Hi, I've updated DogTag to the current modules available (FC11 x86_64): dogtag-pki-ca-ui-1.3.1-1.fc11.noarch dogtag-pki-common-ui-1.3.1-1.fc11.noarch dogtag-pki-console-ui-1.3.1-1.fc11.noarch pki-ca-1.3.3-1.fc11.noarch pki-common-1.3.3-1.fc11.noarch pki-console-1.3.1-1.fc11.noarch pki-java-tools-1.3.1-1.fc11.noarch pki-native-tools-1.3.0-5.fc11.x86_64 pki-selinux-1.3.4-1.fc11.noarch pki-setup-1.3.4-1.fc11.noarch pki-silent-1.3.2-1.fc11.noarch pki-symkey-1.3.2-3.fc11.x86_64 pki-util-1.3.0-5.fc11.noarch I've installed and successfully tested a Utimaco CryptoServer HSM on the operating system, including adding it to secmod.db (in the /var/lib/subca01/alias directory), generating a RSA key-pair, issuing a self-signed and listing the objects using certutil (the attached hsm-config.txt file shows sample output). I've modified CS.cfg in /etc/subca01 to include this token (as the attached modules.txt file shows). I've even restarted pki-cad services after adding the HSM to secmod.db, to ensure that the DogTag code reads secmod.db with the CryptoServer configured in it. However, when it comes time to install a Subordinate CA, the KeyStore page claims that the Utimaco HSM is not found (see keystore-page.png) even though it is correctly listed on the page under "Supported Security Modules". What am I missing? How do I get DogTag to use the HSM to generate the key-pair? Thanks. Arshad Noor StrongAuth, Inc. # pet105:/var/lib/subca01/alias> modutil -dbdir . -nocertdb -list CryptoServer ----------------------------------------------------------- Name: CryptoServer Library file: /usr/local/utimaco/lib/libcs2_pkcs11.so Manufacturer: Utimaco Safeware AG Description: CryptoServer PKCS11 library PKCS #11 Version 2.20 Library Version: 1.48 Cipher Enable Flags: None Default Mechanism Flags: None Slot: CryptoServer Device '/dev/cs2' - Slot No: 0 Slot Mechanism Flags: None Manufacturer: Utimaco Safeware AG Type: Hardware Version Number: 0.0 Firmware Version: 1.6 Status: Enabled Token Name: CBUAE TEST Token Manufacturer: Utimaco Safeware AG Token Model: CryptoServer Token Serial Number: Se1000 CS410019 Token Version: 0.0 Token Firmware Version: 1.6 Access: NOT Write Protected Login Type: Login required User Pin: Initialized ----------------------------------------------------------- # pet105:/var/lib/subca01/alias> certutil -K -d . -h "CBUAE TEST" certutil: Checking token "CBUAE TEST" in slot "CryptoServer Device '/dev/cs2' - Slot No: 0" Enter Password or Pin for "CBUAE TEST": < 0> rsa 1f391f4675efbc5a22d7aa7a0c762b08b793b87a (orphan) < 1> rsa 8329905b66d6e34c25a63c23dee6cd65acc598f1 CBUAE TEST:testcert # pet105:/var/lib/subca01/alias> certutil -L -d . -h "CBUAE TEST" -n testcert Enter Password or Pin for "CBUAE TEST": Certificate: Data: Version: 3 (0x2) Serial Number: 123 (0x7b) Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption Issuer: "CN=TEST Cert" Validity: Not Before: Thu Apr 15 23:33:58 2010 Not After : Thu Jul 15 23:33:58 2010 Subject: "CN=TEST Cert" Subject Public Key Info: Public Key Algorithm: PKCS #1 RSA Encryption RSA Public Key: Modulus: ae:43:b3:10:f4:28:d0:e9:4a:b0:df:80:24:a8:1c:a7: 7f:fc:33:7c:1b:cd:57:e3:67:8f:fc:a6:a6:c5:07:01: cf:67:3a:c6:6f:2f:16:4d:4b:66:92:6a:33:65:a9:24: a1:57:d1:6e:79:73:72:0a:b8:fb:97:9e:bf:b5:34:df: 3c:a3:6b:54:4f:54:70:57:e8:70:ed:da:b1:c9:3a:3c: 35:c0:74:1c:06:be:2e:54:b1:21:c3:69:ec:77:d5:80: 49:8f:80:35:24:00:83:35:7c:a9:19:a7:3c:41:51:63: a3:3b:0d:6a:b3:32:ec:16:b4:90:43:0c:98:ee:5a:f0: 05:c5:06:d0:1b:9f:ab:9d:56:43:e3:f1:87:a6:7e:4b: 5e:4e:4f:65:37:1c:42:79:73:fb:bf:1a:f4:ed:23:c3: b7:16:5a:c9:1a:65:35:64:34:86:6a:10:5d:f3:66:25: 13:5a:85:49:e3:9a:07:00:05:ee:cf:2a:71:72:fe:3a: ae:dd:4a:70:5a:a2:42:6e:33:3b:15:a2:4f:81:1c:30: 93:79:c4:11:db:5b:08:d6:55:73:d9:86:19:1d:87:cf: 4b:e6:e4:10:a0:b4:a2:84:68:4d:5a:53:b8:97:64:68: 07:9e:84:a7:e5:48:ac:be:01:19:be:8a:e6:95:20:19 Exponent: 65537 (0x10001) Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption Signature: 44:b4:bf:8c:f5:22:4e:fe:42:64:5d:f4:e5:73:3a:25: b8:8c:1e:1c:68:7a:65:ce:30:c2:f2:ab:41:1f:58:3b: 70:50:92:b4:81:fc:f4:5a:b1:f3:b3:69:6e:4e:7a:c0: 94:2a:b2:23:4e:41:24:59:0f:62:87:0d:a2:37:cb:67: a5:d2:01:91:aa:74:0f:c0:27:f0:7d:d3:0b:16:48:f8: d9:69:6b:b2:84:80:7e:71:79:5d:11:9d:d6:1a:47:4d: 62:ba:f6:09:28:41:36:e2:78:12:9b:41:fd:df:84:de: b2:91:fa:3e:99:aa:04:17:3e:ff:f7:6f:19:78:4e:a7: aa:77:0a:aa:d2:ee:d1:e4:f2:cf:92:68:e8:79:1f:f3: 10:b0:3e:bd:2d:33:a4:bc:7f:66:ea:31:71:c5:7c:4f: a8:0f:db:25:f2:60:1d:dc:a5:98:73:e3:1e:4b:94:80: 5c:f7:65:69:21:ff:3a:30:55:f6:67:29:f3:e1:aa:a4: b8:40:9b:c3:8e:90:3b:5b:18:95:36:89:23:22:32:8d: 7c:46:a8:5b:10:2c:2e:99:49:d5:cb:18:f1:04:8f:40: 7e:b7:80:d3:1f:32:50:78:2a:c9:b4:c5:e0:78:b9:93: 63:ac:b4:85:ca:7e:a8:36:9d:6c:58:4c:3a:2f:a7:66 Fingerprint (MD5): 3F:AD:29:3F:60:58:27:9D:19:66:88:AC:7A:BF:0A:DC Fingerprint (SHA1): 9F:C1:1B:0A:08:D8:1C:80:50:60:BF:0A:47:5E:3E:2C:29:3C:52:CD Certificate Trust Flags: SSL Flags: Valid Peer Trusted Email Flags: Object Signing Flags: # pet105:/etc/subca01> grep Modules CS.cfg preop.configModules.count=4 preop.configModules.module0.commonName=NSS Internal PKCS #11 Module preop.configModules.module0.imagePath=../img/clearpixel.gif preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module preop.configModules.module1.commonName=nfast preop.configModules.module1.imagePath=../img/clearpixel.gif preop.configModules.module1.userFriendlyName=nCipher's nFast Token Hardware Module preop.configModules.module2.commonName=lunasa preop.configModules.module2.imagePath=../img/clearpixel.gif preop.configModules.module2.userFriendlyName=SafeNet's LunaSA Token Hardware Module preop.configModules.module3.commonName=CryptoServer preop.configModules.module3.imagePath=../img/clearpixel.gif preop.configModules.module3.userFriendlyName=Utimacos's CryptoServer Hardware Security Module
