<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="DE" link="blue" vlink="purple"> <div class="WordSection1"> I’m testing with certmonger 0.78.6 (patched for the GETCACertChain bug) against two EJBCA servers. For verification I a use a second SCEP client called jSCEP. <o:p></o:p> <o:p> </o:p> I started certmonger in debug mode with “/usr/libexec/certmonger/certmonger-session -n -d 15”<o:p></o:p> <o:p> </o:p> The CA file in /root/.config/certmonger/cas looks like this:<o:p></o:p> <o:p> </o:p> id=Test_Sweden<o:p></o:p> ca_aka=SCEP (certmonger 0.78.6)<o:p></o:p> ca_is_default=0<o:p></o:p> ca_type=EXTERNAL<o:p></o:p> ca_external_helper=/usr/libexec/certmonger/scep-submit -u http://ejbca-test2.primekey.se:8080/ejbca/publicweb/apply/scep/mxratest/pkiclient.exe -i "mx_kd3" <o:p></o:p> ca_capabilities=POSTPKIOperation,Renewal,SHA-1<o:p></o:p> scep_ca_identifier=iCOM Kunde1 Schweden<o:p></o:p> ca_encryption_cert=-----BEGIN CERTIFICATE-----<o:p></o:p> <bla><o:p></o:p> -----END CERTIFICATE-----<o:p></o:p> ca_encryption_issuer_cert=-----BEGIN CERTIFICATE-----<o:p></o:p> <bla><o:p></o:p> -----END CERTIFICATE-----<o:p></o:p> <o:p> </o:p> <div style="mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm"> <o:p> </o:p> </div> <o:p> </o:p> Issuing the request<o:p></o:p> <o:p> </o:p> “getcert request -c Test_Sweden -v -d /tmp/nssdb -g 2048 -I husky201 -p /tmp/pwd.txt -n husky201 -L abcd -N CN='husky201' –s”<o:p></o:p> <o:p> </o:p> gives this log:<o:p></o:p> <o:p> </o:p> 2016-08-22 10:31:13 [22931] Handling D-Bus traffic (Read) on FD 8 for 0x7fbe6b0c02e0.<o:p></o:p> 2016-08-22 10:31:13 [22931] message 0x7fbe6b0c02e0(method_call)->org.fedorahosted.certmonger:/org/fedorahosted/certmonger:org.fedorahosted.certmonger.add_request<o:p></o:p> 2016-08-22 10:31:13 [22931] Pending GetConnectionUnixUser serial 135<o:p></o:p> 2016-08-22 10:31:13 [22931] Pending GetConnectionUnixProcessID serial 136<o:p></o:p> 2016-08-22 10:31:13 [22931] Queuing FD 8 for Read for 0x7fbe6b0c02e0:0x7fbe6b0aa690.<o:p></o:p> 2016-08-22 10:31:13 [22931] Dequeuing FD 8 for Read for 0x7fbe6b0c02e0:0x7fbe6b0aa690.<o:p></o:p> 2016-08-22 10:31:13 [22931] Handling D-Bus traffic (Read) on FD 8 for 0x7fbe6b0c02e0.<o:p></o:p> 2016-08-22 10:31:13 [22931] message 0x7fbe6b0c02e0(method_return)->135->73<o:p></o:p> 2016-08-22 10:31:13 [22931] message 0x7fbe6b0c02e0(method_return)->136->74<o:p></o:p> 2016-08-22 10:31:13 [22931] User ID 0 PID 23133 called /org/fedorahosted/certmonger:org.fedorahosted.certmonger.add_request.<o:p></o:p> 2016-08-22 10:31:13 [23135] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:31:13 [23135] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:31:13 [23135] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:31:13 [23135] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:31:13 [23135] Located the key 'husky201'.<o:p></o:p> 2016-08-22 10:31:13 [23135] Converted private key 'husky201' to public key.<o:p></o:p> 2016-08-22 10:31:13 [23135] Key is an RSA key.<o:p></o:p> 2016-08-22 10:31:13 [23135] Key size is 2048.<o:p></o:p> 2016-08-22 10:31:13 [23136] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:31:13 [23136] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:31:13 [23136] Found token 'NSS Generic Crypto Services'.<o:p></o:p> 2016-08-22 10:31:13 [23136] Cert storage slot still needs user PIN to be set.<o:p></o:p> 2016-08-22 10:31:13 [23136] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:31:13 [23136] Error locating certificate.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') starts in state 'NEWLY_ADDED'<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') taking writing lock<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'NEWLY_ADDED_START_READING_KEYINFO'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') now.