CMCEnroll: java.io.IOException: Internal Error - java.io.IOException: Sequence tag error 9
Hi! I'm trying to get CMC signed enrollment to work. What I want to do is create certificate requests via a web based tool on one server, and ship them to the CA for auto-vetting. It looks like in my situation using signed CMC is the most simple solution. I *think* I have set everything up correctly but, when I try to test my assumption by using either CMCEnroll or CMCRequest to create a CMC request I get the following error: [root@ebbe test]# CMCEnroll -d "/root/test/cmc-agent/" -n "cmc" -r "/root/test/test3.csr" -p "bla" cert/key prefix = path = /root/test/cmc-agent/ java.io.IOException: Internal Error - java.io.IOException: Sequence tag error 9 at com.netscape.cmstools.CMCEnroll.getCMCBlob(CMCEnroll.java:133) at com.netscape.cmstools.CMCEnroll.main(CMCEnroll.java:412) and the same error comes when using CMCRequest. Now, this is NOT an error with the CA setup, as the CA doesn't come in play yet, no? Unfortunately I haven't debugged enough Java problems yet to understand what the error means. Maybe there's some library/class missing somewhere? If anyone could help out that would be great :) I'm running Fedora 9 and DogTag 1.00, package list is below: [root@ebbe test]# yum list | grep pki pki-ca.noarch 1.0.0-6.fc9 installed pki-ca-ui.noarch 1.0.0-1.fc9 installed pki-common.noarch 1.0.0-8.fc9 installed pki-common-ui.noarch 1.0.0-2.fc9 installed pki-console.noarch 1.0.0-4.fc9 installed pki-console-ui.noarch 1.0.0-1.fc9 installed pki-java-tools.noarch 1.0.0-1.fc9 installed pki-native-tools.i386 1.0.0-1.fc9 installed pki-ra.noarch 1.0.0-2.fc9 installed pki-ra-ui.noarch 1.0.0-1.fc9 installed pki-setup.noarch 1.0.0-2.fc9 installed pki-util.noarch 1.0.0-2.fc9 installed krb5-pkinit-openssl.i386 1.6.3-10.fc9 fedora pki-common-javadoc.noarch 1.0.0-8.fc9 pki pki-java-tools-javadoc.noarch 1.0.0-1.fc9 pki pki-kra.noarch 1.0.0-2.fc9 pki pki-kra-ui.noarch 1.0.0-2.fc9 pki pki-manage.noarch 1.0.0-1.fc9 pki pki-migrate.noarch 1.0.0-1.fc9 pki pki-ocsp.noarch 1.0.0-2.fc9 pki pki-ocsp-ui.noarch 1.0.0-1.fc9 pki pki-silent.noarch 1.0.0-1.fc9 pki pki-tks.noarch 1.0.0-2.fc9 pki pki-tks-ui.noarch 1.0.0-1.fc9 pki pki-tps.i386 1.0.0-2.fc9 pki pki-tps-ui.noarch 1.0.0-2.fc9 pki pki-util-javadoc.noarch 1.0.0-2.fc9 pki The contents of test3.csr: [root@ebbe test]# cat test3.csr Certificate request generated by Netscape certutil Phone: (not specified) Common Name: test4 Email: (not specified) Organization: (not specified) State: (not specified) Country: (not specified) -----BEGIN NEW CERTIFICATE REQUEST----- MIIBTzCBuQIBADAQMQ4wDAYDVQQDEwV0ZXN0NDCBnzANBgkqhkiG9w0BAQEFAAOB jQAwgYkCgYEA5wv8VPSNH7HH0Nsdr2/3xu3fqglDbQUz8CxhFvFHXm26a1DlyC+l pqZXCgozJzpb1N5EXDR/Wg1VVbcJNnKyvJOa4XqOqqAPFKLfH5GhAijOIIQRuLL/ WHlUeY2LUHcLCZ257b9QEOTrR6iVZPp74r2l7CBkXQ3zvx4PRfX2eY8CAwEAAaAA MA0GCSqGSIb3DQEBBQUAA4GBAB6R3Gf4koSXucYifCIFri3vTSt2ThK7GpKrYe86 JLYOTk4aNdaL/wZDNBLnnw8if8Gv2y/LcpR7Qvto52uckCA2+rRWEYmHhDs8NF6U q0HuaYaUgN1kdOqrzjGFaZxG5eSJkLnmFpKlp+9OsnNfz43v9zzeomzqSdRHpPEZ pmFM -----END NEW CERTIFICATE REQUEST----- The contents of the certificate database that's used for the CMC agent: [root@ebbe test]# certutil -L -d /root/test/cmc-agent Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CMC Agent - NetherNordic SLCS u,u,u cmc u,u,u ca c,c,c -- Jan
Jan Meijer wrote:
Hi!
