Dual-Use Certificate Enrollment’
option.
However, when I tried to import the generated certificate into Firefox browser, I get
following error:
'This personal certificate can't be installed because you don't own the
corresponding private key which was created when the certificate was requested.'
To work around this, I manually created private key and CSR on the client machine using
following steps:
1. Generate a new private key and Certificate Signing Request:
$ openssl req -out operator.csr -new -newkey rsa:2048 -nodes -keyout operator.key
2. Submit a CSR using ‘Manual Administrator Certificate Enrollment’ option via end user
interface
(Note: Ensure that the Subject Name field is populated with the exact value as it appears
in the Subject attribute of CSR)
3. Create a pkcs#12 file once the above CSR is approved:
$ openssl pkcs12 -export -out operator.p12 -inkey operator.key -in operator.cert -certfile
ca.cert
4. Using PKIConsole, create a new user, add that user to the "Certificate Manager
Agents” group and associate the certificate (operator.cert) obtained in the step#3 above
5. Launch Firefox browser and import pkcs#12 file (operator.p12) under 'Your
Certificates’ section
With these steps, I can now successfully access agent interface.
So, I would like to know when and how 'Manual User Dual-Use Certificate Enrollment’
option is useful in overall solution.
Thanks,
Mahendra
From: Nalinda Herath <nali.mrt@gmail.com<mailto:nali.mrt@gmail.com>>
Date: Monday, March 30, 2015 at 10:22 PM
To: "Jain, Mahendra"
<majain@verisign.com<mailto:majain@verisign.com>>
Cc: "pki-users@redhat.com<mailto:pki-users@redhat.com>"
<pki-users@redhat.com<mailto:pki-users@redhat.com>>
Subject: Re: [Pki-users] How to setup PKI Administrator user
Yes mahendra
On Mar 30, 2015 11:07 PM, "Jain, Mahendra"
<Majain@verisign.com<mailto:Majain@verisign.com>> wrote:
Hi Nalinda,
Thanks for the quick response.
How do I create a new user via the web interface?
Do you mean submit a 'Manual User Dual-Use Certificate Enrollment’ request via end
user interface and once the request is approved, use that certificate when creating user
via PKIConsole?
Thanks,
Mahendra
From: Nalinda Herath <nali.mrt@gmail.com<mailto:nali.mrt@gmail.com>>
Date: Monday, March 30, 2015 at 12:24 PM
To: "Jain, Mahendra"
<majain@verisign.com<mailto:majain@verisign.com>>
Cc: "pki-users@redhat.com<mailto:pki-users@redhat.com>"
<pki-users@redhat.com<mailto:pki-users@redhat.com>>
Subject: Re: [Pki-users] How to setup PKI Administrator user
Dear Mahendra,
You can get it done through the pkiconsole.
first create a new user via the web interface.
Then open the pkiconsole, go to users and groups and add a new user for the system. Set
the required attributes and add that user to the "Certificate Manager Agents"
group. use the certificate of the new user created via the web interface.
hope this will help
Regards,
Nalinda
On Mon, Mar 30, 2015 at 9:16 PM, Jain, Mahendra
<Majain@verisign.com<mailto:Majain@verisign.com>> wrote:
Hello All,
When I install the Dogtag Certificate System, the installation creates default PKI
Administrator user (caadmin).
What is the procedure to setup additional PKI Administrator users so that they can also
access agent interface?
Thanks,
Mahendra
“This message (including any attachments) is intended only for the use of the individual
or entity to which it is addressed, and may contain information that is non-public,
proprietary, privileged, confidential and exempt from disclosure under applicable law or
may be constituted as attorney work product. If you are not the intended recipient, you
are hereby notified that any use, dissemination, distribution, or copying of this
communication is strictly prohibited. If you have received this message in error, notify
sender immediately and delete this message immediately.”
_______________________________________________
Pki-users mailing list
Pki-users@redhat.com<mailto:Pki-users@redhat.com>
https://www.redhat.com/mailman/listinfo/pki-users
--
Best Regards,
Nalinda
2:23 p.m.
Thanks Niranjan,
I submitted 'Manual User Dual-Use Certificate Enrollment¹ via End User
interface and got it approved via agent interface and imported it to
browser including the keys.
My confusion is where the keys (private key) came from? Was it
automatically generated when I submitted the Certificate Enrollment
request via browser? Or was it created by the Dogtag server and delivered
it to browser when I imported the cert?
