11:42 p.m.
Hi pki-users,
I am using Fedora 11 and DCS 1.2.x.x.
I was installing only pki-ca instance; no other DCS PKI subsystem is
installed.
I was also able to start the pki-ca process.
When I was about to configure the pki-ca instance, I could not access the
CA's GUI using the web browser.
I am using firefox web browser in the machine to access the CA's
configuration URL provided at the end of the log file.
Could you help me to guide me in the right direction to solve this issue?
Thanks,
Erwin
11:50 p.m.
As a quick test, try setting selinux in permissive mode.
setenforce 0
and restart the pki-ca instance.
Ade
On Tue, 2010-02-02 at 23:42 -0600, Erwin Himawan wrote:
Hi pki-users,
I am using Fedora 11 and DCS 1.2.x.x.
I was installing only pki-ca instance; no other DCS PKI subsystem is
installed.
I was also able to start the pki-ca process.
When I was about to configure the pki-ca instance, I could not access the
CA's GUI using the web browser.
I am using firefox web browser in the machine to access the CA's
configuration URL provided at the end of the log file.
Could you help me to guide me in the right direction to solve this issue?
Thanks,
Erwin
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
6:39 p.m.
Ade,
Thanks for your suggestion; I did "setenforce 0".
In addition to that, I entered wrong URL, which I obtained from the logfile;
i.e. https://:9445/ca/admin/console/config/login?pin=xxxxxxxxxxx
Once I entered this URL; i.e.
http://FQDN:9180/ca/admin/console/config/login?pin=xxxxxxxxxxxxxxx,
I can access the CA configuration UI.
Regards,
Erwin
On Tue, Feb 2, 2010 at 11:50 PM, Ade Lee <alee(a)redhat.com> wrote:
As a quick test, try setting selinux in permissive mode.
setenforce 0
and restart the pki-ca instance.
Ade
On Tue, 2010-02-02 at 23:42 -0600, Erwin Himawan wrote:
> Hi pki-users,
>
> I am using Fedora 11 and DCS 1.2.x.x.
> I was installing only pki-ca instance; no other DCS PKI subsystem is
> installed.
> I was also able to start the pki-ca process.
>
> When I was about to configure the pki-ca instance, I could not access the
> CA's GUI using the web browser.
> I am using firefox web browser in the machine to access the CA's
> configuration URL provided at the end of the log file.
>
> Could you help me to guide me in the right direction to solve this issue?
>
> Thanks,
> Erwin
>
>
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-users
3:33 p.m.
New subject: change Root CA's Validity
Dear All,
I installed DogTag. The default validity of ROOT CA is 2 years. Is a way to change the
ROOT CA's validity during the configuration wizard?
Thanks,
Fu-Jyh Luo
6:06 a.m.
New subject: change Root CA's Validity
Fu-Jyh Luo hello. This might be overkill but you're welcome to it.
I think the default cert expiry period with CMS is 2 years -- way too
short. This script enables 7300 days = 20 years, rather.
#!/bin/bash
#
# COMPONENT_NAME: ca-delta-range.sh
#
# HISTORY: Version 1.0 2008/10 Dave (David) Donnan
#
cd /var/lib/pki-ca/profiles/ca
for file in *.cfg; do
echo $file
cp -p $file $file.pre7300
sed 's/range=[0-9]*/range=7300/' $file.pre7300 > $file
chmod 755 $file
chown pkiuser:pkiuser $file
done
cd /var/lib/pki-ca/conf
for file in *.profile; do
echo $file
cp -p $file $file.pre7300
sed 's/range=[0-9]*/range=7300/' $file.pre7300 > $file
chmod 755 $file
chown pkiuser:pkiuser $file
done
# end
Similarly, I wrote kra-dra-delta-range.sh to be used later:
#!/bin/bash
#
# COMPONENT_NAME: kra-dra-delta-range.sh
#
# HISTORY: Version 1.0 2008/10 Dave (David) Donnan Original
#
#
cd /var/lib/pki-kra/conf
for file in *.profile; do
echo $file
cp -p $file $file.pre7300
sed 's/range=[0-9]*/range=7300/' $file.pre7300 > $file
chmod 755 $file
chown pkiuser:pkiuser $file
done
# end
Fu-Jyh Luo wrote:
Dear All,
I installed DogTag. The default validity of ROOT CA is 2 years. Is a way to change the
ROOT CA's validity during the configuration wizard?
Thanks,
Fu-Jyh Luo
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
10:09 a.m.
New subject: change Root CA's Validity
Dave,
It is a good and useful script. Where should the script be run? After
creating pki-ca instance and prior to configuring the pki-ca instance?
Thanks,
Erwin
On Fri, Feb 12, 2010 at 6:06 AM, David (Dave) Donnan <
david.donnan(a)thalesgroup.com> wrote:
Fu-Jyh Luo hello. This might be overkill but you're welcome to
it.