I'm trying to get CMC signed enrollment to work.
What I want to do is create certificate requests via a web based tool on one server, and ship them to the CA for auto-vetting. It looks like in my situation using signed CMC is the most simple solution.
I *think* I have set everything up correctly but, when I try to test my assumption by using either CMCEnroll or CMCRequest to create a CMC request I get the following error:
[root@ebbe test]# CMCEnroll -d "/root/test/cmc-agent/" -n "cmc" -r "/root/test/test3.csr" -p "bla" cert/key prefix = path = /root/test/cmc-agent/ java.io.IOException: Internal Error - java.io.IOException: Sequence tag error 9 at com.netscape.cmstools.CMCEnroll.getCMCBlob(CMCEnroll.java:133) at com.netscape.cmstools.CMCEnroll.main(CMCEnroll.java:412)
There is something going on with your certificate request in /root/test/test3.csr
and the same error comes when using CMCRequest.
Now, this is NOT an error with the CA setup, as the CA doesn't come in play yet, no? Unfortunately I haven't debugged enough Java problems yet to understand what the error means. Maybe there's some library/class missing somewhere?
If anyone could help out that would be great :)
I'm running Fedora 9 and DogTag 1.00, package list is below:
[root@ebbe test]# yum list | grep pki pki-ca.noarch 1.0.0-6.fc9 installed pki-ca-ui.noarch 1.0.0-1.fc9 installed pki-common.noarch 1.0.0-8.fc9 installed pki-common-ui.noarch 1.0.0-2.fc9 installed pki-console.noarch 1.0.0-4.fc9 installed pki-console-ui.noarch 1.0.0-1.fc9 installed pki-java-tools.noarch 1.0.0-1.fc9 installed pki-native-tools.i386 1.0.0-1.fc9 installed pki-ra.noarch 1.0.0-2.fc9 installed pki-ra-ui.noarch 1.0.0-1.fc9 installed pki-setup.noarch 1.0.0-2.fc9 installed pki-util.noarch 1.0.0-2.fc9 installed krb5-pkinit-openssl.i386 1.6.3-10.fc9 fedora pki-common-javadoc.noarch 1.0.0-8.fc9 pki pki-java-tools-javadoc.noarch 1.0.0-1.fc9 pki pki-kra.noarch 1.0.0-2.fc9 pki pki-kra-ui.noarch 1.0.0-2.fc9 pki pki-manage.noarch 1.0.0-1.fc9 pki pki-migrate.noarch 1.0.0-1.fc9 pki pki-ocsp.noarch 1.0.0-2.fc9 pki pki-ocsp-ui.noarch 1.0.0-1.fc9 pki pki-silent.noarch 1.0.0-1.fc9 pki pki-tks.noarch 1.0.0-2.fc9 pki pki-tks-ui.noarch 1.0.0-1.fc9 pki pki-tps.i386 1.0.0-2.fc9 pki pki-tps-ui.noarch 1.0.0-2.fc9 pki pki-util-javadoc.noarch 1.0.0-2.fc9 pki
The contents of test3.csr:
[root@ebbe test]# cat test3.csr
Certificate request generated by Netscape certutil Phone: (not specified)
Common Name: test4 Email: (not specified) Organization: (not specified) State: (not specified) Country: (not specified)
-----BEGIN NEW CERTIFICATE REQUEST----- MIIBTzCBuQIBADAQMQ4wDAYDVQQDEwV0ZXN0NDCBnzANBgkqhkiG9w0BAQEFAAOB jQAwgYkCgYEA5wv8VPSNH7HH0Nsdr2/3xu3fqglDbQUz8CxhFvFHXm26a1DlyC+l pqZXCgozJzpb1N5EXDR/Wg1VVbcJNnKyvJOa4XqOqqAPFKLfH5GhAijOIIQRuLL/ WHlUeY2LUHcLCZ257b9QEOTrR6iVZPp74r2l7CBkXQ3zvx4PRfX2eY8CAwEAAaAA MA0GCSqGSIb3DQEBBQUAA4GBAB6R3Gf4koSXucYifCIFri3vTSt2ThK7GpKrYe86 JLYOTk4aNdaL/wZDNBLnnw8if8Gv2y/LcpR7Qvto52uckCA2+rRWEYmHhDs8NF6U q0HuaYaUgN1kdOqrzjGFaZxG5eSJkLnmFpKlp+9OsnNfz43v9zzeomzqSdRHpPEZ pmFM -----END NEW CERTIFICATE REQUEST-----
