11:09 a.m.
What are the steps to integrate DogTag (Root) CA with an HSM? Does this have to occur
during installation?
I've successfully performed a general installation with CA keys in software. I was
then able to modify secmod.db to add the HSM library and restart the system. I can both
use command line utilities (certutil) and GUI (pkiconsole) to create keys on the HSM.
Re-keying the caSigning certificate works but the CA certificate is issued (issuer) by the
original software-based issuer (therefore NOT a self-signed CA cert!). So I assume this
has to be done during initial installation (custom install). But, how do I get the HSM
PKCS#11 library added/included with the custom install?
-----------------------------------------------------------
Dennis Gnatowski
dgnatowski(a)yahoo.com
2:10 p.m.
On 11/02/2014 09:09 AM, Dennis Gnatowski wrote:
What are the steps to integrate DogTag (Root) CA with an HSM? Does
this have to occur during installation?
I've successfully performed a general installation with CA keys in
software. I was then able to modify secmod.db to add the HSM library
and restart the system. I can both use command line utilities
(certutil) and GUI (pkiconsole) to create keys on the HSM. Re-keying
the caSigning certificate works but the CA certificate is issued
(issuer) by the original software-based issuer (therefore NOT a
self-signed CA cert!). So I assume this has to be done during initial
installation (custom install). But, how do I get the HSM PKCS#11
library added/included with the custom install?
-----------------------------------------------------------
Dennis Gnatowski
dgnatowski(a)yahoo.com
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
Adding the PKCS #11 module to
secmod.db should happen after the
pkicreate and just before running the silent install or the web based
configuration wizard.
In Dogtag 10, when using pkispawn, you can split the install and config
steps in two using the flags pki_skip_configuration and
pki_skip_installation.
M.
4:28 p.m.
I'm using Dogtag 10.1.1 with SafeNet Luna SA HSM. I changed the flags in the
default.cfg file, performed the install, then added the PKCS#11 library to secmod.
However, either using the Wizard to do the configuration or modifying the default.cfg file
again and using pkispawn failed to get CA keys generated on the HSM. Wizard doesn't
see the SafeNet library (does it have to be in a specific directory?) and pkispawn throws
an error "pkispawn : ERROR ....... KeyError: 'pki_uid'!" I
noticed this was reported in ticket #905.
-----------------------------------------------------------
Dennis Gnatowski
dgnatowski(a)yahoo.com
________________________________
From: Marc Sauton <msauton(a)redhat.com>
To: Dennis Gnatowski <dgnatowski(a)yahoo.com>; "pki-users(a)redhat.com"
<pki-users(a)redhat.com>
Sent: Monday, November 3, 2014 3:10 PM
Subject: Re: [Pki-users] CA integration and installation with HSM
On 11/02/2014 09:09 AM, Dennis Gnatowski wrote:
What are the steps to integrate DogTag (Root) CA with an HSM? Does this have to occur
during installation?
I've successfully performed a general installation with CA keys in software. I was
then able to modify secmod.db to add the HSM library and restart the system. I can both
use command line utilities (certutil) and GUI (pkiconsole) to create keys on the HSM.
Re-keying the caSigning certificate works but the CA certificate is issued (issuer) by the
original software-based issuer (therefore NOT a self-signed CA cert!). So I assume this
has to be done during initial installation (custom install). But, how do I get the HSM
PKCS#11 library added/included with the custom install?
-----------------------------------------------------------
Dennis Gnatowski
dgnatowski(a)yahoo.com
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Adding the PKCS #11 module to secmod.db should happen after the pkicreate and just before
running the silent install or the web based configuration wizard.
In Dogtag 10, when using pkispawn, you can split the install and
config steps in two using the flags pki_skip_configuration and
pki_skip_installation.
M.
8:10 p.m.
You might want to check the basics first.
If you cd into your <dogtag instance directory>/alias
and perform
modutil -dbdir . -list
What do you see?
If you don't see the module, that means your HSM has not been loaded
correctly. If loaded correctly you should see info on the library name,
slots and status: loaded.
The library doesn't have to be in a specific location, but when you use
modutil to add you need to specify the libfile so it knows where to go.
Normally it is at /usr/lunasa/lib/ though.
I'll let someone who has knowledge about the pkispawn issue to answer
the rest of the question. Until then, you can try the above just to see
if your hsm has been loaded correctly.
Christina
On 11/05/2014 02:28 PM, Dennis Gnatowski wrote:
I'm using Dogtag 10.1.1 with SafeNet Luna SA HSM. I changed the
flags
in the default.cfg file, performed the install, then added the PKCS#11
library to secmod. However, either using the Wizard to do the
configuration or modifying the default.cfg file again and using
pkispawn failed to get CA keys generated on the HSM. Wizard doesn't
see the SafeNet library (does it have to be in a specific directory?)
and pkispawn throws an error "pkispawn : ERROR ....... KeyError:
'pki_uid'!" I noticed this was reported in ticket #905.
-----------------------------------------------------------
Dennis Gnatowski
dgnatowski(a)yahoo.com
------------------------------------------------------------------------
*From:* Marc Sauton <msauton(a)redhat.com>
*To:* Dennis Gnatowski <dgnatowski(a)yahoo.com>; "pki-users(a)redhat.com"
<pki-users(a)redhat.com>
*Sent:* Monday, November 3, 2014 3:10 PM
*Subject:* Re: [Pki-users] CA integration and installation with HSM
On 11/02/2014 09:09 AM, Dennis Gnatowski wrote:
> What are the steps to integrate DogTag (Root) CA with an HSM? Does
> this have to occur during installation?
>
> I've successfully performed a general installation with CA keys in
> software. I was then able to modify secmod.db to add the HSM library
> and restart the system. I can both use command line utilities
> (certutil) and GUI (pkiconsole) to create keys on the HSM. Re-keying
> the caSigning certificate works but the CA certificate is issued
> (issuer) by the original software-based issuer (therefore NOT a
> self-signed CA cert!). So I assume this has to be done during
> initial installation (custom install). But, how do I get the HSM
> PKCS#11 library added/included with the custom install?
> -----------------------------------------------------------
> Dennis Gnatowski
> dgnatowski(a)yahoo.com <mailto:dgnatowski@yahoo.com>
>
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com <mailto:Pki-users@redhat.com>
> https://www.redhat.com/mailman/listinfo/pki-users
Adding the PKCS #11 module to secmod.db should happen after the
pkicreate and just before running the silent install or the web based
configuration wizard.
In Dogtag 10, when using pkispawn, you can split the install and
config steps in two using the flags pki_skip_configuration and
pki_skip_installation.
M.
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
7:20 a.m.
Thank you Christina.
The module loaded fine as reported by output from modutil; however, I had to restart the
service in order for the Wizard to pick it up. Keys are now on the HSM.
-----------------------------------------------------------
Dennis Gnatowski
dgnatowski(a)yahoo.com
________________________________
From: Christina Fu <cfu(a)redhat.com>
To: pki-users(a)redhat.com
Sent: Wednesday, November 5, 2014 9:10 PM
Subject: Re: [Pki-users] CA integration and installation with HSM
You might want to check the basics first.
If you cd into your <dogtag instance directory>/alias
and perform
modutil -dbdir . -list
What do you see?
If you don't see the module, that means your HSM has not been loaded
correctly. If loaded correctly you should see info on the library
name, slots and status: loaded.
The library doesn't have to be in a specific location, but when you
use modutil to add you need to specify the libfile so it knows where
to go.
Normally it is at /usr/lunasa/lib/ though.
I'll let someone who has knowledge about the pkispawn issue to
answer the rest of the question. Until then, you can try the above
just to see if your hsm has been loaded correctly.
Christina
On 11/05/2014 02:28 PM, Dennis Gnatowski wrote:
I'm using Dogtag 10.1.1 with SafeNet Luna SA HSM. I changed the flags in the
default.cfg file, performed the install, then added the PKCS#11 library to secmod.
However, either using the Wizard to do the configuration or modifying the default.cfg file
again and using pkispawn failed to get CA keys generated on the HSM. Wizard doesn't
see the SafeNet library (does it have to be in a specific directory?) and pkispawn throws
an error "pkispawn : ERROR ....... KeyError: 'pki_uid'!" I
noticed this was reported in ticket #905.
-----------------------------------------------------------
Dennis Gnatowski
dgnatowski(a)yahoo.com
________________________________
From: Marc Sauton <msauton(a)redhat.com>
To: Dennis Gnatowski <dgnatowski(a)yahoo.com>; "pki-users(a)redhat.com"
<pki-users(a)redhat.com>
Sent: Monday, November 3, 2014 3:10 PM
Subject: Re: [Pki-users] CA integration and installation with HSM
On 11/02/2014 09:09 AM, Dennis Gnatowski wrote:
What are the steps to integrate DogTag (Root) CA with an HSM? Does this have to occur
during installation?
>
>
>I've successfully performed a general installation with CA keys in software. I
was then able to modify secmod.db to add the HSM library and restart the system. I can
both use command line utilities (certutil) and GUI (pkiconsole) to create keys on the HSM.
Re-keying the caSigning certificate works but the CA certificate is issued (issuer) by
the original software-based issuer (therefore NOT a self-signed CA cert!). So I assume
this has to be done during initial installation (custom install). But, how do I get the
HSM PKCS#11 library added/included with the custom install?
>
>-----------------------------------------------------------
>Dennis Gnatowski
>dgnatowski(a)yahoo.com
>
>
>_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com https://www.redhat.com/mailman/listinfo/pki-users
Adding the PKCS #11 module to secmod.db should happen after the pkicreate and just before
running the silent install or the web based configuration wizard.
In Dogtag 10, when using pkispawn, you can split the
install and config steps in two using the flags
pki_skip_configuration and pki_skip_installation.
M.
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
3466
days inactive
3470
days old
4 comments
3 participants
participants (3)
-
Christina Fu -
Dennis Gnatowski -
Marc Sauton