<o:p></o:p> 2016-08-22 10:31:13 [22931] Started Request7('husky201').<o:p></o:p> 2016-08-22 10:31:13 [22931] Queuing FD 8 for Read for 0x7fbe6b0c02e0:0x7fbe6b09b4e0.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'NEWLY_ADDED_READING_KEYINFO'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') on traffic from 11.<o:p></o:p> 2016-08-22 10:31:13 [22931] Dequeuing FD 8 for Read for 0x7fbe6b0c02e0:0x7fbe6b09b4e0.<o:p></o:p> 2016-08-22 10:31:13 [22931] Handling D-Bus traffic (Read) on FD 8 for 0x7fbe6b0c02e0.<o:p></o:p> 2016-08-22 10:31:13 [22931] message 0x7fbe6b0c02e0(method_call)->org.fedorahosted.certmonger:/org/fedorahosted/certmonger/requests/Request7:org.fedorahosted.certmonger.request.get_nickname<o:p></o:p> 2016-08-22 10:31:13 [22931] Pending GetConnectionUnixUser serial 140<o:p></o:p> 2016-08-22 10:31:13 [22931] Pending GetConnectionUnixProcessID serial 141<o:p></o:p> 2016-08-22 10:31:13 [22931] Queuing FD 8 for Read for 0x7fbe6b0c02e0:0x7fbe6b0ae0a0.<o:p></o:p> 2016-08-22 10:31:13 [22931] Dequeuing FD 8 for Read for 0x7fbe6b0c02e0:0x7fbe6b0ae0a0.<o:p></o:p> 2016-08-22 10:31:13 [22931] Handling D-Bus traffic (Read) on FD 8 for 0x7fbe6b0c02e0.<o:p></o:p> 2016-08-22 10:31:13 [22931] message 0x7fbe6b0c02e0(method_return)->140->75<o:p></o:p> 2016-08-22 10:31:13 [22931] message 0x7fbe6b0c02e0(method_return)->141->76<o:p></o:p> 2016-08-22 10:31:13 [22931] User ID 0 PID 23133 called /org/fedorahosted/certmonger/requests/Request7:org.fedorahosted.certmonger.request.get_nickname.<o:p></o:p> 2016-08-22 10:31:13 [22931] Queuing FD 8 for Read for 0x7fbe6b0c02e0:0x7fbe6b09b4e0.<o:p></o:p> 2016-08-22 10:31:13 [23137] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:31:13 [23137] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:31:13 [23137] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:31:13 [23137] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:31:13 [23137] Located the key 'husky201'.<o:p></o:p> 2016-08-22 10:31:13 [23137] Converted private key 'husky201' to public key.<o:p></o:p> 2016-08-22 10:31:13 [23137] Key is an RSA key.<o:p></o:p> 2016-08-22 10:31:13 [23137] Key size is 2048.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'NEWLY_ADDED_START_READING_CERT'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') now.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'NEWLY_ADDED_READING_CERT'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') on traffic from 11.<o:p></o:p> 2016-08-22 10:31:13 [23138] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:31:13 [23138] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:31:13 [23138] Found token 'NSS Generic Crypto Services'.<o:p></o:p> 2016-08-22 10:31:13 [23138] Cert storage slot still needs user PIN to be set.<o:p></o:p> 2016-08-22 10:31:13 [23138] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:31:13 [23138] Error locating certificate.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'NEWLY_ADDED_DECIDING'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') now.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') releasing writing lock<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') has no certificate, will attempt enrollment using already-present key<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'NEED_CSR'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') now.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'GENERATING_CSR'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') on traffic from 11.