The csr seem to be somehow malformed: 0 335: SEQUENCE { 4 185: SEQUENCE { 7 1: INTEGER 0 10 16: SEQUENCE { 12 14: SET { 14 12: SEQUENCE { 16 3: OBJECT IDENTIFIER commonName (2 5 4 3) : (X.520 id-at (2 5 4)) 21 5: PrintableString 'test4' : } : } : } 28 159: SEQUENCE { 31 13: SEQUENCE { 33 9: OBJECT IDENTIFIER rsaEncryption (1 2 840 113549 1 1 1) : (PKCS #1) 44 0: NULL : } 46 141: BIT STRING, encapsulates { 50 137: SEQUENCE { 53 129: INTEGER : 00 E7 0B FC 54 F4 8D 1F B1 C7 D0 DB 1D AF 6F F7 : C6 ED DF AA 09 43 6D 05 33 F0 2C 61 16 F1 47 5E : 6D BA 6B 50 E5 C8 2F A5 A6 A6 57 0A 0A 33 27 3A : 5B D4 DE 44 5C 34 7F 5A 0D 55 55 B7 09 36 72 B2 : BC 93 9A E1 7A 8E AA A0 0F 14 A2 DF 1F 91 A1 02 : 28 CE 20 84 11 B8 B2 FF 58 79 54 79 8D 8B 50 77 : 0B 09 9D B9 ED BF 50 10 E4 EB 47 A8 95 64 FA 7B : E2 BD A5 EC 20 64 5D 0D F3 BF 1E 0F 45 F5 F6 79 : 8F 185 3: INTEGER 65537 : } : } : } 190 0: [0] * : Error: Object has zero length.* ...snip...
The contents of the certificate database that's used for the CMC agent:
[root@ebbe test]# certutil -L -d /root/test/cmc-agent
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
CMC Agent - NetherNordic SLCS u,u,u cmc u,u,u ca c,c,c
Hi Marc, On Thu, 30 Oct 2008, Marc Sauton wrote:
The csr seem to be somehow malformed:
snip
185 3: INTEGER 65537 : } : } : } 190 0: [0] * : Error: Object has zero length.*
Tnx :) This would certainly explain something. Which tool did you use to parse the request? -- Jan
Jan Meijer wrote:
Hi Marc,
On Thu, 30 Oct 2008, Marc Sauton wrote:
The csr seem to be somehow malformed:
snip
185 3: INTEGER 65537 : } : } : } 190 0: [0] * : Error: Object has zero length.*
Tnx :) This would certainly explain something. Which tool did you use to parse the request?
With a free third party tool called dumpasn1: dumpasn1 - ASN.1 object dump utility http://www.cs.auckland.ac.nz/~pgut001/ In was in older versions of the Red Hat Certificate System, there is till a small reference in: http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide... But not fully up to date. You can find it via yum on Fedora. M.
Hi, Try removing all of the text from your request file before the -----BEGIN NEW CERTIFICATE REQUEST----- line. (The "Certificate request generated by Netscape certutil...Phone...", etc text.) I tried that and then CMCEnroll worked on your request on my system. I'm not sure if your request is really malformed, it just doesn't have any Attributes in it, so the SET OF Attributes (PKCS#10) is zero length and dumpasn1 complains. Mike On Thu, Oct 30, 2008 at 2:16 PM, Jan Meijer <Jan.Meijer@uninett.no> wrote: <remove this text>
Certificate request generated by Netscape certutil Phone: (not specified)
Common Name: test4 Email: (not specified) Organization: (not specified) State: (not specified) Country: (not specified)
</remove this text>
-----BEGIN NEW CERTIFICATE REQUEST----- MIIBTzCBuQIBADAQMQ4wDAYDVQQDEwV0ZXN0NDCBnzANBgkqhkiG9w0BAQEFAAOB jQAwgYkCgYEA5wv8VPSNH7HH0Nsdr2/3xu3fqglDbQUz8CxhFvFHXm26a1DlyC+l pqZXCgozJzpb1N5EXDR/Wg1VVbcJNnKyvJOa4XqOqqAPFKLfH5GhAijOIIQRuLL/ WHlUeY2LUHcLCZ257b9QEOTrR6iVZPp74r2l7CBkXQ3zvx4PRfX2eY8CAwEAAaAA MA0GCSqGSIb3DQEBBQUAA4GBAB6R3Gf4koSXucYifCIFri3vTSt2ThK7GpKrYe86 JLYOTk4aNdaL/wZDNBLnnw8if8Gv2y/LcpR7Qvto52uckCA2+rRWEYmHhDs8NF6U q0HuaYaUgN1kdOqrzjGFaZxG5eSJkLnmFpKlp+9OsnNfz43v9zzeomzqSdRHpPEZ pmFM -----END NEW CERTIFICATE REQUEST-----
Hi Mike, On Fri, 31 Oct 2008, Michael Peck wrote:
Try removing all of the text from your request file before the -----BEGIN NEW CERTIFICATE REQUEST----- line. (The "Certificate request generated by Netscape certutil...Phone...", etc text.) I tried that and then CMCEnroll worked on your request on my system.
