You may find further clue in the TPS log, perhaps in the "/var/lib/rhpki-tps/logs/tps-debug.log". From: Julius Adewumi @GDC4S.com Ph:480-441-6768 Contract Corp:MTSI ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Tuesday, December 23, 2008 10:52 AM To: pki-users(a)redhat.com Subject: [Pki-users] ESC Format / Enroll Error We have an Infineon Smart Card and currently we are unable to Format/Enroll due to the following ESC Error "Formatting of smart card failed. Error: The Smart Card Server cannot upgrade the software on your smart card." And Diagnostics show this error: "Attempting to Format Key, ID: ####### - Key Format failure, Error: 19." This card comes up as "Formatted" because we've manually installed a version of the Dogtag applet prior to using ESC & Dogtag. Any advice on how we can troubleshoot? -- Zach Casper Envieta LLC ----------------------------------------

Where do you find the info about your javacard? I have a set of blank Gemalto smartcards and I don't see javacard or model number info on them. From: Julius Adewumi @GDC4S.com Ph:480-441-6768 Contract Corp:MTSI ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Tuesday, December 23, 2008 11:42 AM To: pki-users(a)redhat.com Subject: RE: [Pki-users] ESC Format / Enroll Error Yes - Our cards are JavaCard 2.2.1 and Global Platform 2.1.1 Could that be the problem? From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Veale, Sean Sent: Tuesday, December 23, 2008 1:29 PM To: pki-users(a)redhat.com Subject: RE: [Pki-users] ESC Format / Enroll Error Do you know what version of the JavaCard the card supports? I think you the card needs to work with JC 2.2.2 to work correctly (at least in CS 7.3 and probally in Dogtag CS) but confirmation on that would be good. Sean ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Tuesday, December 23, 2008 12:52 PM To: pki-users(a)redhat.com Subject: [Pki-users] ESC Format / Enroll Error We have an Infineon Smart Card and currently we are unable to Format/Enroll due to the following ESC Error "Formatting of smart card failed. Error: The Smart Card Server cannot upgrade the software on your smart card." And Diagnostics show this error: "Attempting to Format Key, ID: ####### - Key Format failure, Error: 19." This card comes up as "Formatted" because we've manually installed a version of the Dogtag applet prior to using ESC & Dogtag. Any advice on how we can troubleshoot? -- Zach Casper Envieta LLC ----------------------------------------

No I from further diving down in the documents I belive JC 2.2.1 cards should work but I've only had the gemalto cards work correctly so far. On the same note I've only just started using 7.3 and later plan to use dogtag so I wouldn't take any answer I give as fact :) This is an interesting bug relating to Safenet cards so It might be useful for you to see if you have something simular https://bugzilla.redhat.com/show_bug.cgi?id=459538 Sean ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Wednesday, December 24, 2008 10:28 AM To: pki-users(a)redhat.com Subject: RE: [Pki-users] ESC Format / Enroll Error Thanks Sean. Has it been verified that JC 2.2.1 cards are incompatible with Dogtag/CMS 7.3? zach From: Zach Casper [mailto:zach.casper@envieta.com] Sent: Tuesday, December 23, 2008 1:42 PM To: 'pki-users(a)redhat.com' Subject: RE: [Pki-users] ESC Format / Enroll Error Yes - Our cards are JavaCard 2.2.1 and Global Platform 2.1.1 Could that be the problem? From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Veale, Sean Sent: Tuesday, December 23, 2008 1:29 PM To: pki-users(a)redhat.com Subject: RE: [Pki-users] ESC Format / Enroll Error Do you know what version of the JavaCard the card supports? I think you the card needs to work with JC 2.2.2 to work correctly (at least in CS 7.3 and probally in Dogtag CS) but confirmation on that would be good. Sean ________________________________ From: pki-users-bounces(a)redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Zach Casper Sent: Tuesday, December 23, 2008 12:52 PM To: pki-users(a)redhat.com Subject: [Pki-users] ESC Format / Enroll Error We have an Infineon Smart Card and currently we are unable to Format/Enroll due to the following ESC Error "Formatting of smart card failed. Error: The Smart Card Server cannot upgrade the software on your smart card." And Diagnostics show this error: "Attempting to Format Key, ID: ####### - Key Format failure, Error: 19." This card comes up as "Formatted" because we've manually installed a version of the Dogtag applet prior to using ESC & Dogtag. Any advice on how we can troubleshoot? -- Zach Casper Envieta LLC ----------------------------------------

Sean: Yes, we have a profile for each cert. If you look in the CS.cfg in /var/lib/pki-tps/conf, you will see that for each type of token (ie userKey), there is a list of key "types" that are generated. For an example of 3 types look for the string: op.enroll.soKeyTemporary.keyGen.keyType.num=3 The subsequent lines show how a 3rd auth cert is generated. Veale, Sean wrote: