9:20 a.m.
Hello everybody:
Firstly, is this the primary Email-list for Dogtag/Red Hat Certificate System ?
Naturally, I've looked through all the archives, found here, for an answer:
https://www.redhat.com/archives/pki-users/
We're using the DOGTAG CMS system found here:
http://pki.fedoraproject.org/wiki/PKI_Main_Page
We'd like to create a 'portable' CMS on a laptop running, say, Fedora release
8 (Werewolf).We'll then use this machine at different client sites where the
machine's DNS name and IP address will change to issue certificates.
Is this possible ?
Firstly, I know that the console has the directory server's DNS name within the schema
itself.My work-around is to leave an alias in /etc/hosts with the old hostname.
I expect the following URLs to cause an 'exception' in the Browser because
hostname in DN does NOT equal hostname for the machine:
https://dogtag.org:9443/ca/agent/ca/https://dogtag.org:10443/kra/agent/kr...
I reckon this can be over-ridden by simply accepting the 'exception' when
presented
with the warning dialogue-box in Mozilla.
Q1. Any other considerations or obstacles ?
Cdlt,
_________________________________________________________________
Keep in touch and up to date with friends and family. Make the connection now.
http://www.microsoft.com/windows/windowslive/
9:28 a.m.
Firstly, is this the primary Email-list for Dogtag/Red Hat Certificate
System ?
It seems to be the most active one I've found.
We'd like to create a 'portable' CMS on a laptop running, say, Fedora
release 8 (Werewolf).
Is this possible ?
I'd say it is possible. Take a look at this system here
Firstly, I know that the console has the directory server's DNS name
within the schema itself.
My work-around is to leave an alias in /etc/hosts with the old hostname.
I expect the following URLs to cause an 'exception' in the Browser
because
hostname in DN does NOT equal hostname for the machine:
https://dogtag.org:9443/ca/agent/ca/
https://dogtag.org:10443/kra/agent/kra/
https://dogtag.org:12889/
I reckon this can be over-ridden by simply accepting the 'exception'
when presented
with the warning dialogue-box in Mozilla.
Q1. Any other considerations or obstacles ?
Cdlt,
________________________________
9:31 a.m.
New subject: Certificate System Want to change hostname/IP addressafter installation
Sorry sent before I was done...
We'd like to create a 'portable' CMS on a laptop running, say, Fedora
release 8 (Werewolf).
Is this possible ?
I'd say it is possible. Take a look at this system here
http://www.redhat.com/promo/summit/2008/downloads/pdf/Friday/Friday_1015
am_Bob_Lord_OSS.pdf
I've seen the someone from spryus post here before or your best bet
might be contacting them directly to see what info they can share.
Sean
9:58 a.m.
New subject: Certificate System Want to change hostname/IP addressafter installation
I happened to have created one on a fc8 myself for the purpose of traveling.
I have in my /etc/hosts file:
127.0.0.1 localhost.localdomain localhost localhost
and in /etc/nsswitch.conf:
hosts: files dns
I do the following before each installation (rpm install or pkicreate)
as root:
domainname localdomain
hostname localhost
Christina
Veale, Sean wrote:
Sorry sent before I was done...
We'd like to create a 'portable' CMS on a laptop running, say, Fedora
release 8 (Werewolf).
Is this possible ?
I'd say it is possible. Take a look at this system here
http://www.redhat.com/promo/summit/2008/downloads/pdf/Friday/Friday_1015a...
I've seen the someone from spryus post here before or your best bet
might be contacting them directly to see what info they can share.
Sean
------------------------------------------------------------------------
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
12:36 a.m.
Your idea should be quite simple to achieve. The domain for the CA service
does not have to be related to the certificates you issue. I do this
currently on test machine (inside vmware) with the key ports forward from
the host to the dogtag system. People connect remotely to the public and
changing IP address specified by a DynDNS fully qualified host name.
So for your install machine use a dynamic DNS host name. DynDNS offer a
great service both the free and paid service. You could also use your own
organisation's DNS, however DynDNS is quick and easy.
At each new site you simply login to DynDNS, change the related IP addresses
and away you go.
For your own convenience, you also want the /etc/hosts file to resolve the
host name to 127.0.0.1, so it always works even when not on a network...
I do wonder about the security of your laptop, access control, whether you
might like to use some sort of hardware token (smart card/HSM) to at least
protect the CA key when on the road. It would be a shame to go to all the
trouble and have the laptop stolen and/or compromised.
On Wed, Jan 14, 2009 at 1:20 AM, <lambam80(a)hotmail.com> wrote:
Hello everybody:
Firstly, is this the primary Email-list for Dogtag/Red Hat Certificate
System ?
Naturally, I've looked through all the archives, found here, for an answer:
https://www.redhat.com/archives/pki-users/
We're using the DOGTAG CMS system found here:
http://pki.fedoraproject.org/wiki/PKI_Main_Page
We'd like to create a 'portable' CMS on a laptop running, say, Fedora
release 8 (Werewolf).
We'll then use this machine at different client sites where the machine's
DNS name and IP
address will change to issue certificates.
Is this possible ?
Firstly, I know that the console has the directory server's DNS name within
the schema itself.
My work-around is to leave an alias in /etc/hosts with the old hostname.
I expect the following URLs to cause an 'exception' in the Browser because
hostname in DN does NOT equal hostname for the machine:
https://dogtag.org:9443/ca/agent/ca/
https://dogtag.org:10443/kra/agent/kra/
https://dogtag.org:12889/
I reckon this can be over-ridden by simply accepting the 'exception' when
presented
with the warning dialogue-box in Mozilla.
Q1. Any other considerations or obstacles ?
Cdlt,
------------------------------
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
9:17 a.m.
New subject: Certificate System Want to change hostname/IP addressafter installation
Hello again and thanks for the help.
I've perfomed my CA install taking into account all your helpful advice.
However when I launch the admin interfact with:
https://localhost.localdomain:9443/ca/services
I get the following errors:
message description The server encountered an internal error () that prevented it from
fulfilling this request.exception java.io.IOException: CS server is not ready to serve.
com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:424)
javax.servlet.http.HttpServlet.service(HttpServlet.java:729) note The full stack trace of
the root cause is available in the Apache Tomcat/5.5.27 logs.
Q1. I've looked allover /var/lobs/tomcat5 etc. but cannot find these log files. Where
should I be looking ?
Thanks again for all your help lambam80.
----
Date: Tue, 13 Jan 2009 07:58:58 -0800
From: cfu(a)redhat.com
To: sean.veale(a)gdc4s.com
Subject: Re: [Pki-users] Certificate System Want to change hostname/IP addressafter
installation
CC: pki-users(a)redhat.com
I happened to have created one on a fc8 myself for the purpose of traveling.
I have in my /etc/hosts file:
127.0.0.1 localhost.localdomain localhost localhost
and in /etc/nsswitch.conf:
hosts: files dns
I do the following before each installation (rpm install or pkicreate)
as root:
domainname localdomain
hostname localhost
Christina
Veale, Sean wrote:
> Sorry sent before I was done...
>
> We'd like to create a 'portable' CMS on a laptop running, say, Fedora
> release 8 (Werewolf).
>
> Is this possible ?
>
> I'd say it is possible. Take a look at this system here
>
http://www.redhat.com/promo/summit/2008/downloads/pdf/Friday/Friday_1015a...
>
> I've seen the someone from spryus post here before or your best bet
> might be contacting them directly to see what info they can share.
>
> Sean
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-users
>
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
_________________________________________________________________
So many new options, so little time. Windows Live Messenger.
http://www.microsoft.com/windows/windowslive/products/messenger.aspx
11:32 a.m.
