I finally succeeded getting a Fedora Directory service installed on a "persistent" Fedora9 USB drive (DNS lookup issues caused previous reported startup problem). I am now attempting to install the DogTag PKI package on the USB drive using 'yum' -- but is prevented to do so - apparently a PKI repository for Fedora9 has not yet been built. Any suggestions? Should I may attempt a manual "piecemeal" type installation of individual PKI-RPM packages - if I knew the dependency-sequence, such task may be easier? Even if successful with such "piecemeal" installation, I assume there is no guarantee the Fedora8 built DogTag PKI system will "behave" properly under Fedora9! When can I expect a Fedora9 version of the DogTag PKI to become available? E. Hansen @ SPYRUS _____ From: Ebbe Hansen Sent: Thursday, May 29, 2008 3:01 PM To: 'pki-users(a)redhat.com' Subject: Failing to install directory server on Fedora9-live USB-stick using the Data Persistence option. The "livecd-iso-to-disk" command appears to work OK when loading Fedora9 on-to a USB thumb-drive with "persistence" option (with an appropriately sized overlay - I used 1 GBY overlay). Custom changes to file-system and installation of new applications appears to survive subsequent reboot sessions. However, while attempting to install the DogTag system on the "persistent" USB, I run unto trouble getting the Directory Server to startup properly. The log-file indicates the configuration session went OK - but the resulting instance does not start (or remain on running state) - the log-file does not indicate any errors! Have anyone on the list been successful getting the Directory Server (and DogTag PKI) to install on a "persistent" live USB? I am using fedora9 version 2.6.25-14.fc9.i686 - downloaded a few days ago. Any comments & suggestions appreciated! E. Hansen @ SPYRUS

I am currently testing the WEB enrollment features (https://<CA-instance-name>:<port>/ca/ee/ca) using the IE as well as the FireFox browsers. When requesting a Dual-Use certificate (Certificate Profile - Manual User Dual-Use Certificate Enrollment) I have the choice of invoking use of smart-cards / hard-tokens via a CSP or a PKCS#11 crypto provider. However, the keys generated always defaults to RSA 1024 bit! Has anyone found the place to modify/configure the DogTag Certificate Request WEB pages to default to (or enable selection of) other key-sizes e.g. 2048 bits? E. Hansen @ SPYRUS