Any chance you're trying to use the same Slot for multiple CAs? The module listing only shows a single slot. It's possible/probable that won't work. Try initializing a second slot on the UT and try again. Mike On 4/15/2010 8:49 PM, Arshad Noor wrote:
Hi,
I've updated DogTag to the current modules available (FC11 x86_64):
dogtag-pki-ca-ui-1.3.1-1.fc11.noarch dogtag-pki-common-ui-1.3.1-1.fc11.noarch dogtag-pki-console-ui-1.3.1-1.fc11.noarch
pki-ca-1.3.3-1.fc11.noarch pki-common-1.3.3-1.fc11.noarch pki-console-1.3.1-1.fc11.noarch pki-java-tools-1.3.1-1.fc11.noarch pki-native-tools-1.3.0-5.fc11.x86_64 pki-selinux-1.3.4-1.fc11.noarch pki-setup-1.3.4-1.fc11.noarch pki-silent-1.3.2-1.fc11.noarch pki-symkey-1.3.2-3.fc11.x86_64 pki-util-1.3.0-5.fc11.noarch
I've installed and successfully tested a Utimaco CryptoServer HSM on the operating system, including adding it to secmod.db (in the /var/lib/subca01/alias directory), generating a RSA key-pair, issuing a self-signed and listing the objects using certutil (the attached hsm-config.txt file shows sample output).
I've modified CS.cfg in /etc/subca01 to include this token (as the attached modules.txt file shows).
I've even restarted pki-cad services after adding the HSM to secmod.db, to ensure that the DogTag code reads secmod.db with the CryptoServer configured in it.
However, when it comes time to install a Subordinate CA, the KeyStore page claims that the Utimaco HSM is not found (see keystore-page.png) even though it is correctly listed on the page under "Supported Security Modules".
What am I missing?
How do I get DogTag to use the HSM to generate the key-pair?
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
This is the only CA using the HSM. The TEST Root was setup using the Internal token. Arshad Noor StrongAuth, Inc. Michael StJohns wrote:
Any chance you're trying to use the same Slot for multiple CAs? The module listing only shows a single slot. It's possible/probable that won't work. Try initializing a second slot on the UT and try again.
Mike
On 4/15/2010 8:49 PM, Arshad Noor wrote:
Hi,
I've updated DogTag to the current modules available (FC11 x86_64):
dogtag-pki-ca-ui-1.3.1-1.fc11.noarch dogtag-pki-common-ui-1.3.1-1.fc11.noarch dogtag-pki-console-ui-1.3.1-1.fc11.noarch
pki-ca-1.3.3-1.fc11.noarch pki-common-1.3.3-1.fc11.noarch pki-console-1.3.1-1.fc11.noarch pki-java-tools-1.3.1-1.fc11.noarch pki-native-tools-1.3.0-5.fc11.x86_64 pki-selinux-1.3.4-1.fc11.noarch pki-setup-1.3.4-1.fc11.noarch pki-silent-1.3.2-1.fc11.noarch pki-symkey-1.3.2-3.fc11.x86_64 pki-util-1.3.0-5.fc11.noarch
I've installed and successfully tested a Utimaco CryptoServer HSM on the operating system, including adding it to secmod.db (in the /var/lib/subca01/alias directory), generating a RSA key-pair, issuing a self-signed and listing the objects using certutil (the attached hsm-config.txt file shows sample output).
I've modified CS.cfg in /etc/subca01 to include this token (as the attached modules.txt file shows).
I've even restarted pki-cad services after adding the HSM to secmod.db, to ensure that the DogTag code reads secmod.db with the CryptoServer configured in it.
However, when it comes time to install a Subordinate CA, the KeyStore page claims that the Utimaco HSM is not found (see keystore-page.png) even though it is correctly listed on the page under "Supported Security Modules".
What am I missing?
How do I get DogTag to use the HSM to generate the key-pair?
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
------------------------------------------------------------------------
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Sorry - after I sent my earlier email I realized you probably encountered the same problem I did. I need to report the bug to Utimaco/Sophos, but the driver on the 2.01 disk for Linux appears to have problems finding the configuration file in the standard locations. I'm not sure exactly what the problem is. You can duplicate this by clearing the CS2_PKCS11_INI environment variable, placing the cs2_pkcs11.ini file in one of the standard locations - e.g. /usr/etc/cs2_pkcs11.ini and then running the modutil command again over a blank database and try and add the module again. If you get the error CKR_FUNCTION_FAILED - its the same issue. Strangely enough, the config file is found, its just not loaded for some reason. (Do an 'strace' and look at the "access" calls). Mike On 4/15/2010 8:49 PM, Arshad Noor wrote:
Hi,
I've updated DogTag to the current modules available (FC11 x86_64):
dogtag-pki-ca-ui-1.3.1-1.fc11.noarch dogtag-pki-common-ui-1.3.1-1.fc11.noarch dogtag-pki-console-ui-1.3.1-1.fc11.noarch
pki-ca-1.3.3-1.fc11.noarch pki-common-1.3.3-1.fc11.noarch pki-console-1.3.1-1.fc11.noarch pki-java-tools-1.3.1-1.fc11.noarch pki-native-tools-1.3.0-5.fc11.x86_64 pki-selinux-1.3.4-1.fc11.noarch pki-setup-1.3.4-1.fc11.noarch pki-silent-1.3.2-1.fc11.noarch pki-symkey-1.3.2-3.fc11.x86_64 pki-util-1.3.0-5.fc11.noarch
I've installed and successfully tested a Utimaco CryptoServer HSM on the operating system, including adding it to secmod.db (in the /var/lib/subca01/alias directory), generating a RSA key-pair, issuing a self-signed and listing the objects using certutil (the attached hsm-config.txt file shows sample output).
