Andrew Wnuk writes: Thanks, I will try this. That is _exactly_ what I am in the midst of doing. I can do whatever I need to do on the client (RA javascript) side, but I don't know how to get the subject components to the CA itself - I've sent it all kinds of things & successfully gotten it to write the certificate subjectaltname component, but not the subject. Our plan is to let the profile handle all the policy attributes and only bring over the user/ee - specific content. That's our use case. If anyone else is working on this I'd be delighted to work with you. There are a lot of browsers we can support if we can keygen support out to the RA. Thanks, ==mwh

Andrew Wnuk writes: Anything that has a functioning keygen tag - currently, opera, most google chrome / webkit, safari on mac os, & some derivatives. firefox also has keygen but it has a Mozilla crypto. method that the RA supports. Thanks, ==mwh

Andrew Wnuk writes: IE doesn't use keygen, it has CAPI (or whatever it's called now in Windows 7) and makes pkcs#10 requests. I couldn't find any trace of a keygen tag in IE 9 and I am given to understand (from some of the W3c mailing lists) that Microsoft is opposed to it & won't implement it in their HTML5. In any event, they're fine as-is. Opera and Google-style webkit browsers seem to have keygen. I don't know whether it works on all platforms they support yet. Definitely works on Windows. (My guess is it doesn't work on MacOS.) Safari also has keygen, but it doesn't work on windows - the tag exists but it won't do anything. Does work on MacOS. The tag is a browser method (one of my more knowledgeable coworkers calls it this) and so I can't really look inside the tag & see usable methods - just have to try and check results. Firefox has it but it's kind of a magic tag, perhaps it's an interface to crypto.crmf-something. It works on most platforms (not mobile Android - this deployment completely lacks crypto.* as far as I can tell.) By "work" I mean it does only what it says it will do - make a key pair, and understand that it has a private key somewhere & how to retrieve it. I can definitely load a successfully-signed certificate into these browsers. It may be that some options can provide a little more capability, but I can't tell whether they're there & I don't understand them either. I don't see one that will link more attributes to the generated key. The problem now is, I need to persuade the CA to sign the certificate with a usable subject name. This I don't know how to do, & I don't understand the CA's internal software structure (let alone the "request architecture" or flow) well enough yet to figure out whether it can be fixed. I can get it the key; I can get it a subjectaltname; I can deliver the policy attributes thru the profile, but the subject name.... My hope is that the CA is fine as-is and what I need to do is adjust the policy or learn some more about the request API so I can feed it the subject name in a manner it can understand - that would mean a patch to the RA perl libraries. Otherwise, need to modify something in the CA. Thanks, ==mwh Michael Helm ESnet/LBNL

On 06/08/2011 09:33 AM, Mike Helm wrote: Will Safari on iPad work similar way?

On 06/08/2011 02:46 PM, Mike Helm wrote: I saw some references on the net saying that iPad could use SCEP protocol to deploy certificates. (http://images.apple.com/ipad/business/pdf/iPad_Deployment_Scenarios.pdf) Have you tried this? Thank you, Andrew

On 06/08/2011 07:22 PM, Mike Helm wrote: I wonder if certmonger would be useful in this case. It can request certificates on behalf other constituents. It definitely works with IPA but it might not work with raw Dogtag. Would you consider evaluating this approach? -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/