New subject: Certificate System Want to change hostname/IP addressafter installation
lambam80(a)hotmail.com wrote:
Hello again and thanks for the help.
I've perfomed my CA install taking into account all your helpful advice.
However when I launch the admin interfact with:
https://localhost.localdomain:9443/ca/services
I get the following errors:
*message* *description* _The server encountered an internal error ()
that prevented it from fulfilling this request._*exception*
java.io.IOException: CS server is not ready to serve.
com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:424)
javax.servlet.http.HttpServlet.service(HttpServlet.java:729) *note*
_The full stack trace of the root cause is available in the Apache
Tomcat/5.5.27 logs._
Q1. I've looked allover /var/lobs/tomcat5 etc. but cannot find these
log files. Where should I be looking ?
The first instance created at installation
will have logs into
/var/log/rhpki-ca/
Buf if you add other instances, only the install log will be in this
same location, and the newer log files will be under
/var/lib/rhpki<instance-id>/logs/
So, I always search under /var/lib/rhpki<instance-id>/ first.
For you problem, try to see if a process is listening on the port
(9443), and then try to browse using the ip address bound to this port.
Also look for events in the catalina.out log file.
M.
Thanks again for all your help lambam80.
----
> Date: Tue, 13 Jan 2009 07:58:58 -0800
> From: cfu(a)redhat.com
> To: sean.veale(a)gdc4s.com
> Subject: Re: [Pki-users] Certificate System Want to change
hostname/IP addressafter installation
> CC: pki-users(a)redhat.com
>
> I happened to have created one on a fc8 myself for the purpose of
traveling.
>
> I have in my /etc/hosts file:
> 127.0.0.1 localhost.localdomain localhost localhost
>
> and in /etc/nsswitch.conf:
> hosts: files dns
>
> I do the following before each installation (rpm install or pkicreate)
> as root:
> domainname localdomain
> hostname localhost
>
> Christina
>
> Veale, Sean wrote:
> > Sorry sent before I was done...
> >
> > We'd like to create a 'portable' CMS on a laptop running, say,
Fedora
> > release 8 (Werewolf).
> >
> > Is this possible ?
> >
> > I'd say it is possible. Take a look at this system here
> >
http://www.redhat.com/promo/summit/2008/downloads/pdf/Friday/Friday_1015a...
> >
> > I've seen the someone from spryus post here before or your best bet
> > might be contacting them directly to see what info they can share.
> >
> > Sean
> >
> >
> >
------------------------------------------------------------------------
> >
> > _______________________________________________
> > Pki-users mailing list
> > Pki-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/pki-users
> >
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-users
------------------------------------------------------------------------
So many new options, so little time. Windows Live Messenger.
<http://www.microsoft.com/windows/windowslive/products/messenger.aspx>
------------------------------------------------------------------------
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
3:30 a.m.
New subject: Certificate System Want to change hostname/IP addressafter installation
Marc, et al, hello and thanks for the continued support.
I looked in the file: /var/lib/pki-ca/logs/catalina.out
...
94 INFO: XML validation disabled
95 Internal Database Error encountered: Could not connect to LDAP server host localhost
port 389 Error netscape.ldap.LD APException: failed to connect to server
ldap://localhost:389 (91)
...
Failed install of Directory Server - it's only a stand-alone laptop so I'll
re-install from scratch (OS also). I'm not
brave enough to de-install CMS.
Naturally, I'll keep you posted. Thanks again for your support.
---------
Date: Wed, 25 Feb 2009 09:32:38 -0800
From: msauton(a)redhat.com
To: lambam80(a)hotmail.com
CC: pki-users(a)redhat.com
Subject: Re: [Pki-users] Certificate System Want to change hostname/IP addressafter
installation
lambam80(a)hotmail.com wrote:
> Hello again and thanks for the help.
>
> I've perfomed my CA install taking into account all your helpful advice.