I've modified CS.cfg in /etc/subca01 to include this token (as the attached modules.txt file shows).
I've even restarted pki-cad services after adding the HSM to secmod.db, to ensure that the DogTag code reads secmod.db with the CryptoServer configured in it.
However, when it comes time to install a Subordinate CA, the KeyStore page claims that the Utimaco HSM is not found (see keystore-page.png) even though it is correctly listed on the page under "Supported Security Modules".
What am I missing?
How do I get DogTag to use the HSM to generate the key-pair?
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
So, how did you resolve this, Mike? Or, is it still unresolved? Thanks. Arshad Noor StrongAuth, Inc. Michael StJohns wrote:
Sorry - after I sent my earlier email I realized you probably encountered the same problem I did.
I need to report the bug to Utimaco/Sophos, but the driver on the 2.01 disk for Linux appears to have problems finding the configuration file in the standard locations. I'm not sure exactly what the problem is. You can duplicate this by clearing the CS2_PKCS11_INI environment variable, placing the cs2_pkcs11.ini file in one of the standard locations - e.g. /usr/etc/cs2_pkcs11.ini and then running the modutil command again over a blank database and try and add the module again. If you get the error CKR_FUNCTION_FAILED - its the same issue.
Strangely enough, the config file is found, its just not loaded for some reason. (Do an 'strace' and look at the "access" calls).
Mike
On 4/15/2010 8:49 PM, Arshad Noor wrote:
Hi,
I've updated DogTag to the current modules available (FC11 x86_64):
dogtag-pki-ca-ui-1.3.1-1.fc11.noarch dogtag-pki-common-ui-1.3.1-1.fc11.noarch dogtag-pki-console-ui-1.3.1-1.fc11.noarch
pki-ca-1.3.3-1.fc11.noarch pki-common-1.3.3-1.fc11.noarch pki-console-1.3.1-1.fc11.noarch pki-java-tools-1.3.1-1.fc11.noarch pki-native-tools-1.3.0-5.fc11.x86_64 pki-selinux-1.3.4-1.fc11.noarch pki-setup-1.3.4-1.fc11.noarch pki-silent-1.3.2-1.fc11.noarch pki-symkey-1.3.2-3.fc11.x86_64 pki-util-1.3.0-5.fc11.noarch
I've installed and successfully tested a Utimaco CryptoServer HSM on the operating system, including adding it to secmod.db (in the /var/lib/subca01/alias directory), generating a RSA key-pair, issuing a self-signed and listing the objects using certutil (the attached hsm-config.txt file shows sample output).
I've modified CS.cfg in /etc/subca01 to include this token (as the attached modules.txt file shows).
I've even restarted pki-cad services after adding the HSM to secmod.db, to ensure that the DogTag code reads secmod.db with the CryptoServer configured in it.
However, when it comes time to install a Subordinate CA, the KeyStore page claims that the Utimaco HSM is not found (see keystore-page.png) even though it is correctly listed on the page under "Supported Security Modules".
What am I missing?
How do I get DogTag to use the HSM to generate the key-pair?
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
------------------------------------------------------------------------
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Can someone from the DogTag team explain the process by which the installation servlet "finds" PKCS11 modules/HSMs and logs into them? Alternatively, if you can point me to the specific source module that performs this, I'd be happy to look at it myself. I'm still baffled by our inability to have the installation servlet find the Utimaco HSM module, despite the fact that modutil sees it: $ pet105:~> modutil -dbdir /var/lib/subca01/alias -nocertdb -list Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificate Services token: NSS Certificate DB 2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAE TEST ----------------------------------------------------------- There were some SELinux errors, but I fixed all of them; despite all calls now being successful, the installation servlet will still not see the HSM. Thanks. Arshad Noor StrongAuth, Inc.
Hi Arshad, Just a thought. Did you try removing the space for your token name? Christina Arshad Noor wrote:
Can someone from the DogTag team explain the process by which the installation servlet "finds" PKCS11 modules/HSMs and logs into them? Alternatively, if you can point me to the specific source module that performs this, I'd be happy to look at it myself.
I'm still baffled by our inability to have the installation servlet find the Utimaco HSM module, despite the fact that modutil sees it:
$ pet105:~> modutil -dbdir /var/lib/subca01/alias -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAE TEST -----------------------------------------------------------
There were some SELinux errors, but I fixed all of them; despite all calls now being successful, the installation servlet will still not see the HSM.
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Hi Christina, Good to hear from you again. I changed the token name and removed the space, but nothing changed, unfortunately: Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificate Services token: NSS Certificate DB 2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST ----------------------------------------------------------- The debug file for the new CA instance shows: ------------------------------------------- [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: display() [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: supported modules count= 4 [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: module found: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=NSS Generic Crypto Services [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?false [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token NSS Generic Crypto Services not to be added [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=Internal Key Storage Token [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel subpanelno =9 ------------------------------------------- The CS.cfg for this instance has the following: ------------------------------------------- preop.configModules.count=4 ... preop.configModules.module3.commonName=CryptoServer preop.configModules.module3.imagePath=../img/clearpixel.gif preop.configModules.module3.userFriendlyName=Utimacos's CryptoServer Hardware Security Module preop.module.token=CBUAETEST ------------------------------------------- Arshad Noor StrongAuth, Inc. Christina Fu wrote:
Hi Arshad,
Just a thought. Did you try removing the space for your token name?
Christina
Arshad Noor wrote:
Can someone from the DogTag team explain the process by which the installation servlet "finds" PKCS11 modules/HSMs and logs into them? Alternatively, if you can point me to the specific source module that performs this, I'd be happy to look at it myself.