<o:p></o:p> 2016-08-22 10:31:13 [23139] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:31:13 [23139] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:31:13 [23139] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:31:13 [23139] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:31:13 [23139] Located the key 'husky201'.<o:p></o:p> 2016-08-22 10:31:13 [23139] Converted private key 'husky201' to public key.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'HAVE_CSR'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') now.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'NEED_TO_SUBMIT'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') now.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'SUBMITTING'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') on traffic from 15.<o:p></o:p> 2016-08-22 10:31:13 [22931] Certificate submission attempt complete.<o:p></o:p> 2016-08-22 10:31:13 [22931] Child status = 16.<o:p></o:p> 2016-08-22 10:31:13 [22931] Child output:<o:p></o:p> <o:p> </o:p> "Error reading request, expected PKCS7 data.<o:p></o:p> "<o:p></o:p> 2016-08-22 10:31:13 [22931] Error reading request, expected PKCS7 data.<o:p></o:p> 2016-08-22 10:31:13 [22931] Certificate not (yet?) issued.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') goes to a CA over SCEP, need to generate SCEP data.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'NEED_SCEP_DATA'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') now.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'GENERATING_SCEP_DATA'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') on traffic from 11.<o:p></o:p> 2016-08-22 10:31:13 [23141] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:31:13 [23141] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:31:13 [23141] Generating dummy key.<o:p></o:p> 2016-08-22 10:31:13 [23141] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:31:13 [23141] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:31:13 [23141] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:31:13 [23141] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:31:13 [23141] Located the key 'husky201'.<o:p></o:p> 2016-08-22 10:31:13 [23141] Converted private key 'husky201' to public key.<o:p></o:p> 2016-08-22 10:31:13 [23141] Server does not support DES3, using DES.<o:p></o:p> 2016-08-22 10:31:13 [23141] Server does not support better digests, using MD5.<o:p></o:p> 2016-08-22 10:31:13 [23141] Generating PKCSREQ pkiMessage.<o:p></o:p> 2016-08-22 10:31:13 [23141] Setting transaction ID "46763632748922674693649122043315271915873922247404248201497767686509312971065".<o:p></o:p> 2016-08-22 10:31:13 [23141] Setting message type "19".<o:p></o:p> 2016-08-22 10:31:13 [23141] Setting sender nonce.<o:p></o:p> 2016-08-22 10:31:13 [23141] Signed data.<o:p></o:p> 2016-08-22 10:31:13 [23141] Generating GetCertInitial pkiMessage.<o:p></o:p> 2016-08-22 10:31:13 [23141] Setting transaction ID "46763632748922674693649122043315271915873922247404248201497767686509312971065".<o:p></o:p> 2016-08-22 10:31:13 [23141] Setting message type "20".<o:p></o:p> 2016-08-22 10:31:13 [23141] Setting sender nonce.<o:p></o:p> 2016-08-22 10:31:13 [23141] Signed data.<o:p></o:p> 2016-08-22 10:31:13 [23141] Signing using old key.<o:p></o:p> 2016-08-22 10:31:13 [23141] Re-signing PKCSREQ message with old key.<o:p></o:p> 2016-08-22 10:31:13 [23141] Re-signing GetCertInitial message with old key.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'HAVE_SCEP_DATA'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') now.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'NEED_TO_SUBMIT'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') now.