>
> However when I launch the admin interfact with:
>
> https://localhost.localdomain:9443/ca/services
>
> I get the following errors:
>
> *message* *description* _The server encountered an internal error ()
> that prevented it from fulfilling this request._*exception*
> java.io.IOException: CS server is not ready to serve.
> com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:424)
> javax.servlet.http.HttpServlet.service(HttpServlet.java:729) *note*
> _The full stack trace of the root cause is available in the Apache
> Tomcat/5.5.27 logs._
>
>
> Q1. I've looked allover /var/lobs/tomcat5 etc. but cannot find these
> log files. Where should I be looking ?
The first instance created at installation will have logs into
/var/log/rhpki-ca/
Buf if you add other instances, only the install log will be in this
same location, and the newer log files will be under
/var/lib/rhpki<instance-id>/logs/
So, I always search under /var/lib/rhpki<instance-id>/ first.
For you problem, try to see if a process is listening on the port
(9443), and then try to browse using the ip address bound to this port.
Also look for events in the catalina.out log file.
M.
>
> Thanks again for all your help lambam80.
> ----
>
> > Date: Tue, 13 Jan 2009 07:58:58 -0800
> > From: cfu(a)redhat.com
> > To: sean.veale(a)gdc4s.com
> > Subject: Re: [Pki-users] Certificate System Want to change
> hostname/IP addressafter installation
> > CC: pki-users(a)redhat.com
> >
> > I happened to have created one on a fc8 myself for the purpose of
> traveling.
> >
> > I have in my /etc/hosts file:
> > 127.0.0.1 localhost.localdomain localhost localhost
> >
> > and in /etc/nsswitch.conf:
> > hosts: files dns
> >
> > I do the following before each installation (rpm install or pkicreate)
> > as root:
> > domainname localdomain
> > hostname localhost
> >
> > Christina
> >
> > Veale, Sean wrote:
> > > Sorry sent before I was done...
> > >
> > > We'd like to create a 'portable' CMS on a laptop running, say,
Fedora
> > > release 8 (Werewolf).
> > >
> > > Is this possible ?
> > >
> > > I'd say it is possible. Take a look at this system here
> > >
>
http://www.redhat.com/promo/summit/2008/downloads/pdf/Friday/Friday_1015a...
> > >
> > > I've seen the someone from spryus post here before or your best bet
> > > might be contacting them directly to see what info they can share.
> > >
> > > Sean
> > >
> > >
> > >
> ------------------------------------------------------------------------
> > >
> > > _______________________________________________
> > > Pki-users mailing list
> > > Pki-users(a)redhat.com
> > > https://www.redhat.com/mailman/listinfo/pki-users
> > >
> >
> > _______________________________________________
> > Pki-users mailing list
> > Pki-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/pki-users
>
> ------------------------------------------------------------------------
> So many new options, so little time. Windows Live Messenger.
> <http://www.microsoft.com/windows/windowslive/products/messenger.aspx>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-users
>
_________________________________________________________________
So many new options, so little time. Windows Live Messenger.
http://www.microsoft.com/windows/windowslive/products/messenger.aspx
6:30 a.m.
It's now working after a meticulous (re)installation.
Thanks again everybody.
From: lambam80(a)hotmail.com
To: msauton(a)redhat.com; lambam80(a)hotmail.com; pki-users(a)redhat.com
Subject: RE: [Pki-users] Certificate System Want to change hostname/IP addressafter
installation
Date: Thu, 26 Feb 2009 04:30:53 -0500
Marc, et al, hello and thanks for the continued support.
I looked in the file: /var/lib/pki-ca/logs/catalina.out
...
94 INFO: XML validation disabled
95 Internal Database Error encountered: Could not connect to LDAP server host localhost
port 389 Error netscape.ldap.LD APException: failed to connect to server
ldap://localhost:389 (91)
...
Failed install of Directory Server - it's only a stand-alone laptop so I'll
re-install from scratch (OS also). I'm not
brave enough to de-install CMS.