I'm still baffled by our inability to have the installation servlet find the Utimaco HSM module, despite the fact that modutil sees it:
$ pet105:~> modutil -dbdir /var/lib/subca01/alias -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAE TEST -----------------------------------------------------------
There were some SELinux errors, but I fixed all of them; despite all calls now being successful, the installation servlet will still not see the HSM.
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Arshad, I'm curious. The unsupported modules are supposed to be picked up by the configuration module. That means, you don't need to add those configModules in the CS.cfg. Can you try doing that? If that works, I'd be interested in knowing if the token name with space contributed to any part of the issue too. Chistina Arshad Noor wrote:
Hi Christina,
Good to hear from you again.
I changed the token name and removed the space, but nothing changed, unfortunately:
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST -----------------------------------------------------------
The debug file for the new CA instance shows:
------------------------------------------- [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: display() [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: supported modules count= 4 [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: module found: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=NSS Generic Crypto Services [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?false [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token NSS Generic Crypto Services not to be added [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=Internal Key Storage Token [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel subpanelno =9 -------------------------------------------
The CS.cfg for this instance has the following:
------------------------------------------- preop.configModules.count=4 ... preop.configModules.module3.commonName=CryptoServer preop.configModules.module3.imagePath=../img/clearpixel.gif preop.configModules.module3.userFriendlyName=Utimacos's CryptoServer Hardware Security Module preop.module.token=CBUAETEST -------------------------------------------
Arshad Noor StrongAuth, Inc.
Christina Fu wrote:
Hi Arshad,
Just a thought. Did you try removing the space for your token name?
Christina
Arshad Noor wrote:
Can someone from the DogTag team explain the process by which the installation servlet "finds" PKCS11 modules/HSMs and logs into them? Alternatively, if you can point me to the specific source module that performs this, I'd be happy to look at it myself.
I'm still baffled by our inability to have the installation servlet find the Utimaco HSM module, despite the fact that modutil sees it:
$ pet105:~> modutil -dbdir /var/lib/subca01/alias -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAE TEST -----------------------------------------------------------
There were some SELinux errors, but I fixed all of them; despite all calls now being successful, the installation servlet will still not see the HSM.
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
So, if I understand you correctly, you want me to: 1) Make sure that the module is configured correctly in the new CA instance's alias/secmod.db file; and 2) Remove all references to the new HSM from CS.cfg, use a default CS.cfg, so that your configuration module code adds it to CS.cfg based on what's configured in secmod.db? Will get back to you in about 15 minutes. Arshad Noor StrongAuth, Inc. Christina Fu wrote:
Arshad,
I'm curious. The unsupported modules are supposed to be picked up by the configuration module. That means, you don't need to add those configModules in the CS.cfg. Can you try doing that? If that works, I'd be interested in knowing if the token name with space contributed to any part of the issue too.
Chistina
Arshad Noor wrote:
Hi Christina,
Good to hear from you again.
I changed the token name and removed the space, but nothing changed, unfortunately:
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST -----------------------------------------------------------
The debug file for the new CA instance shows:
------------------------------------------- [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: display() [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: supported modules count= 4 [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: module found: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=NSS Generic Crypto Services [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?false [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token NSS Generic Crypto Services not to be added [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=Internal Key Storage Token [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel subpanelno =9 -------------------------------------------
The CS.cfg for this instance has the following:
------------------------------------------- preop.configModules.count=4 ... preop.configModules.module3.commonName=CryptoServer preop.configModules.module3.imagePath=../img/clearpixel.gif preop.configModules.module3.userFriendlyName=Utimacos's CryptoServer Hardware Security Module preop.module.token=CBUAETEST -------------------------------------------
Arshad Noor StrongAuth, Inc.
Christina Fu wrote:
Hi Arshad,
Just a thought. Did you try removing the space for your token name?
Christina
Arshad Noor wrote:
Can someone from the DogTag team explain the process by which the installation servlet "finds" PKCS11 modules/HSMs and logs into them? Alternatively, if you can point me to the specific source module that performs this, I'd be happy to look at it myself.
I'm still baffled by our inability to have the installation servlet find the Utimaco HSM module, despite the fact that modutil sees it:
$ pet105:~> modutil -dbdir /var/lib/subca01/alias -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAE TEST -----------------------------------------------------------
There were some SELinux errors, but I fixed all of them; despite all calls now being successful, the installation servlet will still not see the HSM.
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
I'm afraid it didn't pick up the new module, Christina. modutil shows it correctly, but as you can see from the attached PNG, the servlet did not find the HSM. Based on Michael StJohn's postings and some feedback I have from the vendor, it appears that the 32-bit version of DogTag may be working; but we're testing on a 64-bit version of Fedora 11 and DogTag. Could that be causing the problem? The PKCS11 library from the HSM vendor is 64-bit. Arshad Noor StrongAuth, Inc. Arshad Noor wrote:
So, if I understand you correctly, you want me to:
1) Make sure that the module is configured correctly in the new CA instance's alias/secmod.db file; and
2) Remove all references to the new HSM from CS.cfg, use a default CS.cfg, so that your configuration module code adds it to CS.cfg based on what's configured in secmod.db?
Will get back to you in about 15 minutes.
Arshad Noor StrongAuth, Inc.
Christina Fu wrote:
Arshad,
I'm curious. The unsupported modules are supposed to be picked up by the configuration module. That means, you don't need to add those configModules in the CS.cfg. Can you try doing that? If that works, I'd be interested in knowing if the token name with space contributed to any part of the issue too.
Chistina
Arshad Noor wrote:
Hi Christina,
Good to hear from you again.
I changed the token name and removed the space, but nothing changed, unfortunately:
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST -----------------------------------------------------------
The debug file for the new CA instance shows:
------------------------------------------- [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: display() [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: supported modules count= 4 [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: module found: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=NSS Generic Crypto Services [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?false [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token NSS Generic Crypto Services not to be added [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=Internal Key Storage Token [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel subpanelno =9 -------------------------------------------
The CS.cfg for this instance has the following:
------------------------------------------- preop.configModules.count=4 ... preop.configModules.module3.commonName=CryptoServer preop.configModules.module3.imagePath=../img/clearpixel.gif preop.configModules.module3.userFriendlyName=Utimacos's CryptoServer Hardware Security Module preop.module.token=CBUAETEST -------------------------------------------
Arshad Noor StrongAuth, Inc.
Christina Fu wrote:
Hi Arshad,
Just a thought. Did you try removing the space for your token name?
Christina
Arshad Noor wrote:
Can someone from the DogTag team explain the process by which the installation servlet "finds" PKCS11 modules/HSMs and logs into them? Alternatively, if you can point me to the specific source module that performs this, I'd be happy to look at it myself.
I'm still baffled by our inability to have the installation servlet find the Utimaco HSM module, despite the fact that modutil sees it:
$ pet105:~> modutil -dbdir /var/lib/subca01/alias -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAE TEST -----------------------------------------------------------
There were some SELinux errors, but I fixed all of them; despite all calls now being successful, the installation servlet will still not see the HSM.
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
On 04/22/2010 03:43 PM, Arshad Noor wrote:
I'm afraid it didn't pick up the new module, Christina. modutil shows it correctly, but as you can see from the attached PNG, the servlet did not find the HSM.
Looks like the NSS layer has no problems identifying the token. can you use this tool and see if the JSS layer can see it as well ? http://www.redhat.com/docs/manuals/cert-system/8.0/cli/html/TokenInfo.html
Based on Michael StJohn's postings and some feedback I have from the vendor, it appears that the 32-bit version of DogTag may be working; but we're testing on a 64-bit version of Fedora 11 and DogTag. Could that be causing the problem? The PKCS11 library from the HSM vendor is 64-bit.
Arshad Noor StrongAuth, Inc.
Arshad Noor wrote:
So, if I understand you correctly, you want me to:
1) Make sure that the module is configured correctly in the new CA instance's alias/secmod.db file; and
2) Remove all references to the new HSM from CS.cfg, use a default CS.cfg, so that your configuration module code adds it to CS.cfg based on what's configured in secmod.db?
Will get back to you in about 15 minutes.
Arshad Noor StrongAuth, Inc.
Christina Fu wrote:
Arshad,
I'm curious. The unsupported modules are supposed to be picked up by the configuration module. That means, you don't need to add those configModules in the CS.cfg. Can you try doing that? If that works, I'd be interested in knowing if the token name with space contributed to any part of the issue too.
Chistina
Arshad Noor wrote:
Hi Christina,
Good to hear from you again.
I changed the token name and removed the space, but nothing changed, unfortunately:
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST -----------------------------------------------------------
The debug file for the new CA instance shows:
------------------------------------------- [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: display() [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: supported modules count= 4 [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: module found: NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=NSS Generic Crypto Services [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?false [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token NSS Generic Crypto Services not to be added [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token nick name=Internal Key Storage Token [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token logged in?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: token is present?true [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module NSS Internal PKCS #11 Module [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module nfast [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module lunasa [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: got from config module: CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel: adding module CryptoServer [22/Apr/2010:13:59:43][http-11004-Processor21]: ModulePanel subpanelno =9 -------------------------------------------
The CS.cfg for this instance has the following:
------------------------------------------- preop.configModules.count=4 ... preop.configModules.module3.commonName=CryptoServer preop.configModules.module3.imagePath=../img/clearpixel.gif preop.configModules.module3.userFriendlyName=Utimacos's CryptoServer Hardware Security Module preop.module.token=CBUAETEST -------------------------------------------
Arshad Noor StrongAuth, Inc.
Christina Fu wrote:
Hi Arshad,
Just a thought. Did you try removing the space for your token name?
Christina
Arshad Noor wrote:
Can someone from the DogTag team explain the process by which the installation servlet "finds" PKCS11 modules/HSMs and logs into them? Alternatively, if you can point me to the specific source module that performs this, I'd be happy to look at it myself.
I'm still baffled by our inability to have the installation servlet find the Utimaco HSM module, despite the fact that modutil sees it:
$ pet105:~> modutil -dbdir /var/lib/subca01/alias -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAE TEST -----------------------------------------------------------
There were some SELinux errors, but I fixed all of them; despite all calls now being successful, the installation servlet will still not see the HSM.
Thanks.
Arshad Noor StrongAuth, Inc.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Interesting; it did not: # pet105:~> modutil -dbdir /var/lib/subca01/alias/ -nocertdb -list Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificate Services token: NSS Certificate DB 2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST ----------------------------------------------------------- # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~> And there were no SELinux errors in the audit log. Arshad Noor StrongAuth, Inc. Chandrasekar Kannan wrote:
Looks like the NSS layer has no problems identifying the token. can you use this tool and see if the JSS layer can see it as well ?
http://www.redhat.com/docs/manuals/cert-system/8.0/cli/html/TokenInfo.html
On 04/22/2010 04:44 PM, Arshad Noor wrote:
Interesting; it did not:
# pet105:~> modutil -dbdir /var/lib/subca01/alias/ -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST ----------------------------------------------------------- # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~>
And there were no SELinux errors in the audit log.
Can you 'setenforce 0' (putting selinux to permissive mode ) and try one more time ?.
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
Looks like the NSS layer has no problems identifying the token. can you use this tool and see if the JSS layer can see it as well ?
http://www.redhat.com/docs/manuals/cert-system/8.0/cli/html/TokenInfo.html
No luck. ------------- # pet105:~> setenforce 0 # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~> ------------- Output from audit.log: ------------- type=MAC_STATUS msg=audit(1271980444.565:345): enforcing=0 old_enforcing=1 auid=500 ses=5 type=SYSCALL msg=audit(1271980444.565:345): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff300dfb20 a2=1 a3=fffffff8 items=0 ppid=32217 pid=32292 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=5 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ------------- Arshad Noor StrongAuth, Inc. Chandrasekar Kannan wrote:
On 04/22/2010 04:44 PM, Arshad Noor wrote:
Interesting; it did not:
# pet105:~> modutil -dbdir /var/lib/subca01/alias/ -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST ----------------------------------------------------------- # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~>
And there were no SELinux errors in the audit log.
Can you 'setenforce 0' (putting selinux to permissive mode ) and try one more time ?.
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
Looks like the NSS layer has no problems identifying the token. can you use this tool and see if the JSS layer can see it as well ?
http://www.redhat.com/docs/manuals/cert-system/8.0/cli/html/TokenInfo.html
Do you have any update on the JSS issue, Chandrasekar? Thanks. Arshad Noor StrongAuth, Inc. Arshad Noor wrote:
No luck.
------------- # pet105:~> setenforce 0 # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~> -------------
Output from audit.log:
------------- type=MAC_STATUS msg=audit(1271980444.565:345): enforcing=0 old_enforcing=1 auid=500 ses=5 type=SYSCALL msg=audit(1271980444.565:345): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff300dfb20 a2=1 a3=fffffff8 items=0 ppid=32217 pid=32292 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=5 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) -------------
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
On 04/22/2010 04:44 PM, Arshad Noor wrote:
Interesting; it did not:
# pet105:~> modutil -dbdir /var/lib/subca01/alias/ -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST ----------------------------------------------------------- # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~>
And there were no SELinux errors in the audit log.
Can you 'setenforce 0' (putting selinux to permissive mode ) and try one more time ?.
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
Looks like the NSS layer has no problems identifying the token. can you use this tool and see if the JSS layer can see it as well ?
http://www.redhat.com/docs/manuals/cert-system/8.0/cli/html/TokenInfo.html
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
On 04/26/2010 09:51 AM, Arshad Noor wrote:
Do you have any update on the JSS issue, Chandrasekar? Thanks.
I don't. We may need to debug the JSS code to figure out what the problem is....
Arshad Noor StrongAuth, Inc.
Arshad Noor wrote:
No luck.
------------- # pet105:~> setenforce 0 # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~> -------------
Output from audit.log:
------------- type=MAC_STATUS msg=audit(1271980444.565:345): enforcing=0 old_enforcing=1 auid=500 ses=5 type=SYSCALL msg=audit(1271980444.565:345): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff300dfb20 a2=1 a3=fffffff8 items=0 ppid=32217 pid=32292 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=5 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) -------------
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
On 04/22/2010 04:44 PM, Arshad Noor wrote:
Interesting; it did not:
# pet105:~> modutil -dbdir /var/lib/subca01/alias/ -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST ----------------------------------------------------------- # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~>
And there were no SELinux errors in the audit log.
Can you 'setenforce 0' (putting selinux to permissive mode ) and try one more time ?.
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
Looks like the NSS layer has no problems identifying the token. can you use this tool and see if the JSS layer can see it as well ?
http://www.redhat.com/docs/manuals/cert-system/8.0/cli/html/TokenInfo.html
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
On 04/26/2010 09:51 AM, Arshad Noor wrote:
Do you have any update on the JSS issue, Chandrasekar? Thanks.
I don't. We may need to debug the JSS code to figure out what the problem is....
Arshad Noor StrongAuth, Inc.
Arshad Noor wrote:
No luck.
------------- # pet105:~> setenforce 0 # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~> -------------
Output from audit.log:
------------- type=MAC_STATUS msg=audit(1271980444.565:345): enforcing=0 old_enforcing=1 auid=500 ses=5 type=SYSCALL msg=audit(1271980444.565:345): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff300dfb20 a2=1 a3=fffffff8 items=0 ppid=32217 pid=32292 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=5 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) -------------
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
On 04/22/2010 04:44 PM, Arshad Noor wrote:
Interesting; it did not:
# pet105:~> modutil -dbdir /var/lib/subca01/alias/ -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST ----------------------------------------------------------- # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~>
And there were no SELinux errors in the audit log.
Can you 'setenforce 0' (putting selinux to permissive mode ) and try one more time ?.
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
Looks like the NSS layer has no problems identifying the token. can you use this tool and see if the JSS layer can see it as well ?
http://www.redhat.com/docs/manuals/cert-system/8.0/cli/html/TokenInfo.html
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users Actually, I did spend some time looking into JSS code. The result was inconclusive. The code appeared to be reasonable. I do suspect, however, without looking closely at the code, that somehow the module is unloaded somewhere along the way. I'm curious whether this is an issue on this particular HSM, or if it's a matter of handling external modules (including software modules) in general. Has anyone had any success installing/using certicom module on this
Chandrasekar Kannan wrote: platform, for example? Again, I did not see any email from another member (StJohns?) that you mentioned claiming success with Utimaco HSM on a 32 bit machine... could you please forward the email? Another thing is, I'm not familiar with Utimaco HSM, but you might want to find out how to turn on debugger. Otherwise, try turning on NSS debugging, which might give you some clue. Christina
On 4/26/2010 10:46 PM, Christina Fu wrote:
Actually, I did spend some time looking into JSS code. The result was inconclusive. The code appeared to be reasonable. I do suspect, however, without looking closely at the code, that somehow the module is unloaded somewhere along the way. I'm curious whether this is an issue on this particular HSM, or if it's a matter of handling external modules (including software modules) in general. Has anyone had any success installing/using certicom module on this platform, for example?
Again, I did not see any email from another member (StJohns?) that you mentioned claiming success with Utimaco HSM on a 32 bit machine... could you please forward the email? Another thing is, I'm not familiar with Utimaco HSM, but you might want to find out how to turn on debugger.
Otherwise, try turning on NSS debugging, which might give you some clue.
Christina
Hi Christina - I had to put work on this aside for a few days, but am getting back to it. I've had uneven results. The time that I got the HSM to show up with the slots, but I didn't get the "Login" button. This time, I didn't even get the HSM to show up. The first time, I added the HSM manually, the second via a mod to the create script. Still working my way through it. I modified pki_create_instance to add both the Utimaco library and the Coolkey PKCS11 libary. I had to turn off SELinux enforcement to get Coolkey to show up on the list, but even then, the Utimaco lib didn't. I haven't had a chance to go back and check again. Mike
Was this on a 32-bit or 64-bit environment, Mike? I was planning to test this with the 32-bit version of Fedora 11, based on your assertion that it worked. But, now it appears that this might be unpredictable. Is that right? Arshad Noor StrongAuth, Inc. Michael StJohns wrote:
On 4/26/2010 10:46 PM, Christina Fu wrote:
Actually, I did spend some time looking into JSS code. The result was inconclusive. The code appeared to be reasonable. I do suspect, however, without looking closely at the code, that somehow the module is unloaded somewhere along the way. I'm curious whether this is an issue on this particular HSM, or if it's a matter of handling external modules (including software modules) in general. Has anyone had any success installing/using certicom module on this platform, for example?
Again, I did not see any email from another member (StJohns?) that you mentioned claiming success with Utimaco HSM on a 32 bit machine... could you please forward the email? Another thing is, I'm not familiar with Utimaco HSM, but you might want to find out how to turn on debugger.
Otherwise, try turning on NSS debugging, which might give you some clue.
Christina
Hi Christina -
I had to put work on this aside for a few days, but am getting back to it. I've had uneven results. The time that I got the HSM to show up with the slots, but I didn't get the "Login" button. This time, I didn't even get the HSM to show up. The first time, I added the HSM manually, the second via a mod to the create script. Still working my way through it.
I modified pki_create_instance to add both the Utimaco library and the Coolkey PKCS11 libary. I had to turn off SELinux enforcement to get Coolkey to show up on the list, but even then, the Utimaco lib didn't. I haven't had a chance to go back and check again.
Mike
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
OK - Using my recompiled/relinked version of the Utimaco library on Fedora 12 - 32 bit. I can consistently get the Utimaco library to show up in the list with the three slots I've initialized. BUT - none of those show up with the "Login" button. The reason I couldn't get it to work before was because of the coolkey library... if that libary is loaded (name "coolkey"), modutil and TokenInfo both see it, but only the coolkey library gets listed on the setup page. I deleted the coolkey library, restarted the server and the Utimaco slots showed up. I re-added the coolkey library with the name "zcoolkey", restarted the server - only the Utimaco slots showed up. - At this point I got suspicious and tried one more thing. I deleted the Utimaco library with the name "utimaco", restarted the server. The zcoolkey library showed up. Hmm..... looks like for some reason, only the first module (alphabetically) is being listed/loaded. Mike On 4/27/2010 8:51 PM, Arshad Noor wrote:
Was this on a 32-bit or 64-bit environment, Mike? I was planning to test this with the 32-bit version of Fedora 11, based on your assertion that it worked. But, now it appears that this might be unpredictable. Is that right?
Arshad Noor StrongAuth, Inc.
Michael StJohns wrote:
On 4/26/2010 10:46 PM, Christina Fu wrote:
Actually, I did spend some time looking into JSS code. The result was inconclusive. The code appeared to be reasonable. I do suspect, however, without looking closely at the code, that somehow the module is unloaded somewhere along the way. I'm curious whether this is an issue on this particular HSM, or if it's a matter of handling external modules (including software modules) in general. Has anyone had any success installing/using certicom module on this platform, for example?
Again, I did not see any email from another member (StJohns?) that you mentioned claiming success with Utimaco HSM on a 32 bit machine... could you please forward the email? Another thing is, I'm not familiar with Utimaco HSM, but you might want to find out how to turn on debugger.
Otherwise, try turning on NSS debugging, which might give you some clue.
Christina
Hi Christina -
I had to put work on this aside for a few days, but am getting back to it. I've had uneven results. The time that I got the HSM to show up with the slots, but I didn't get the "Login" button. This time, I didn't even get the HSM to show up. The first time, I added the HSM manually, the second via a mod to the create script. Still working my way through it.
I modified pki_create_instance to add both the Utimaco library and the Coolkey PKCS11 libary. I had to turn off SELinux enforcement to get Coolkey to show up on the list, but even then, the Utimaco lib didn't. I haven't had a chance to go back and check again.
Mike
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
When the Utimaco slots show up, do they consistently show up with a Login button? If there is no Login button, what would be the point of displaying the slot? One wouldn't be able to use it to generate keys. Arshad Noor StrongAuth, Inc. Michael StJohns wrote:
OK -
Using my recompiled/relinked version of the Utimaco library on Fedora 12 - 32 bit.
I can consistently get the Utimaco library to show up in the list with the three slots I've initialized. BUT - none of those show up with the "Login" button.
The reason I couldn't get it to work before was because of the coolkey library... if that libary is loaded (name "coolkey"), modutil and TokenInfo both see it, but only the coolkey library gets listed on the setup page.
I deleted the coolkey library, restarted the server and the Utimaco slots showed up.
I re-added the coolkey library with the name "zcoolkey", restarted the server - only the Utimaco slots showed up.
- At this point I got suspicious and tried one more thing.
I deleted the Utimaco library with the name "utimaco", restarted the server. The zcoolkey library showed up.
Hmm..... looks like for some reason, only the first module (alphabetically) is being listed/loaded.
Mike
On 4/27/2010 8:51 PM, Arshad Noor wrote:
Was this on a 32-bit or 64-bit environment, Mike? I was planning to test this with the 32-bit version of Fedora 11, based on your assertion that it worked. But, now it appears that this might be unpredictable. Is that right?
Arshad Noor StrongAuth, Inc.
Michael StJohns wrote:
On 4/26/2010 10:46 PM, Christina Fu wrote:
Actually, I did spend some time looking into JSS code. The result was inconclusive. The code appeared to be reasonable. I do suspect, however, without looking closely at the code, that somehow the module is unloaded somewhere along the way. I'm curious whether this is an issue on this particular HSM, or if it's a matter of handling external modules (including software modules) in general. Has anyone had any success installing/using certicom module on this platform, for example?
Again, I did not see any email from another member (StJohns?) that you mentioned claiming success with Utimaco HSM on a 32 bit machine... could you please forward the email? Another thing is, I'm not familiar with Utimaco HSM, but you might want to find out how to turn on debugger.
Otherwise, try turning on NSS debugging, which might give you some clue.
Christina
Hi Christina -
I had to put work on this aside for a few days, but am getting back to it. I've had uneven results. The time that I got the HSM to show up with the slots, but I didn't get the "Login" button. This time, I didn't even get the HSM to show up. The first time, I added the HSM manually, the second via a mod to the create script. Still working my way through it.
I modified pki_create_instance to add both the Utimaco library and the Coolkey PKCS11 libary. I had to turn off SELinux enforcement to get Coolkey to show up on the list, but even then, the Utimaco lib didn't. I haven't had a chance to go back and check again.
Mike
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
On 4/27/2010 9:59 PM, Arshad Noor wrote:
When the Utimaco slots show up, do they consistently show up with a Login button? If there is no Login button, what would be the point of displaying the slot? One wouldn't be able to use it to generate keys.
Arshad Noor StrongAuth, Inc.
They consistently show up with the Login button if I add them to the preop.configModules section (and they show up in the Supported section). They consistently do not have a login button if I only add them to the module database (so they show up in the unsupported section of the config page). I don't know why they don't show up with a Login button in the unsupported section of the page. Mike
Interesting. I added the Utimaco to the list of supported modules (CS.cfg - preop.configModules). This time it showed up in the list in the supported section along with the "Login" tag. I clicked "Login" and manually logged in, selected the module as the default, and completed the enrollment. I then went back to the HSM and using the Utimaco provided tool confirmed all the keys etc are present. zcoolkey showed up in the unsupported list. So try: Add utimaco to the pkicreate script in /usr/bin Add utimaco to the supported list in the default CS.cfg /usr/share/pki/ca/conf Mike On 4/27/2010 9:51 PM, Michael StJohns wrote:
OK -
Using my recompiled/relinked version of the Utimaco library on Fedora 12 - 32 bit.
I can consistently get the Utimaco library to show up in the list with the three slots I've initialized. BUT - none of those show up with the "Login" button.
The reason I couldn't get it to work before was because of the coolkey library... if that libary is loaded (name "coolkey"), modutil and TokenInfo both see it, but only the coolkey library gets listed on the setup page.