I think the default cert expiry period with CMS is 2 years – way too short.
This script enables 7300 days = 20 years, rather.
#!/bin/bash
#
# COMPONENT_NAME: ca-delta-range.sh
#
# HISTORY: Version 1.0 2008/10 Dave (David) Donnan
#
cd /var/lib/pki-ca/profiles/ca
for file in *.cfg; do
echo $file
cp -p $file $file.pre7300
sed 's/range=[0-9]*/range=7300/' $file.pre7300 > $file
chmod 755 $file
chown pkiuser:pkiuser $file
done
cd /var/lib/pki-ca/conf
for file in *.profile; do
echo $file
cp -p $file $file.pre7300
sed 's/range=[0-9]*/range=7300/' $file.pre7300 > $file
chmod 755 $file
chown pkiuser:pkiuser $file
done
# end
Similarly, I wrote kra-dra-delta-range.sh to be used later:
#!/bin/bash
#
# COMPONENT_NAME: kra-dra-delta-range.sh
#
# HISTORY: Version 1.0 2008/10 Dave (David) Donnan Original
#
#
cd /var/lib/pki-kra/conf
for file in *.profile; do
echo $file
cp -p $file $file.pre7300
sed 's/range=[0-9]*/range=7300/' $file.pre7300 > $file
chmod 755 $file
chown pkiuser:pkiuser $file
done
# end
Fu-Jyh Luo wrote:
Dear All,
I installed DogTag. The default validity of ROOT CA is 2 years. Is a way to change the
ROOT CA's validity during the configuration wizard?
Thanks,
Fu-Jyh Luo
_______________________________________________
Pki-users mailing
listPki-users@redhat.comhttps://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
8:57 a.m.
New subject: change Root CA's Validity
Immediately after ‘yum install’ and before launching the following URL,
in your Browser, run the following script,
http://dogtag.x.y:9080/ca/admin/console/config/login?pin=wefcqIpLK76vmfs7...
<http://dogtag.theresis.thales:9080/ca/admin/console/config/login?pin=wefc...
Cdlt, Dave
--------
Erwin Himawan wrote:
Dave,
It is a good and useful script. Where should the script be run?
After creating pki-ca instance and prior to configuring the pki-ca
instance?
Thanks,
Erwin
On Fri, Feb 12, 2010 at 6:06 AM, David (Dave) Donnan
<david.donnan(a)thalesgroup.com <mailto:david.donnan@thalesgroup.com>>
wrote:
Fu-Jyh Luo hello. This might be overkill but you're welcome to it.
I think the default cert expiry period with CMS is 2 years – way
too short. This script enables 7300 days = 20 years, rather.
#!/bin/bash
#
# COMPONENT_NAME: ca-delta-range.sh
#
# HISTORY: Version 1.0 2008/10 Dave (David) Donnan
#
cd /var/lib/pki-ca/profiles/ca
for file in *.cfg; do
echo $file
cp -p $file $file.pre7300
sed 's/range=[0-9]*/range=7300/' $file.pre7300 > $file
chmod 755 $file
chown pkiuser:pkiuser $file
done
cd /var/lib/pki-ca/conf
for file in *.profile; do
echo $file
cp -p $file $file.pre7300
sed 's/range=[0-9]*/range=7300/' $file.pre7300 > $file
chmod 755 $file
chown pkiuser:pkiuser $file
done
# end
Similarly, I wrote kra-dra-delta-range.sh to be used later:
#!/bin/bash
#
# COMPONENT_NAME: kra-dra-delta-range.sh
#
# HISTORY: Version 1.0 2008/10 Dave (David) Donnan Original
#
#
cd /var/lib/pki-kra/conf
for file in *.profile; do
echo $file
cp -p $file $file.pre7300
sed 's/range=[0-9]*/range=7300/' $file.pre7300 > $file
chmod 755 $file
chown pkiuser:pkiuser $file
done
# end
Fu-Jyh Luo wrote:
> Dear All,
>
> I installed DogTag. The default validity of ROOT CA is 2 years. Is a way to
change the ROOT CA's validity during the configuration wizard?
>
> Thanks,
> Fu-Jyh Luo
>
>
>
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com <mailto:Pki-users@redhat.com>
> https://www.redhat.com/mailman/listinfo/pki-users
>
>
_______________________________________________
Pki-users mailing list
Pki-users(a)redhat.com <mailto:Pki-users@redhat.com>
https://www.redhat.com/mailman/listinfo/pki-users
5737
days inactive
5749
days old
6 comments
4 participants
participants (4)
-
Ade Lee -
David (Dave) Donnan -
Erwin Himawan -
Fu-Jyh Luo