<o:p></o:p> 2016-08-22 10:31:13 [22931] Request7('husky201') moved to state 'SUBMITTING'<o:p></o:p> 2016-08-22 10:31:13 [22931] Will revisit Request7('husky201') on traffic from 15.<o:p></o:p> 2016-08-22 10:31:15 [22931] Certificate submission attempt complete.<o:p></o:p> 2016-08-22 10:31:15 [22931] Child status = 3.<o:p></o:p> 2016-08-22 10:31:15 [22931] Child output:<o:p></o:p> "Error: failed to verify signature on server response.<o:p></o:p> "<o:p></o:p> 2016-08-22 10:31:15 [22931] Error: failed to verify signature on server response.<o:p></o:p> 2016-08-22 10:31:15 [22931] Certificate not (yet?) issued.<o:p></o:p> 2016-08-22 10:31:15 [22931] Request7('husky201') moved to state 'CA_UNREACHABLE'<o:p></o:p> 2016-08-22 10:31:15 [22931] Will revisit Request7('husky201') in 604800 seconds.<o:p></o:p> <o:p> </o:p> <div style="mso-element:para-border-div;border-top:solid windowtext 1.0pt;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:none;padding:1.0pt 0cm 1.0pt 0cm"> I recorded the client server communication and can clearly see that the server transmitted the certificate.<o:p></o:p> <o:p> </o:p> When using jSCEP client I can successfully download certificates from that server with e.g.<o:p></o:p> <o:p> </o:p> $ openssl req -key test.key -new -days 30 -out test.pemreq -outform PEM # end entity set to mx_pre2<o:p></o:p> <o:p> </o:p> $ java -jar target/jscepcli-1.0-SNAPSHOT-exe.jar --ca-identifier mx_kd3 --challenge abcd --csr-file test.pemreq --dn "CN=mx_pre2" --key-file test.key \<o:p></o:p> --url <a href="http://ejbca-"> http://ejbca-</a>test2.primekey.se:8080/ejbca/publicweb/apply/scep/mxratest/pkiclient.exe<o:p></o:p> <o:p> </o:p> <o:p> </o:p> </div> <o:p> </o:p> With certmonger I can successfully get a cert using another CA with an internal EJBCA server and this request:<o:p></o:p> <o:p> </o:p> “getcert request -c Test_Sweden -v -d /tmp/nssdb -g 2048 -I husky100 -p /tmp/pwd.txt -n husky100 -L abcd -N CN='husky100' –s”<o:p></o:p> <o:p> </o:p> <o:p> </o:p> id=KBCA<o:p></o:p> ca_aka=SCEP (certmonger 0.78.6)<o:p></o:p> ca_is_default=0<o:p></o:p> ca_type=EXTERNAL<o:p></o:p> ca_external_helper=/usr/libexec/certmonger/scep-submit -u http://mucs70202.corp.knorr-bremse.com:8080/ejbca/publicweb/apply/scep/pkiclient.exe -i "iCOM%20Kunde1%20Dev%20SubCA"<o:p></o:p> ca_capabilities=POSTPKIOperation,Renewal,SHA-1<o:p></o:p> scep_ca_identifier=KBCA<o:p></o:p> ca_encryption_cert=-----BEGIN CERTIFICATE-----<o:p></o:p> <bla><o:p></o:p> -----END CERTIFICATE-----<o:p></o:p> ca_encryption_issuer_cert=-----BEGIN CERTIFICATE-----<o:p></o:p> <bla><o:p></o:p> -----END CERTIFICATE-----<o:p></o:p> ca_encryption_cert_pool=-----BEGIN CERTIFICATE-----<o:p></o:p> <bla><o:p></o:p> -----END CERTIFICATE-----<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> 2016-08-22 10:05:24 [21621] User ID 0 PID 22278 called /org/fedorahosted/certmonger:org.fedorahosted.certmonger.add_request.<o:p></o:p> 2016-08-22 10:05:24 [22280] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:24 [22280] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:24 [22280] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:05:24 [22280] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:24 [22280] Error locating a key.<o:p></o:p> 2016-08-22 10:05:24 [22281] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:24 [22281] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:24 [22281] Found token 'NSS Generic Crypto Services'.<o:p></o:p> 2016-08-22 10:05:24 [22281] Cert storage slot still needs user PIN to be set.<o:p></o:p> 2016-08-22 10:05:24 [22281] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:24 [22281] Error locating certificate.