I deleted the coolkey library, restarted the server and the Utimaco slots showed up.
I re-added the coolkey library with the name "zcoolkey", restarted the server - only the Utimaco slots showed up.
- At this point I got suspicious and tried one more thing.
I deleted the Utimaco library with the name "utimaco", restarted the server. The zcoolkey library showed up.
Hmm..... looks like for some reason, only the first module (alphabetically) is being listed/loaded.
Mike
On 4/27/2010 8:51 PM, Arshad Noor wrote:
Was this on a 32-bit or 64-bit environment, Mike? I was planning to test this with the 32-bit version of Fedora 11, based on your assertion that it worked. But, now it appears that this might be unpredictable. Is that right?
Arshad Noor StrongAuth, Inc.
Michael StJohns wrote:
On 4/26/2010 10:46 PM, Christina Fu wrote:
Actually, I did spend some time looking into JSS code. The result was inconclusive. The code appeared to be reasonable. I do suspect, however, without looking closely at the code, that somehow the module is unloaded somewhere along the way. I'm curious whether this is an issue on this particular HSM, or if it's a matter of handling external modules (including software modules) in general. Has anyone had any success installing/using certicom module on this platform, for example?
Again, I did not see any email from another member (StJohns?) that you mentioned claiming success with Utimaco HSM on a 32 bit machine... could you please forward the email? Another thing is, I'm not familiar with Utimaco HSM, but you might want to find out how to turn on debugger.
Otherwise, try turning on NSS debugging, which might give you some clue.
Christina
Hi Christina -
I had to put work on this aside for a few days, but am getting back to it. I've had uneven results. The time that I got the HSM to show up with the slots, but I didn't get the "Login" button. This time, I didn't even get the HSM to show up. The first time, I added the HSM manually, the second via a mod to the create script. Still working my way through it.
I modified pki_create_instance to add both the Utimaco library and the Coolkey PKCS11 libary. I had to turn off SELinux enforcement to get Coolkey to show up on the list, but even then, the Utimaco lib didn't. I haven't had a chance to go back and check again.
Mike
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
On 4/27/2010 10:41 PM, Arshad Noor wrote:
Appreciate everything you're mentioning about this, Mike; can you clarify one last item?
What do you mean by the following statement? Thanks.
Arshad Noor StrongAuth, Inc.
Michael StJohns wrote:
Add utimaco to the pkicreate script in /usr/bin
Find the sections where nFast and Luna are added to the module by pkicreate - add similar language for Utimaco.
All it seems to be doing is adding the PKCS11 library to the secmod.db for the new instance it is creating - something one can do manually even after the instance has been created. You do have to restart the service so the servlet sees the new module in secmod.db, but I don't think it does anything else. Arshad Noor StrongAuth, Inc. P.S. How I miss the old Java installation wizard CS had; it was simple, elegant and allowed for significant configuration in the wizard. You could have an instance of a CA up and running in less than 5 minutes. Between rpm, perl scripts, HTML and servlets, the new installation process appears to have made installation one of the most complex parts of setting up a DogTag PKI. What a pity. Michael StJohns wrote:
On 4/27/2010 10:41 PM, Arshad Noor wrote:
Appreciate everything you're mentioning about this, Mike; can you clarify one last item?
What do you mean by the following statement? Thanks.
Arshad Noor StrongAuth, Inc.
Michael StJohns wrote:
Add utimaco to the pkicreate script in /usr/bin
Find the sections where nFast and Luna are added to the module by pkicreate - add similar language for Utimaco.
All it seems to be doing is adding the PKCS11 library to the secmod.db for the new instance it is creating - something one can do manually even after the instance has been created. Right - but if you modify both of these files and use the same "name" for the module for both then this gets picked up in the Supported Module
On 4/27/2010 11:04 PM, Arshad Noor wrote: section of the page. Alternately, run the unmodified pkicreate, modify CS.cfg, stop the server, add the module manually and restart the server. Make sure you use the same name..... Mike
You do have to restart the service so the servlet sees the new module in secmod.db, but I don't think it does anything else.
Arshad Noor StrongAuth, Inc.
P.S. How I miss the old Java installation wizard CS had; it was simple, elegant and allowed for significant configuration in the wizard. You could have an instance of a CA up and running in less than 5 minutes. Between rpm, perl scripts, HTML and servlets, the new installation process appears to have made installation one of the most complex parts of setting up a DogTag PKI. What a pity.
After much struggling, I finally changed SE Linux settings to "permissive" and the HSM is now visible and usable. The PKCS11 config file from Utimaco (cs2_pkcs11.ini) also needed to be in the /etc folder for JSS+NSS to see the HSM. While this got the CA installed, I've run into an issue that seems to be unresolved from a thread back in Nov 2009: https://www.redhat.com/archives/pki-users/2009-November/msg00017.html Bugzilla apparently has the fix and the server.xml has the right values for clientAuth, but the bad MAC error keeps appearing for every HTTPS page in my test installation. Is there any resolution to John Dorovski's problem? His last message remains unanswered. Thanks. Arshad Noor StrongAuth, Inc.
Any suggestions or hints on how to move forward with this? Thanks. Arshad Noor StrongAuth, Inc. Arshad Noor wrote:
I've run into an issue that seems to be unresolved from a thread back in Nov 2009:
https://www.redhat.com/archives/pki-users/2009-November/msg00017.html
Bugzilla apparently has the fix and the server.xml has the right values for clientAuth, but the bad MAC error keeps appearing for every HTTPS page in my test installation.
Is there any resolution to John Dorovski's problem? His last message remains unanswered.
On 05/07/2010 09:41 AM, Arshad Noor wrote:
Any suggestions or hints on how to move forward with this?
We have never tried with this utimaco hsm unit. So ... can you provide some more info along these lines .. - pki-ca install logs, ca debug logs, server configuration files - at the time when u hit the bad mac - ssltap reports, hsm pkcs11 debug logs etc.. thanks, --Chandra
Thanks.
Arshad Noor StrongAuth, Inc.
Arshad Noor wrote:
I've run into an issue that seems to be unresolved from a thread back in Nov 2009:
https://www.redhat.com/archives/pki-users/2009-November/msg00017.html
Bugzilla apparently has the fix and the server.xml has the right values for clientAuth, but the bad MAC error keeps appearing for every HTTPS page in my test installation.
Is there any resolution to John Dorovski's problem? His last message remains unanswered.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
participants (4)
-
Arshad Noor -
Chandrasekar Kannan -
Christina Fu -
Michael StJohns