4:21 p.m.
I created a certificate request using certreq.exe and the prerequisite
request.info on a Windows Server 2012R2 DC--references and details given
below.
However, I receive the error "Sorry, your request is not submitted. The
reason is "Invalid Request." when attempting to submit "Manual Server
Certificate Enrollment" it to my Root CA.
Am I using the wrong template profile? Is there a template that supports
OID=1.3.6.1.5.5.7.3.1?
Currently using PKI/Dogtag 10.3, but I did update to 10.4, briefly, then
recovered from snap/backup to 10.3 for the error persisted with 10.4.
These are my primary references:
https://support.microsoft.com/en-us/help/321051/how-to-
enable-ldap-over-ssl-with-a-third-party-certification-authority
https://technet.microsoft.com/en-us/library/ff625722(v=ws.
10).aspx#BKMK_Certreq
Created the CSR by executing "certreq -new request.inf request.csr"
The request.inf follows:
========================================
[Version]
Signature="$Windows NT$
[NewRequest]
Subject = "CN=ad.winauth.mydomain.net"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
[Extensions]
2.5.29.17 = "dns=ad.winauth.mydomain.net&"
_continue_ = "dn=CN=AD,OU=Domain
Controllers,DC=winauth,DC=mydomain,DC=net&"
_continue_ = "ipaddress=192.168.1.1&"
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication
========================================
7:03 p.m.
On Tue, Oct 17, 2017 at 02:21:41PM -0700, Richard Harmonson wrote:
I created a certificate request using certreq.exe and the
prerequisite
request.info on a Windows Server 2012R2 DC--references and details given
below.
However, I receive the error "Sorry, your request is not submitted. The
reason is "Invalid Request." when attempting to submit "Manual Server
Certificate Enrollment" it to my Root CA.
Am I using the wrong template profile? Is there a template that supports
OID=1.3.6.1.5.5.7.3.1?
Yes, this OID is configured in the server certificate profile. You
don't need to include it in the CSR (but it doesn't hurt).
There is something about the request that Dogtag does not like.
Could you attach the CSR itself and/or the relevant portion of the
/var/log/pki/pki-tomcat/ca/debug log file?
Thanks,
Fraser
Currently using PKI/Dogtag 10.3, but I did update to 10.4, briefly, then
recovered from snap/backup to 10.3 for the error persisted with 10.4.
These are my primary references:
https://support.microsoft.com/en-us/help/321051/how-to-
enable-ldap-over-ssl-with-a-third-party-certification-authority
https://technet.microsoft.com/en-us/library/ff625722(v=ws.
10).aspx#BKMK_Certreq
Created the CSR by executing "certreq -new request.inf request.csr"
The request.inf follows:
========================================
[Version]
Signature="$Windows NT$
[NewRequest]
Subject = "CN=ad.winauth.mydomain.net"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
[Extensions]
2.5.29.17 = "dns=ad.winauth.mydomain.net&"
_continue_ = "dn=CN=AD,OU=Domain
Controllers,DC=winauth,DC=mydomain,DC=net&"
_continue_ = "ipaddress=192.168.1.1&"
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication
========================================
9:08 p.m.
On Tue, Oct 17, 2017 at 5:03 PM, Fraser Tweedale <ftweedal(a)redhat.com>
wrote:
On Tue, Oct 17, 2017 at 02:21:41PM -0700, Richard Harmonson wrote:
> I created a certificate request using certreq.exe and the prerequisite
> request.info on a Windows Server 2012R2 DC--references and details given
> below.
>
> However, I receive the error "Sorry, your request is not submitted. The
> reason is "Invalid Request." when attempting to submit "Manual
Server
> Certificate Enrollment" it to my Root CA.
>
> Am I using the wrong template profile? Is there a template that supports
> OID=1.3.6.1.5.5.7.3.1?
>
Yes, this OID is configured in the server certificate profile. You
don't need to include it in the CSR (but it doesn't hurt).
There is something about the request that Dogtag does not like.
Could you attach the CSR itself and/or the relevant portion of the
/var/log/pki/pki-tomcat/ca/debug log file?
Thanks,
Fraser
>
> Currently using PKI/Dogtag 10.3, but I did update to 10.4, briefly, then
> recovered from snap/backup to 10.3 for the error persisted with 10.4.
>
>
> These are my primary references:
>
> https://support.microsoft.com/en-us/help/321051/how-to-
> enable-ldap-over-ssl-with-a-third-party-certification-authority
>
> https://technet.microsoft.com/en-us/library/ff625722(v=ws.
> 10).aspx#BKMK_Certreq
>
> Created the CSR by executing "certreq -new request.inf request.csr"
>
> The request.inf follows:
>
> ========================================
> [Version]
>
> Signature="$Windows NT$
>
> [NewRequest]
> Subject = "CN=ad.winauth.mydomain.net"
> KeySpec = 1
> KeyLength = 2048
> Exportable = TRUE
> MachineKeySet = TRUE
> SMIME = False
> PrivateKeyArchive = FALSE
> UserProtected = FALSE
> UseExistingKeySet = FALSE
> ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
> ProviderType = 12
> RequestType = PKCS10
> KeyUsage = 0xa0
>
> [Extensions]
> 2.5.29.17 = "dns=ad.winauth.mydomain.net&"
> _continue_ = "dn=CN=AD,OU=Domain Controllers,DC=winauth,DC=mydo
main,DC=net&"
> _continue_ = "ipaddress=192.168.1.1&"
>
I reviewed the suggested log, thank you, which clearly showed DogTag
complaining about something being provided in the CSR. I couldn't interpret
exactly what was the problem but I removed the one thing I had never done
before, the [Extensions] stanza with the SAN.
I successfully submitted!
What is the correct method to provide a 'Subject Alternative Name" in a CSR
to DogTag? Or am I going about this all wrong? I was intending to provide
FQDN, IP address, and DN in the SAN.
Thank you,
Richard
> [EnhancedKeyUsageExtension]
> OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication
> ========================================
9:41 a.m.
>
> > [Extensions]
> > 2.5.29.17 = "dns=ad.winauth.mydomain.net&"
> > _continue_ = "dn=CN=AD,OU=Domain Controllers,DC=winauth,DC=mydo
> main,DC=net&"
> > _continue_ = "ipaddress=192.168.1.1&"
> >
>
I got it! Essentially, I didn't follow the instructions. Note the missing
"{text}" above! I thought the author was giving an example so excluded it.
After a night's sleep, I checked my erroneous assumption.
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=ad.winauth.mydomain.net&"
_continue_ = "dn=CN=AD,OU=Domain
Controllers,DC=winauth,DC=maydomain,DC=net&"
_continue_ = "ipaddress=192.168.1.1&"
Thank you for your help Fraser.
I reviewed the suggested log, thank you, which clearly showed DogTag
complaining about something being provided in the CSR. I couldn't interpret
exactly what was the problem but I removed the one thing I had never done
before, the [Extensions] stanza with the SAN.
I successfully submitted!
What is the correct method to provide a 'Subject Alternative Name" in a
CSR to DogTag? Or am I going about this all wrong? I was intending to
provide FQDN, IP address, and DN in the SAN.
Thank you,
Richard
2375
days inactive
2376
days old
3 comments
2 participants
participants (2)
-
Fraser Tweedale -
Richard Harmonson