I'm not sure if your request is really malformed, it just doesn't have any Attributes in it, so the SET OF Attributes (PKCS#10) is zero length and dumpasn1 complains.
And indeed it does over here as well, working that is. My request is not malformed out of the ordinary. The zero length that dumpasn1 complains about is explained by Steve Henson: http://www.mail-archive.com/openssl-dev@openssl.org/msg10922.html I tested further today and got more frustrated and then got it working and now I think I know what's going on. Thanks for delivering the final piece to my little puzzle :) I tested with requests generated by certutil and openssl. And given my familiarity with openssl I started with that. CMCEnroll bombed on the openssl PEM input, so I figured, well, convert it to DER. And then the bombing was different and I got the error I sent to the list. Because this approach didn't work, switched to certutil *testing with the binary output*. I did test it with ASCII output but apparently didn't test with the stuff in front of the actual request removed, otherwise I'd have found the right way yesterday already. I got it working today with a request generated by the pkiconsole. An ascii request. And then I tried your suggestion and yes, it worked as well. Then I tried again with my openssl ascii output, and no, didn't work. But, then I converted the openssl DER output to binary using the AtoB utility and *then* it worked. I don't know enough intricate details about the formats the requests can be in but am tempted to say that the openssl binary format is incompatible with what is expected by CMCEnroll. And little technologist, what did you learn today? That when confronted with multiple options I should document what I've tested in a proper test matrix. And, oh lucky me, I learned to use certutil. I think that tool is a bit clunky ;) Mike, Marc, thanks for your help :=) I'm now unstuck and on the road to bliss. -- Jan
Jan Meijer wrote:
Hi Mike,
On Fri, 31 Oct 2008, Michael Peck wrote:
Try removing all of the text from your request file before the -----BEGIN NEW CERTIFICATE REQUEST----- line. (The "Certificate request generated by Netscape certutil...Phone...", etc text.) I tried that and then CMCEnroll worked on your request on my system.
I'm not sure if your request is really malformed, it just doesn't have any Attributes in it, so the SET OF Attributes (PKCS#10) is zero length and dumpasn1 complains.
And indeed it does over here as well, working that is. My request is not malformed out of the ordinary. The zero length that dumpasn1 complains about is explained by Steve Henson:
http://www.mail-archive.com/openssl-dev@openssl.org/msg10922.html
I tested further today and got more frustrated and then got it working and now I think I know what's going on. Thanks for delivering the final piece to my little puzzle :)
I tested with requests generated by certutil and openssl. And given my familiarity with openssl I started with that. CMCEnroll bombed on the openssl PEM input, The difference between NSS and OpenSSL formats is usually in the headers. See: http://pki.fedoraproject.org/wiki/PKI_TechNote_X509_Certificates http://pki.fedoraproject.org/wiki/PKI_TechNote_CRLS
so I figured, well, convert it to DER. And then the bombing was different and I got the error I sent to the list.
Because this approach didn't work, switched to certutil *testing with the binary output*. I did test it with ASCII output but apparently didn't test with the stuff in front of the actual request removed, otherwise I'd have found the right way yesterday already.
I got it working today with a request generated by the pkiconsole. An ascii request. And then I tried your suggestion and yes, it worked as well.
Then I tried again with my openssl ascii output, and no, didn't work. But, then I converted the openssl DER output to binary using the AtoB utility and *then* it worked.
I don't know enough intricate details about the formats the requests can be in but am tempted to say that the openssl binary format is incompatible with what is expected by CMCEnroll.
And little technologist, what did you learn today? That when confronted with multiple options I should document what I've tested in a proper test matrix.
And, oh lucky me, I learned to use certutil. I think that tool is a bit clunky ;)
Mike, Marc, thanks for your help :=) I'm now unstuck and on the road to bliss.
And to end the story, I've now got the total setup working, signed CMC enrollment :) Thanks for the help! -- Jan
participants (5)
-
Andrew Wnuk -
Jan Meijer -
Jan Meijer
-
Marc Sauton -
Michael Peck