Naturally, I'll keep you posted. Thanks again for your support.
---------
Date: Wed, 25 Feb 2009 09:32:38 -0800
From: msauton(a)redhat.com
To: lambam80(a)hotmail.com
CC: pki-users(a)redhat.com
Subject: Re: [Pki-users] Certificate System Want to change hostname/IP addressafter
installation
lambam80(a)hotmail.com wrote:
> Hello again and thanks for the help.
>
> I've perfomed my CA install taking into account all your helpful advice.
>
> However when I launch the admin interfact with:
>
> https://localhost.localdomain:9443/ca/services
>
> I get the following errors:
>
> *message* *description* _The server encountered an internal error ()
> that prevented it from fulfilling this request._*exception*
> java.io.IOException: CS server is not ready to serve.
> com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:424)
> javax.servlet.http.HttpServlet.service(HttpServlet.java:729) *note*
> _The full stack trace of the root cause is available in the Apache
> Tomcat/5.5.27 logs._
>
>
> Q1. I've looked allover /var/lobs/tomcat5 etc. but cannot find these
> log files. Where should I be looking ?
The first instance created at installation will have logs into
/var/log/rhpki-ca/
Buf if you add other instances, only the install log will be in this
same location, and the newer log files will be under
/var/lib/rhpki<instance-id>/logs/
So, I always search under /var/lib/rhpki<instance-id>/ first.
For you problem, try to see if a process is listening on the port
(9443), and then try to browse using the ip address bound to this port.
Also look for events in the catalina.out log file.
M.
>
> Thanks again for all your help lambam80.
> ----
>
> > Date: Tue, 13 Jan 2009 07:58:58 -0800
> > From: cfu(a)redhat.com
> > To: sean.veale(a)gdc4s.com
> > Subject: Re: [Pki-users] Certificate System Want to change
> hostname/IP addressafter installation
> > CC: pki-users(a)redhat.com
> >
> > I happened to have created one on a fc8 myself for the purpose of
> traveling.
> >
> > I have in my /etc/hosts file:
> > 127.0.0.1 localhost.localdomain localhost localhost
> >
> > and in /etc/nsswitch.conf:
> > hosts: files dns
> >
> > I do the following before each installation (rpm install or pkicreate)
> > as root:
> > domainname localdomain
> > hostname localhost
> >
> > Christina
> >
> > Veale, Sean wrote:
> > > Sorry sent before I was done...
> > >
> > > We'd like to create a 'portable' CMS on a laptop running, say,
Fedora
> > > release 8 (Werewolf).
> > >
> > > Is this possible ?
> > >
> > > I'd say it is possible. Take a look at this system here
> > >
>
http://www.redhat.com/promo/summit/2008/downloads/pdf/Friday/Friday_1015a...
> > >
> > > I've seen the someone from spryus post here before or your best bet
> > > might be contacting them directly to see what info they can share.
> > >
> > > Sean
> > >
> > >
> > >
> ------------------------------------------------------------------------
> > >
> > > _______________________________________________
> > > Pki-users mailing list
> > > Pki-users(a)redhat.com
> > > https://www.redhat.com/mailman/listinfo/pki-users
> > >
> >
> > _______________________________________________
> > Pki-users mailing list
> > Pki-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/pki-users
>
> ------------------------------------------------------------------------
> So many new options, so little time. Windows Live Messenger.
> <http://www.microsoft.com/windows/windowslive/products/messenger.aspx>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-users
>
So many new options, so little time. Windows Live Messenger.
_________________________________________________________________
How fun is this? IMing with Windows Live Messenger just got better.
http://www.microsoft.com/windows/windowslive/products/messenger.aspx
5544
days inactive
5588
days old
8 comments
5 participants
participants (5)
-
Christina Fu -
lambam80＠hotmail.com -
Marc Sauton -
Robert -
Veale, Sean