Do you know what version of the JavaCard the card supports? I think you the card needs to work with JC 2.2.2 to work correctly (at least in CS 7.3 and probally in Dogtag CS) but confirmation on that would be good. Sean ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Tuesday, December 23, 2008 12:52 PM To: pki-users(a)redhat.com Subject: [Pki-users] ESC Format / Enroll Error We have an Infineon Smart Card and currently we are unable to Format/Enroll due to the following ESC Error "Formatting of smart card failed. Error: The Smart Card Server cannot upgrade the software on your smart card." And Diagnostics show this error: "Attempting to Format Key, ID: ####### - Key Format failure, Error: 19." This card comes up as "Formatted" because we've manually installed a version of the Dogtag applet prior to using ESC & Dogtag. Any advice on how we can troubleshoot? -- Zach Casper Envieta LLC ----------------------------------------

Where do you find the info about your javacard? I have a set of blank Gemalto smartcards and I don't see javacard or model number info on them. From: Julius Adewumi @GDC4S.com Ph:480-441-6768 Contract Corp:MTSI ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Tuesday, December 23, 2008 11:42 AM To: pki-users(a)redhat.com Subject: RE: [Pki-users] ESC Format / Enroll Error Yes - Our cards are JavaCard 2.2.1 and Global Platform 2.1.1 Could that be the problem? From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Veale, Sean Sent: Tuesday, December 23, 2008 1:29 PM To: pki-users(a)redhat.com Subject: RE: [Pki-users] ESC Format / Enroll Error Do you know what version of the JavaCard the card supports? I think you the card needs to work with JC 2.2.2 to work correctly (at least in CS 7.3 and probally in Dogtag CS) but confirmation on that would be good. Sean ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Tuesday, December 23, 2008 12:52 PM To: pki-users(a)redhat.com Subject: [Pki-users] ESC Format / Enroll Error We have an Infineon Smart Card and currently we are unable to Format/Enroll due to the following ESC Error "Formatting of smart card failed. Error: The Smart Card Server cannot upgrade the software on your smart card." And Diagnostics show this error: "Attempting to Format Key, ID: ####### - Key Format failure, Error: 19." This card comes up as "Formatted" because we've manually installed a version of the Dogtag applet prior to using ESC & Dogtag. Any advice on how we can troubleshoot? -- Zach Casper Envieta LLC ----------------------------------------

No I from further diving down in the documents I belive JC 2.2.1 cards should work but I've only had the gemalto cards work correctly so far. On the same note I've only just started using 7.3 and later plan to use dogtag so I wouldn't take any answer I give as fact :) This is an interesting bug relating to Safenet cards so It might be useful for you to see if you have something simular https://bugzilla.redhat.com/show_bug.cgi?id=459538 Sean ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Wednesday, December 24, 2008 10:28 AM To: pki-users(a)redhat.com Subject: RE: [Pki-users] ESC Format / Enroll Error Thanks Sean. Has it been verified that JC 2.2.1 cards are incompatible with Dogtag/CMS 7.3? zach From: Zach Casper [mailto:zach.casper@envieta.com] Sent: Tuesday, December 23, 2008 1:42 PM To: 'pki-users(a)redhat.com' Subject: RE: [Pki-users] ESC Format / Enroll Error Yes - Our cards are JavaCard 2.2.1 and Global Platform 2.1.1 Could that be the problem? From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Veale, Sean Sent: Tuesday, December 23, 2008 1:29 PM To: pki-users(a)redhat.com Subject: RE: [Pki-users] ESC Format / Enroll Error Do you know what version of the JavaCard the card supports? I think you the card needs to work with JC 2.2.2 to work correctly (at least in CS 7.3 and probally in Dogtag CS) but confirmation on that would be good. Sean ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Tuesday, December 23, 2008 12:52 PM To: pki-users(a)redhat.com Subject: [Pki-users] ESC Format / Enroll Error We have an Infineon Smart Card and currently we are unable to Format/Enroll due to the following ESC Error "Formatting of smart card failed. Error: The Smart Card Server cannot upgrade the software on your smart card." And Diagnostics show this error: "Attempting to Format Key, ID: ####### - Key Format failure, Error: 19." This card comes up as "Formatted" because we've manually installed a version of the Dogtag applet prior to using ESC & Dogtag. Any advice on how we can troubleshoot? -- Zach Casper Envieta LLC ----------------------------------------

I currently have a CS setup where using Gemalto tokens, I can see that an signing and encryption certs are written to the card. What profile(s) in the /var/lib/<ca instance>/profile directory is used to generate the certs in a default dogtag setup? I noticed there is both a caTokenUserEncryptionKeyEnrollment.cfg and caTokenUserSigningLeyEnrollment.cfg profiles in the directory that seem to correspond to each of the certs created on the token. That is a bit odd to me as I though it usually was one profile that would have multiple policysets to handle 2 certs not a seperate profile for each? The basic question is I'd like to modify the configuration so a third cert is created on the card (to be used for authentication) beyond the email signing and encryption certs. Anyone know how to do that? Thanks Sean

Thanks. Where is it specified the type of token to use in the enrollement process? Thanks Sean -----Original Message----- From: Jack Magne [mailto:jmagne@redhat.com] Sent: Monday, January 19, 2009 7:49 PM To: Veale, Sean Cc: pki-users(a)redhat.com Subject: Re: [Pki-users] Token Cert Profile Question Sean: Yes, we have a profile for each cert. If you look in the CS.cfg in /var/lib/pki-tps/conf, you will see that for each type of token (ie userKey), there is a list of key "types" that are generated. For an example of 3 types look for the string: op.enroll.soKeyTemporary.keyGen.keyType.num=3 The subsequent lines show how a 3rd auth cert is generated. Veale, Sean wrote: