Re: [Pki-users] Questions on customizing certificate profiles
Hi @ all, I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck! I found, this is hard-coded in the sources, for example in: - pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan:
On 04/06/2010 05:08 PM, Arshad Noor wrote:
The only option that is visible under Advanced is the key-size for each of the certificate-types. The hash algorithm does not show up at all.
Even the default, as mentioned by Step 8, is not the default as the last 10-12 installs have shown:
* SHA256withRSA (the default)
So, the question is: is the current build of DogTag in the pki repository identical to RHCS 8.0 or is it a different version?
It might very well be ... we can look at the svn commits to be really sure...
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
the installation wizard should provide 'options' under the advanced section for you to be able to select the alg to use. Have you tried doing Step (8) from here ? http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configur ing_a_CA.html
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
-- Oliver Burtchen, Berlin
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product? I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks. Arshad Noor StrongAuth, Inc. P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support? Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks.
Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan:
On 04/06/2010 05:08 PM, Arshad Noor wrote:
The only option that is visible under Advanced is the key-size for each of the certificate-types. The hash algorithm does not show up at all.
Even the default, as mentioned by Step 8, is not the default as the last 10-12 installs have shown:
* SHA256withRSA (the default)
So, the question is: is the current build of DogTag in the pki repository identical to RHCS 8.0 or is it a different version? It might very well be ... we can look at the svn commits to be really sure...
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
the installation wizard should provide 'options' under the advanced section for you to be able to select the alg to use. Have you tried doing Step (8) from here ? http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configur ing_a_CA.html
Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Hi Arshad, Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag. PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen. Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew. Cheers, Kev On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan:
On 04/06/2010 05:08 PM, Arshad Noor wrote:
The only option that is visible under Advanced is the key-size for each of the certificate-types. The hash algorithm does not show up at all.
Even the default, as mentioned by Step 8, is not the default as the last 10-12 installs have shown:
* SHA256withRSA (the default)
So, the question is: is the current build of DogTag in the pki repository identical to RHCS 8.0 or is it a different version? It might very well be ... we can look at the svn commits to be really sure...
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
the installation wizard should provide 'options' under the advanced section for you to be able to select the alg to use. Have you tried doing Step (8) from here ? http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configur
ing_a_CA.html
Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Hi Kevin, thanks for making the differences plain. For me RHBA-2009-1602 is more a new feature, than a bug fix, but okay. ;-) It seems that pkisilent does not offer an option to change the hash to SHA-2, and as I wrote earlier, IMHO it is volitional hard-coded. Most of the rest of dogtag has code to work with SHA-2. I will give the "renewal method" a try. Best regards, Oli Am Donnerstag, 8. April 2010 20:51:14 schrieb Kevin Unthank:
Hi Arshad,
Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag.
PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen.
Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew.
Cheers, Kev
On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan:
On 04/06/2010 05:08 PM, Arshad Noor wrote:
The only option that is visible under Advanced is the key-size for each of the certificate-types. The hash algorithm does not show up at all.
Even the default, as mentioned by Step 8, is not the default as the last 10-12 installs have shown:
* SHA256withRSA (the default)
So, the question is: is the current build of DogTag in the pki repository identical to RHCS 8.0 or is it a different version?
It might very well be ... we can look at the svn commits to be really sure...
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
the installation wizard should provide 'options' under the advanced section for you to be able to select the alg to use. Have you tried doing Step (8) from here ? http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Confi gur
ing_a_CA.html
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
-- Oliver Burtchen, Berlin
Just for the record, the "renewal method" seems to work, but it is very annoying. I would be very glad to see the possibility to change the hash-alg as on option to pkicreate, in the wizard or pkisilent. This is a feature-request. ;-) Best regards, Oli Am Donnerstag, 8. April 2010 22:12:40 schrieb Oliver Burtchen:
Hi Kevin,
thanks for making the differences plain. For me RHBA-2009-1602 is more a new feature, than a bug fix, but okay. ;-)
It seems that pkisilent does not offer an option to change the hash to SHA-2, and as I wrote earlier, IMHO it is volitional hard-coded. Most of the rest of dogtag has code to work with SHA-2.
I will give the "renewal method" a try.
Best regards, Oli
Am Donnerstag, 8. April 2010 20:51:14 schrieb Kevin Unthank:
Hi Arshad,
Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag.
PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen.
Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew.
Cheers, Kev
On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan:
On 04/06/2010 05:08 PM, Arshad Noor wrote:
The only option that is visible under Advanced is the key-size for each of the certificate-types. The hash algorithm does not show up at all.
Even the default, as mentioned by Step 8, is not the default as the last 10-12 installs have shown:
* SHA256withRSA (the default)
So, the question is: is the current build of DogTag in the pki repository identical to RHCS 8.0 or is it a different version?
It might very well be ... we can look at the svn commits to be really sure...
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote: > the installation wizard should provide 'options' under the advanced > section for you to be able to select the alg to use. Have you tried > doing Step (8) from here ? > http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Con >fi gur > > ing_a_CA.html
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
-- Oliver Burtchen, Berlin
Oliver, So, what you did was complete the entire process using SHA-1, submit an immediate renewal after modifying the profiles and then install the renewed certificate with SHA-2? A question for Kevin: is this going to require that all the certs generated through the installation process must go through an immediate renewal to get other custom parameters in them? The certs I want have: 1) SHA-256; 2) Custom key-usages - not default for everything; 3) Custom AIA extensions - (did you know that the AIA extension in the OCSP Signing certificate has a pointer to the OCSP URL? I didn't look closely, but I think it may have also been missing the OCSPNoCheck extension - how could OCSP work at all with these defaults?) 4) Custom CPS extensions; 5) Etc. The renewal method essentially forces us to install the PKI twice to get it right, with the additional burden of performing renewals, approvals, replacements, etc. to get the certs right. If there is one tiny error in this additional process, the work just multiplies from there. This is not elegant at all, Kevin. Is there any priority that can be placed towards merging the RHCS code into DogTag and fixing this? Arshad Noor StrongAuth, Inc. Oliver Burtchen wrote:
Just for the record,
the "renewal method" seems to work, but it is very annoying. I would be very glad to see the possibility to change the hash-alg as on option to pkicreate, in the wizard or pkisilent. This is a feature-request. ;-)
Best regards, Oli
Am Donnerstag, 8. April 2010 22:12:40 schrieb Oliver Burtchen:
Hi Kevin,
thanks for making the differences plain. For me RHBA-2009-1602 is more a new feature, than a bug fix, but okay. ;-)
It seems that pkisilent does not offer an option to change the hash to SHA-2, and as I wrote earlier, IMHO it is volitional hard-coded. Most of the rest of dogtag has code to work with SHA-2.
I will give the "renewal method" a try.
Best regards, Oli
Am Donnerstag, 8. April 2010 20:51:14 schrieb Kevin Unthank:
Hi Arshad,
Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag.
PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen.
Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew.
Cheers, Kev
On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan:
On 04/06/2010 05:08 PM, Arshad Noor wrote: > The only option that is visible under Advanced is the key-size > for each of the certificate-types. The hash algorithm does not > show up at all. > > Even the default, as mentioned by Step 8, is not the default as > the last 10-12 installs have shown: > > * SHA256withRSA (the default) > > So, the question is: is the current build of DogTag in the pki > repository identical to RHCS 8.0 or is it a different version? It might very well be ... we can look at the svn commits to be really sure...
> Arshad Noor > StrongAuth, Inc. > > Chandrasekar Kannan wrote: >> the installation wizard should provide 'options' under the advanced >> section for you to be able to select the alg to use. Have you tried >> doing Step (8) from here ? >> http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Con >> fi gur >> >> ing_a_CA.html _______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
On 04/08/2010 02:43 PM, Arshad Noor wrote:
Oliver,
So, what you did was complete the entire process using SHA-1, submit an immediate renewal after modifying the profiles and then install the renewed certificate with SHA-2?
A question for Kevin: is this going to require that all the certs generated through the installation process must go through an immediate renewal to get other custom parameters in them? The certs I want have:
1) SHA-256; 2) Custom key-usages - not default for everything; 3) Custom AIA extensions - (did you know that the AIA extension in the OCSP Signing certificate has a pointer to the OCSP URL? I didn't look closely, but I think it may have also been missing the OCSPNoCheck extension - how could OCSP work at all with these defaults?) 4) Custom CPS extensions; 5) Etc.
The renewal method essentially forces us to install the PKI twice to get it right, CA installation and certificate renewal are two different processes. with the additional burden of performing renewals, approvals, replacements, etc. to get the certs right. If there is one tiny error in this additional process, the work just multiplies from there.
This is not elegant at all, Kevin.
Is there any priority that can be placed towards merging the RHCS code into DogTag and fixing this?
Arshad Noor StrongAuth, Inc.
Oliver Burtchen wrote:
Just for the record,
the "renewal method" seems to work, but it is very annoying. I would be very glad to see the possibility to change the hash-alg as on option to pkicreate, in the wizard or pkisilent. This is a feature-request. ;-)
Best regards, Oli
Am Donnerstag, 8. April 2010 22:12:40 schrieb Oliver Burtchen:
Hi Kevin,
thanks for making the differences plain. For me RHBA-2009-1602 is more a new feature, than a bug fix, but okay. ;-)
It seems that pkisilent does not offer an option to change the hash to SHA-2, and as I wrote earlier, IMHO it is volitional hard-coded. Most of the rest of dogtag has code to work with SHA-2.
I will give the "renewal method" a try.
Best regards, Oli
Am Donnerstag, 8. April 2010 20:51:14 schrieb Kevin Unthank:
Hi Arshad,
Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag.
PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen.
Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew.
Cheers, Kev
On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan: > On 04/06/2010 05:08 PM, Arshad Noor wrote: >> The only option that is visible under Advanced is the key-size >> for each of the certificate-types. The hash algorithm does not >> show up at all. >> >> Even the default, as mentioned by Step 8, is not the default as >> the last 10-12 installs have shown: >> >> * SHA256withRSA (the default) >> >> So, the question is: is the current build of DogTag in the pki >> repository identical to RHCS 8.0 or is it a different version? > It might very well be ... we can look at the svn commits > to be really sure... > >> Arshad Noor >> StrongAuth, Inc. >> >> Chandrasekar Kannan wrote: >>> the installation wizard should provide 'options' under the >>> advanced >>> section for you to be able to select the alg to use. Have you >>> tried >>> doing Step (8) from here ? >>> http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Con >>> >>> fi gur >>> >>> ing_a_CA.html > _______________________________________________ > Pki-users mailing list > Pki-users@redhat.com > https://www.redhat.com/mailman/listinfo/pki-users
Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
I am aware of that, Andrew. But, if the original installation process does not get me the certificates I want, and I have to "renew" the certificates to get the profile I want, then I am being forced to nearly double the work I have to do just to get the certificates right the first time. Arshad Noor StrongAuth, Inc. Andrew Wnuk wrote:
On 04/08/2010 02:43 PM, Arshad Noor wrote:
The renewal method essentially forces us to install the PKI twice to get it right,
CA installation and certificate renewal are two different processes.
Hi @ all, yes, I followed the "normal" installation, than did a renewal like Andrew suggested and installed this cert via pkiconsole. And I also know the difference between CA installation and certificate renewal, this is what we are talking about. I did this only to get SHA-2 certificates, what is currently IMHO not possible with the normal installation of dogtag. Best regards, Oli Am Donnerstag, 8. April 2010 23:43:22 schrieb Arshad Noor:
Oliver,
So, what you did was complete the entire process using SHA-1, submit an immediate renewal after modifying the profiles and then install the renewed certificate with SHA-2?
A question for Kevin: is this going to require that all the certs generated through the installation process must go through an immediate renewal to get other custom parameters in them? The certs I want have:
1) SHA-256; 2) Custom key-usages - not default for everything; 3) Custom AIA extensions - (did you know that the AIA extension in the OCSP Signing certificate has a pointer to the OCSP URL? I didn't look closely, but I think it may have also been missing the OCSPNoCheck extension - how could OCSP work at all with these defaults?) 4) Custom CPS extensions; 5) Etc.