Thanks in advance.
Mahendra
On 3/30/15, 12:24 PM, "Niranjan M.R" <mrniranjan(a)redhat.com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/30/2015 09:16 PM, Jain, Mahendra wrote:
> Hello All,
>
> When I install the Dogtag Certificate System, the installation creates
>default PKI Administrator user (caadmin).
> What is the procedure to setup additional PKI Administrator users so
>that they can also access agent interface?
If you are on latest dogtag (fedora 20), you could pki user cli to create
user and add him to Certificate Manager Agents Group .
Also use a user profile to generate cert for the new user and add the
cert using pki user cli . Import the cert to browser (including keys).
You could do the same using pkiconsole too.
>
> Thanks,
> Mahendra
>
>
> ³This message (including any attachments) is intended only
>for the use of the individual or entity to which it is addressed, and
>may contain
> information that is non-public, proprietary, privileged,
>confidential and exempt from disclosure under applicable law or may be
>constituted
> as attorney work product. If you are not the intended
>recipient, you are hereby notified that any use, dissemination,
>distribution, or
> copying of this communication is strictly prohibited. If you
>have received this message in error, notify sender immediately and
>delete this
> message immediately.²
>
>
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-users
>
- --
Niranjan
irc: mrniranjan
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iKYEARECAGYFAlUZeMRfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl
bnBncC5maWZ0aGhvcnNlbWFuLm5ldEY3OTE3QTg3ODE0RkVCQ0YyNjgyOTRENjJF
RURDNTVGNjA0N0M3QzcACgkQLu3FX2BHx8dsCwCgh14OK+0ZFyFYUWkEt04Idgq0
E4kAoIohPEYgdwXYLXPiMunLSyDhEOQz
=766t
-----END PGP SIGNATURE-----
4:29 p.m.
On 4/9/2015 2:23 PM, Jain, Mahendra wrote:
Thanks Niranjan,
I submitted 'Manual User Dual-Use Certificate Enrollment¹ via End User
interface and got it approved via agent interface and imported it to
browser including the keys.
My confusion is where the keys (private key) came from? Was it
automatically generated when I submitted the Certificate Enrollment
request via browser? Or was it created by the Dogtag server and delivered
it to browser when I imported the cert?
Thanks in advance.
Mahendra
To my understanding the current UI relies on a Firefox feature to
generate a private key in the browser. However, this feature is going
away in future Firefox, so Dogtag is now providing a way to generate a
private key using the CLI:
http://pki.fedoraproject.org/wiki/User_Certificate
The private key later can be imported into Firefox.
If you want to use a non-root Linux user as CA admin with a new
certificate, follow the above page to generate the certificate, then add
the user into the admin group.
If you want to use a non-root Linux user as CA admin with existing CA
admin certificate, follow this instruction:
http://pki.fedoraproject.org/wiki/CA_Admin_Setup
--
Endi S. Dewata
7:32 p.m.
Thanks Endi for the quick response.
On 4/9/15, 5:29 PM, "Endi Sukma Dewata" <edewata(a)redhat.com> wrote:
On 4/9/2015 2:23 PM, Jain, Mahendra wrote:
> Thanks Niranjan,
>
> I submitted 'Manual User Dual-Use Certificate Enrollment¹ via End User
> interface and got it approved via agent interface and imported it to
> browser including the keys.
>
> My confusion is where the keys (private key) came from? Was it
> automatically generated when I submitted the Certificate Enrollment
> request via browser? Or was it created by the Dogtag server and
>delivered
> it to browser when I imported the cert?
>
>
> Thanks in advance.
> Mahendra
>
To my understanding the current UI relies on a Firefox feature to
generate a private key in the browser. However, this feature is going
away in future Firefox, so Dogtag is now providing a way to generate a
private key using the CLI:
http://pki.fedoraproject.org/wiki/User_Certificate
The private key later can be imported into Firefox.
If you want to use a non-root Linux user as CA admin with a new
certificate, follow the above page to generate the certificate, then add
the user into the admin group.
If you want to use a non-root Linux user as CA admin with existing CA
admin certificate, follow this instruction:
http://pki.fedoraproject.org/wiki/CA_Admin_Setup
--
Endi S. Dewata
3312
days inactive
3323
days old
8 comments
4 participants
participants (4)
-
Endi Sukma Dewata -
Jain, Mahendra -
Nalinda Herath -
Niranjan M.R