<o:p></o:p> 2016-08-22 10:05:24 [21621] Request2('husky100') starts in state 'NEWLY_ADDED'<o:p></o:p> 2016-08-22 10:05:24 [21621] Request2('husky100') taking writing lock<o:p></o:p> 2016-08-22 10:05:24 [21621] Request2('husky100') moved to state 'NEWLY_ADDED_START_READING_KEYINFO'<o:p></o:p> 2016-08-22 10:05:24 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:24 [21621] Started Request2('husky100').<o:p></o:p> 2016-08-22 10:05:24 [21621] Queuing FD 8 for Read for 0x7fdf7bf25630:0x7fdf7bf33720.<o:p></o:p> 2016-08-22 10:05:24 [21621] Request2('husky100') moved to state 'NEWLY_ADDED_READING_KEYINFO'<o:p></o:p> 2016-08-22 10:05:24 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:24 [21621] Dequeuing FD 8 for Read for 0x7fdf7bf25630:0x7fdf7bf33720.<o:p></o:p> 2016-08-22 10:05:24 [21621] Handling D-Bus traffic (Read) on FD 8 for 0x7fdf7bf25630.<o:p></o:p> 2016-08-22 10:05:24 [21621] message 0x7fdf7bf25630(method_call)->org.fedorahosted.certmonger:/org/fedorahosted/certmonger/requests/Request2:org.fedorahosted.certmonger.request.get_nickname<o:p></o:p> 2016-08-22 10:05:24 [21621] Pending GetConnectionUnixUser serial 1227<o:p></o:p> 2016-08-22 10:05:24 [21621] Pending GetConnectionUnixProcessID serial 1228<o:p></o:p> 2016-08-22 10:05:24 [21621] Queuing FD 8 for Read for 0x7fdf7bf25630:0x7fdf7bf2bc00.<o:p></o:p> 2016-08-22 10:05:24 [21621] Dequeuing FD 8 for Read for 0x7fdf7bf25630:0x7fdf7bf2bc00.<o:p></o:p> 2016-08-22 10:05:24 [21621] Handling D-Bus traffic (Read) on FD 8 for 0x7fdf7bf25630.<o:p></o:p> 2016-08-22 10:05:24 [21621] message 0x7fdf7bf25630(method_return)->1227->819<o:p></o:p> 2016-08-22 10:05:24 [21621] message 0x7fdf7bf25630(method_return)->1228->820<o:p></o:p> 2016-08-22 10:05:24 [21621] User ID 0 PID 22278 called /org/fedorahosted/certmonger/requests/Request2:org.fedorahosted.certmonger.request.get_nickname.<o:p></o:p> 2016-08-22 10:05:24 [21621] Queuing FD 8 for Read for 0x7fdf7bf25630:0x7fdf7bf33720.<o:p></o:p> 2016-08-22 10:05:24 [22282] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:24 [22282] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:24 [22282] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:05:24 [22282] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:24 [22282] Error locating a key.<o:p></o:p> 2016-08-22 10:05:24 [21621] Request2('husky100') moved to state 'NEWLY_ADDED_START_READING_CERT'<o:p></o:p> 2016-08-22 10:05:24 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:24 [21621] Request2('husky100') moved to state 'NEWLY_ADDED_READING_CERT'<o:p></o:p> 2016-08-22 10:05:24 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:25 [22283] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:25 [22283] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:25 [22283] Found token 'NSS Generic Crypto Services'.<o:p></o:p> 2016-08-22 10:05:25 [22283] Cert storage slot still needs user PIN to be set.<o:p></o:p> 2016-08-22 10:05:25 [22283] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:25 [22283] Error locating certificate.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'NEWLY_ADDED_DECIDING'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') releasing writing lock<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') has no key or certificate, will generate keys and attempt enrollment<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'NEED_KEY_PAIR'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') taking writing lock<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'GENERATING_KEY_PAIR'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:25 [22284] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:25 [22284] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:25 [22284] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:25 [22284] Generating key pair.