The renewal method essentially forces us to install the PKI twice to get it right, with the additional burden of performing renewals, approvals, replacements, etc. to get the certs right. If there is one tiny error in this additional process, the work just multiplies from there.
This is not elegant at all, Kevin.
Is there any priority that can be placed towards merging the RHCS code into DogTag and fixing this?
Arshad Noor StrongAuth, Inc.
Oliver Burtchen wrote:
Just for the record,
the "renewal method" seems to work, but it is very annoying. I would be very glad to see the possibility to change the hash-alg as on option to pkicreate, in the wizard or pkisilent. This is a feature-request. ;-)
Best regards, Oli
Am Donnerstag, 8. April 2010 22:12:40 schrieb Oliver Burtchen:
Hi Kevin,
thanks for making the differences plain. For me RHBA-2009-1602 is more a new feature, than a bug fix, but okay. ;-)
It seems that pkisilent does not offer an option to change the hash to SHA-2, and as I wrote earlier, IMHO it is volitional hard-coded. Most of the rest of dogtag has code to work with SHA-2.
I will give the "renewal method" a try.
Best regards, Oli
Am Donnerstag, 8. April 2010 20:51:14 schrieb Kevin Unthank:
Hi Arshad,
Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag.
PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen.
Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew.
Cheers, Kev
On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.jav a
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan: > On 04/06/2010 05:08 PM, Arshad Noor wrote: >> The only option that is visible under Advanced is the key-size >> for each of the certificate-types. The hash algorithm does not >> show up at all. >> >> Even the default, as mentioned by Step 8, is not the default as >> the last 10-12 installs have shown: >> >> * SHA256withRSA (the default) >> >> So, the question is: is the current build of DogTag in the pki >> repository identical to RHCS 8.0 or is it a different version? > > It might very well be ... we can look at the svn commits > to be really sure... > >> Arshad Noor >> StrongAuth, Inc. >> >> Chandrasekar Kannan wrote: >>> the installation wizard should provide 'options' under the >>> advanced section for you to be able to select the alg to use. Have >>> you tried doing Step (8) from here ? >>> http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Co >>>n fi gur >>> >>> ing_a_CA.html > > _______________________________________________ > Pki-users mailing list > Pki-users@redhat.com > https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
-- Oliver Burtchen, Berlin
I am sorry to read this, Kevin. It suggests that RedHat has forgotten its open-source roots and what made it a billion dollar company in the first place. We are all familiar with the **** that companies put up with when buying some commercial products. Open-source was meant to be an answer to that problem - that quality could be vastly improved in software when there were many eyes looking at the source - not because some people just like the idea of seeing the source-code of the products they use. That RedHat was making money on services off of open-source products was perfectly acceptable - there is real value in services. But, when the open-source company starts differentiating its open-source products from its commercial products, it subverts the whole notion of open-source and what it stands for. If the fix did not exist and it was up to the open-source community to prioritize the fix, that's one thing. But when the fix *does* exist, and has been merged into the commercial branch, but is not merged into the open-source branch - that suggests deliberate manipulation of the trust and goodwill of the open-source community. Arshad Noor StrongAuth, Inc. Kevin Unthank wrote:
Hi Arshad,
Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag.
PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen.
Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew.
Cheers, Kev
On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan:
On 04/06/2010 05:08 PM, Arshad Noor wrote:
The only option that is visible under Advanced is the key-size for each of the certificate-types. The hash algorithm does not show up at all.
Even the default, as mentioned by Step 8, is not the default as the last 10-12 installs have shown:
* SHA256withRSA (the default)
So, the question is: is the current build of DogTag in the pki repository identical to RHCS 8.0 or is it a different version? It might very well be ... we can look at the svn commits to be really sure...
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
the installation wizard should provide 'options' under the advanced section for you to be able to select the alg to use. Have you tried doing Step (8) from here ? http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configur
ing_a_CA.html
Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Hi Arshad, We most certainly have not forgotten our open-source roots. In response to customer demand for this SHA2 functionality, Red Hat engineers implemented it and released it as an enhancement errata for RHCS8. At the very same time, the source code for that enhancement was made available, freely, to everyone in the dogtag community. You can checkout that codewith SVN svn co https://pki.fedoraproject.org/svn/pki/branches/PKI_8_0_ERRATA_BRANCH Merge it with the dogtag source and compile your own dogtag packages with the desired functionality. As I stated in my earlier response we absolutely intend to take the code from the open-source CS8 branch, and add it to the open-source dogtag tip but that work has not been scheduled yet. I will see if I can get the priority bumped up. I strongly encourage you to create your own dogtag build environment so you can get access to the latest code checkins. There are instructions for doing this on the dogtag wiki and I know some of the community members have already done this. There is no manipulation of the trust and goodwill of the open-source community going on here. Cheers, Kev On 04/08/2010 03:25 PM, Arshad Noor wrote:
I am sorry to read this, Kevin. It suggests that RedHat has forgotten its open-source roots and what made it a billion dollar company in the first place.
We are all familiar with the **** that companies put up with when buying some commercial products. Open-source was meant to be an answer to that problem - that quality could be vastly improved in software when there were many eyes looking at the source - not because some people just like the idea of seeing the source-code of the products they use.
That RedHat was making money on services off of open-source products was perfectly acceptable - there is real value in services. But, when the open-source company starts differentiating its open-source products from its commercial products, it subverts the whole notion of open-source and what it stands for.
If the fix did not exist and it was up to the open-source community to prioritize the fix, that's one thing. But when the fix *does* exist, and has been merged into the commercial branch, but is not merged into the open-source branch - that suggests deliberate manipulation of the trust and goodwill of the open-source community.
Arshad Noor StrongAuth, Inc.
Kevin Unthank wrote:
Hi Arshad,
Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag.
PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen.
Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew.
Cheers, Kev
On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan:
On 04/06/2010 05:08 PM, Arshad Noor wrote:
The only option that is visible under Advanced is the key-size for each of the certificate-types. The hash algorithm does not show up at all.
Even the default, as mentioned by Step 8, is not the default as the last 10-12 installs have shown:
* SHA256withRSA (the default)
So, the question is: is the current build of DogTag in the pki repository identical to RHCS 8.0 or is it a different version? It might very well be ... we can look at the svn commits to be really sure...
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote: > the installation wizard should provide 'options' under the advanced > section for you to be able to select the alg to use. Have you tried > doing Step (8) from here ? > http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configur > > > ing_a_CA.html
Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
I will give this a shot, Kevin - although I wonder how much time it will take to get the Build environment right to get through all the compiles vs. doing a "renewal" of the certs. However, to follow up on the other issue - the documentation on RHBA-2009-1602 suggests that only the SHA-2 algorithm issue can be fixed. Am I still stuck with the renewal method to get the other certificate extensions fixed - the keyUsages, AIA, OCSPNoCheck, etc? Arshad Noor StrongAuth, Inc. Kevin Unthank wrote:
Hi Arshad,
We most certainly have not forgotten our open-source roots.
In response to customer demand for this SHA2 functionality, Red Hat engineers implemented it and released it as an enhancement errata for RHCS8. At the very same time, the source code for that enhancement was made available, freely, to everyone in the dogtag community.
You can checkout that codewith SVN svn co https://pki.fedoraproject.org/svn/pki/branches/PKI_8_0_ERRATA_BRANCH Merge it with the dogtag source and compile your own dogtag packages with the desired functionality.
As I stated in my earlier response we absolutely intend to take the code from the open-source CS8 branch, and add it to the open-source dogtag tip but that work has not been scheduled yet. I will see if I can get the priority bumped up.
I strongly encourage you to create your own dogtag build environment so you can get access to the latest code checkins. There are instructions for doing this on the dogtag wiki and I know some of the community members have already done this.
There is no manipulation of the trust and goodwill of the open-source community going on here.
Cheers, Kev
On 04/08/2010 03:25 PM, Arshad Noor wrote:
I am sorry to read this, Kevin. It suggests that RedHat has forgotten its open-source roots and what made it a billion dollar company in the first place.
We are all familiar with the **** that companies put up with when buying some commercial products. Open-source was meant to be an answer to that problem - that quality could be vastly improved in software when there were many eyes looking at the source - not because some people just like the idea of seeing the source-code of the products they use.
That RedHat was making money on services off of open-source products was perfectly acceptable - there is real value in services. But, when the open-source company starts differentiating its open-source products from its commercial products, it subverts the whole notion of open-source and what it stands for.
If the fix did not exist and it was up to the open-source community to prioritize the fix, that's one thing. But when the fix *does* exist, and has been merged into the commercial branch, but is not merged into the open-source branch - that suggests deliberate manipulation of the trust and goodwill of the open-source community.
Arshad Noor StrongAuth, Inc.
Kevin Unthank wrote:
Hi Arshad,
Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag.
PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen.
Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew.
Cheers, Kev
On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan:
On 04/06/2010 05:08 PM, Arshad Noor wrote: > The only option that is visible under Advanced is the key-size > for each of the certificate-types. The hash algorithm does not > show up at all. > > Even the default, as mentioned by Step 8, is not the default as > the last 10-12 installs have shown: > > * SHA256withRSA (the default) > > So, the question is: is the current build of DogTag in the pki > repository identical to RHCS 8.0 or is it a different version? It might very well be ... we can look at the svn commits to be really sure...
> Arshad Noor > StrongAuth, Inc. > > Chandrasekar Kannan wrote: >> the installation wizard should provide 'options' under the advanced >> section for you to be able to select the alg to use. Have you tried >> doing Step (8) from here ? >> http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configur >> >> >> >> ing_a_CA.html _______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
On 04/08/2010 04:33 PM, Arshad Noor wrote:
I will give this a shot, Kevin - although I wonder how much time it will take to get the Build environment right to get through all the compiles vs. doing a "renewal" of the certs.
However, to follow up on the other issue - the documentation on RHBA-2009-1602 suggests that only the SHA-2 algorithm issue can be fixed. Am I still stuck with the renewal method to get the other certificate extensions fixed - the keyUsages, AIA, OCSPNoCheck, etc?
I don't think so. You should be able to get those customized by editing those profile config files in question before going through the wizard. Sha-2 was a bit hard-coded IIRC , hence it required code changes.
Arshad Noor StrongAuth, Inc.
Kevin Unthank wrote:
Hi Arshad,
We most certainly have not forgotten our open-source roots.
In response to customer demand for this SHA2 functionality, Red Hat engineers implemented it and released it as an enhancement errata for RHCS8. At the very same time, the source code for that enhancement was made available, freely, to everyone in the dogtag community.
You can checkout that codewith SVN svn co https://pki.fedoraproject.org/svn/pki/branches/PKI_8_0_ERRATA_BRANCH Merge it with the dogtag source and compile your own dogtag packages with the desired functionality.
As I stated in my earlier response we absolutely intend to take the code from the open-source CS8 branch, and add it to the open-source dogtag tip but that work has not been scheduled yet. I will see if I can get the priority bumped up.
I strongly encourage you to create your own dogtag build environment so you can get access to the latest code checkins. There are instructions for doing this on the dogtag wiki and I know some of the community members have already done this.
There is no manipulation of the trust and goodwill of the open-source community going on here.
Cheers, Kev
On 04/08/2010 03:25 PM, Arshad Noor wrote:
I am sorry to read this, Kevin. It suggests that RedHat has forgotten its open-source roots and what made it a billion dollar company in the first place.
We are all familiar with the **** that companies put up with when buying some commercial products. Open-source was meant to be an answer to that problem - that quality could be vastly improved in software when there were many eyes looking at the source - not because some people just like the idea of seeing the source-code of the products they use.
That RedHat was making money on services off of open-source products was perfectly acceptable - there is real value in services. But, when the open-source company starts differentiating its open-source products from its commercial products, it subverts the whole notion of open-source and what it stands for.
If the fix did not exist and it was up to the open-source community to prioritize the fix, that's one thing. But when the fix *does* exist, and has been merged into the commercial branch, but is not merged into the open-source branch - that suggests deliberate manipulation of the trust and goodwill of the open-source community.
Arshad Noor StrongAuth, Inc.
Kevin Unthank wrote:
Hi Arshad,
Obviously, there are differences between RHCS8 and the latest release of Dogtag. Generally, new feature development takes place in dogtag and some of those features find there way back into RHCS8. Bug fixing often occurs first in RHCS8 and those fixes are ported to dogtag.
PKI with only SHA-2 hashes is a fix that was made in the RHCS8 code tree and released in both source binary form in errata RHBA-2009-1602. That fix will make it into dogtag builds but I can't commit to a specific release or date when this will happen.
Until then it should be possible to work around the problem by using pkisilent or the renewal method suggested by Andrew.
Cheers, Kev
On 04/08/2010 10:55 AM, Arshad Noor wrote:
Can someone from the DogTag Engineering team confirm that a PKI with only SHA-2 hashes *cannot* be built with the current version of the product?
I find this hard to believe given that the RHCS documentation seems to indicate that it is possible to do so, and given that the underlying code already has SHA-2 support; nevertheless, can someone confirm Oliver's finding? Thanks.
Arshad Noor StrongAuth, Inc.
P.S. Since the RHCS 8.0 documentation does state that SHA-2 hashes can be configured at the time the self-signed cert is created, does that imply that the commercial RHCS is technologically different from the open-source DogTag? And, that it isn't just a question of RedHat support?
Oliver Burtchen wrote:
Hi @ all,
I also tried to change from "SHA1withRSA" to "SHA256withRSA" by editing the config files. No luck!
I found, this is hard-coded in the sources, for example in:
- pki-common-1.3.2/src/com/netscape/cms/servlet/csadmin/SizePanel.java - pki-common-1.3.2//src/com/netscape/cmscore/security/CASigningCert.java
Just look for "SHA1withRSA" in the files, I don't think this are just fallbacks. Best regards, Oli
Am Mittwoch, 7. April 2010 03:27:04 schrieb Chandrasekar Kannan: > On 04/06/2010 05:08 PM, Arshad Noor wrote: >> The only option that is visible under Advanced is the key-size >> for each of the certificate-types. The hash algorithm does not >> show up at all. >> >> Even the default, as mentioned by Step 8, is not the default as >> the last 10-12 installs have shown: >> >> * SHA256withRSA (the default) >> >> So, the question is: is the current build of DogTag in the pki >> repository identical to RHCS 8.0 or is it a different version? > It might very well be ... we can look at the svn commits > to be really sure... > >> Arshad Noor >> StrongAuth, Inc. >> >> Chandrasekar Kannan wrote: >>> the installation wizard should provide 'options' under the >>> advanced >>> section for you to be able to select the alg to use. Have you >>> tried >>> doing Step (8) from here ? >>> http://www.redhat.com/docs/manuals/cert-system/8.0/install/html/Configur >>> >>> >>> >>> ing_a_CA.html > _______________________________________________ > Pki-users mailing list > Pki-users@redhat.com > https://www.redhat.com/mailman/listinfo/pki-users >
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
However, when I did modify the *.cfg files in the profiles/ca directory to customize the extensions, none of the changes were picked up. I've only focused on the SHA-2 issue because that seemed to be symptomatic of the underlying problem - but the real problem is that the entire certificate is not customizable in the installation process. Or, are you suggesting that with the fix compiled in, all the profile changes will get included too? Arshad Noor StrongAuth, Inc. Chandrasekar Kannan wrote:
On 04/08/2010 04:33 PM, Arshad Noor wrote:
However, to follow up on the other issue - the documentation on RHBA-2009-1602 suggests that only the SHA-2 algorithm issue can be fixed. Am I still stuck with the renewal method to get the other certificate extensions fixed - the keyUsages, AIA, OCSPNoCheck, etc?
I don't think so. You should be able to get those customized by editing those profile config files in question before going through the wizard. Sha-2 was a bit hard-coded IIRC , hence it required code changes.
On 04/08/2010 04:52 PM, Arshad Noor wrote:
However, when I did modify the *.cfg files in the profiles/ca directory to customize the extensions, none of the changes were picked up.
For the CA, You would need to edit the conf/*.profile files. restart the instance. Go through the wizard and see if your customization's show up. IIRC this should work. --Chandra
I've only focused on the SHA-2 issue because that seemed to be symptomatic of the underlying problem - but the real problem is that the entire certificate is not customizable in the installation process.
Or, are you suggesting that with the fix compiled in, all the profile changes will get included too?
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
On 04/08/2010 04:33 PM, Arshad Noor wrote:
However, to follow up on the other issue - the documentation on RHBA-2009-1602 suggests that only the SHA-2 algorithm issue can be fixed. Am I still stuck with the renewal method to get the other certificate extensions fixed - the keyUsages, AIA, OCSPNoCheck, etc?
I don't think so. You should be able to get those customized by editing those profile config files in question before going through the wizard. Sha-2 was a bit hard-coded IIRC , hence it required code changes.
As I said before, you can also customize your certificate using agent approval page. You need to customize profile only for items that cannot be edited through agent approval UI. On 04/08/2010 04:52 PM, Arshad Noor wrote:
However, when I did modify the *.cfg files in the profiles/ca directory to customize the extensions, none of the changes were picked up. I've only focused on the SHA-2 issue because that seemed to be symptomatic of the underlying problem - but the real problem is that the entire certificate is not customizable in the installation process.
Or, are you suggesting that with the fix compiled in, all the profile changes will get included too?
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
On 04/08/2010 04:33 PM, Arshad Noor wrote:
However, to follow up on the other issue - the documentation on RHBA-2009-1602 suggests that only the SHA-2 algorithm issue can be fixed. Am I still stuck with the renewal method to get the other certificate extensions fixed - the keyUsages, AIA, OCSPNoCheck, etc?
I don't think so. You should be able to get those customized by editing those profile config files in question before going through the wizard. Sha-2 was a bit hard-coded IIRC , hence it required code changes.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
I agree with Arshad, the /etc/<instance>/CF.cfg file is overridden, when the "Key Pairs" tab in the wizard is processed, no matter what you say in the *.cfg or *.profiles files before. I will have a look at the SVN-branch like Kevin sugguests tomorrow. But I am afraid that it does not matter. It's a pki.fedoraproject branch. I had looks at rawhide, no difference. For example, search for "SHA1" here. It's still hard coded: https://pki.fedoraproject.org/svn/pki/branches/PKI_8_0_ERRATA_BRANCH/pki/bas... BTW: There are other things which could be easily fixed, but are pending for 2 years, like my last two comments on this bug: https://bugzilla.redhat.com/show_bug.cgi?id=441974 Best regards, Oli Am Freitag, 9. April 2010 01:52:47 schrieb Arshad Noor:
However, when I did modify the *.cfg files in the profiles/ca directory to customize the extensions, none of the changes were picked up. I've only focused on the SHA-2 issue because that seemed to be symptomatic of the underlying problem - but the real problem is that the entire certificate is not customizable in the installation process.
Or, are you suggesting that with the fix compiled in, all the profile changes will get included too?
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
On 04/08/2010 04:33 PM, Arshad Noor wrote:
However, to follow up on the other issue - the documentation on RHBA-2009-1602 suggests that only the SHA-2 algorithm issue can be fixed. Am I still stuck with the renewal method to get the other certificate extensions fixed - the keyUsages, AIA, OCSPNoCheck, etc?
I don't think so. You should be able to get those customized by editing those profile config files in question before going through the wizard. Sha-2 was a bit hard-coded IIRC , hence it required code changes.
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
-- Oliver Burtchen, Berlin
participants (5)
-
Andrew Wnuk -
Arshad Noor -
Chandrasekar Kannan -
Kevin Unthank -
Oliver Burtchen