<o:p></o:p> 2016-08-22 10:05:25 [22284] Nickname "husky100" appears to be unused.<o:p></o:p> 2016-08-22 10:05:25 [22284] Set nickname "husky100" on private key.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') releasing writing lock<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'HAVE_KEY_PAIR'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'NEED_KEYINFO'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'READING_KEYINFO'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:25 [22285] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:25 [22285] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:25 [22285] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:05:25 [22285] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:25 [22285] Located the key 'husky100'.<o:p></o:p> 2016-08-22 10:05:25 [22285] Converted private key 'husky100' to public key.<o:p></o:p> 2016-08-22 10:05:25 [22285] Key is an RSA key.<o:p></o:p> 2016-08-22 10:05:25 [22285] Key size is 2048.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'HAVE_KEYINFO'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'NEED_CSR'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'GENERATING_CSR'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:25 [22286] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:25 [22286] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:25 [22286] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:05:25 [22286] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:25 [22286] Located the key 'husky100'.<o:p></o:p> 2016-08-22 10:05:25 [22286] Converted private key 'husky100' to public key.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'HAVE_CSR'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'NEED_TO_SUBMIT'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'SUBMITTING'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') on traffic from 15.<o:p></o:p> 2016-08-22 10:05:25 [21621] Certificate submission attempt complete.<o:p></o:p> 2016-08-22 10:05:25 [21621] Child status = 16.<o:p></o:p> 2016-08-22 10:05:25 [21621] Child output:<o:p></o:p> "Error reading request, expected PKCS7 data.<o:p></o:p> "<o:p></o:p> 2016-08-22 10:05:25 [21621] Error reading request, expected PKCS7 data.<o:p></o:p> 2016-08-22 10:05:25 [21621] Certificate not (yet?) issued.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') goes to a CA over SCEP, need to generate SCEP data.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'NEED_SCEP_DATA'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'GENERATING_SCEP_DATA'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:25 [22288] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:25 [22288] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:25 [22288] Generating dummy key.<o:p></o:p> 2016-08-22 10:05:25 [22288] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:25 [22288] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:25 [22288] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:05:25 [22288] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:25 [22288] Located the key 'husky100'.<o:p></o:p> 2016-08-22 10:05:25 [22288] Converted private key 'husky100' to public key.<o:p></o:p> 2016-08-22 10:05:25 [22288] Server does not support DES3, using DES.<o:p></o:p> 2016-08-22 10:05:25 [22288] Server does not support better digests, using MD5.<o:p></o:p> 2016-08-22 10:05:25 [22288] Generating PKCSREQ pkiMessage.<o:p></o:p> 2016-08-22 10:05:25 [22288] Setting transaction ID "89399340103492129363376569585892061602695437784280139265051808388486717974760".<o:p></o:p> 2016-08-22 10:05:25 [22288] Setting message type "19".<o:p></o:p> 2016-08-22 10:05:25 [22288] Setting sender nonce.<o:p></o:p> 2016-08-22 10:05:25 [22288] Signed data.<o:p></o:p> 2016-08-22 10:05:25 [22288] Generating GetCertInitial pkiMessage.<o:p></o:p> 2016-08-22 10:05:25 [22288] Setting transaction ID "89399340103492129363376569585892061602695437784280139265051808388486717974760".<o:p></o:p> 2016-08-22 10:05:25 [22288] Setting message type "20".<o:p></o:p> 2016-08-22 10:05:25 [22288] Setting sender nonce.<o:p></o:p> 2016-08-22 10:05:25 [22288] Signed data.<o:p></o:p> 2016-08-22 10:05:25 [22288] Signing using old key.<o:p></o:p> 2016-08-22 10:05:25 [22288] Re-signing PKCSREQ message with old key.<o:p></o:p> 2016-08-22 10:05:25 [22288] Re-signing GetCertInitial message with old key.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'HAVE_SCEP_DATA'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'NEED_TO_SUBMIT'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:25 [21621] Request2('husky100') moved to state 'SUBMITTING'<o:p></o:p> 2016-08-22 10:05:25 [21621] Will revisit Request2('husky100') on traffic from 15.<o:p></o:p> 2016-08-22 10:05:26 [21621] Certificate submission attempt complete.<o:p></o:p> 2016-08-22 10:05:26 [21621] Child status = 0.<o:p></o:p> 2016-08-22 10:05:26 [21621] Child output:<o:p></o:p> "-----BEGIN PKCS7-----<o:p></o:p> MIAGCSqGSIb3DQEHA6CAMIACAQAxggFUMIIBUAIBADA4MBMxETAPBgNVBAMTCGh1<o:p></o:p> c2t5MTAwAiEAxaY7vcruKj5BOCTGw5wQBTpMC0GpLQ5rQJvfM6bjKOgwDQYJKoZI<o:p></o:p> hvcNAQEBBQAEggEAF8VwCqiExnQyPQvdPV8vYFIvV0OGJ5AuyurIQQ0y3zeb6Jjc<o:p></o:p> h4j6LilwV0BnUjdH9G2t4gGWUbbUVxciaXy0lgcZnO7C39ptc8tPfcfnD5gwRXdj<o:p></o:p> jLjWTRa6IBhBvgZS6/tQ1uiWXygSnTVl9renZSBixKrnUSaRO5vHl4IsMWp4J8/p<o:p></o:p> 39DY2zncvP/oq4bMKe5priZEjgbZkgFI9IuleQM80pzTHayWlChx2M5Cg5pDrBLc<o:p></o:p> k0lZeVLQ6Vg5V3yRGSsXNrxkexYZkRFGQkZ/6gsLmj1nPPVGjhjbtoEGtQZGpXaW<o:p></o:p> xD+nWyv2TUDge1OzIYj326scX3z3+YXcw2J23zCABgkqhkiG9w0BBwEwEQYFKw4D<o:p></o:p> AgcECJgYnlIa2DxtoIAEggNgaTC2AhLM52T8guE2jr4YTK1UlcwDpN8yRJNRyuK7<o:p></o:p> vtDjx5aPx3+qTRJAOdeulV3pYK+3dpmddJoePGFpW/MaKBgAOpZVi/gk6LxnfKG4<o:p></o:p> l+gwPR7y3EyXXCyank553tceF08lPoPMfkRCe01le5EW2PKKH9y7JeqvVkxIjhI8<o:p></o:p> vaYKmARCLAtC4fXexjnjMxFKISctLTIJqqDfCn6T7h2j61jIAB4wABmTKjh1fwp5<o:p></o:p> +bR+enbCG33KY9taeDHvgAYl0XOi8IQ370dI57I72383RCcQdAa9qdMSnhquMyZL<o:p></o:p> GS1zBnWrW9wMbMWkIRjR+1nGguS+6qBP4IekOuifoi/LHkSz/uOUuEi0cintRRy6<o:p></o:p> TsQEimydfIRfGrpcpaPCksHYUp/QZOSsQz9xAb/u6xMJMYRxKEw8q80xSniZP+dr<o:p></o:p> HwfRThoJuxZcr3bpnRuEt2fYd1MgASeNTuZyLV4UJgdAZKAid74S0oi20OTSJyJE<o:p></o:p> +GScqV/loZ4kJByE7fk3ZzCEWjOBhbzFzkoJ0vCxnRsq2eiyiTmTQvl4CM24q84f<o:p></o:p> SNvUT3UE2NryGV8DSVuyUb0HX97x8Ii0l+pcciylWWy0W5qBhVlo5ns8aDfP4xqg<o:p></o:p> blXv13hVIZPRs2KYFinK1ptOf2dBdYI8AFRx4eq85HGTd4J9yy5qIPjMfTVCNJz1<o:p></o:p> GLHFCIAQrClFehHvVrny0tO88B9/Xky9I6ReRPdz8kZ6GBCkTBS3I+4Km7uyo2Bd<o:p></o:p> XE5XlBJhaVboApZIwLNaf24eqH/L9pG6O+BhzKQEFqDYmpIzWslIsBqtMPFWD5E/<o:p></o:p> x/v8O2Pj0b+Tmkky+VYv8gdEkOy6LPX2J4YH86PljJDEoSqhmSeeVFuGCbaRa60L<o:p></o:p> NevoUzoQ3qCl/Brob7nDrOWeE1uJBWcDBs/CeFUvB0mfniIp0iDUOiTpWVm7drwv<o:p></o:p> EMObPE+5SijzwFnj5HIgSpmHZUjFR9JcRfuG6E3u7BrDl1wS6U5lfb7Oqro2T6PF<o:p></o:p> DB1+bL7NzCqF1nOYEDELOSrMxvk8/JQMxkBdrNx592FunoMEz8oAPbK5Lvt8oqE8<o:p></o:p> YcULZMb56Zp4S/L4P/8jV5KB9peXhxWhvU4qqXGeBBQSjggBxAURUZni5HaRrzv4<o:p></o:p> nUIyUuaf0fv3QY3tIi9hKaH8AAAAAAAAAAAAAA==<o:p></o:p> -----END PKCS7-----<o:p></o:p> "<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:26 [22292] Postprocessing output "-----BEGIN PKCS7-----<o:p></o:p> MIAGCSqGSIb3DQEHA6CAMIACAQAxggFUMIIBUAIBADA4MBMxETAPBgNVBAMTCGh1<o:p></o:p> c2t5MTAwAiEAxaY7vcruKj5BOCTGw5wQBTpMC0GpLQ5rQJvfM6bjKOgwDQYJKoZI<o:p></o:p> hvcNAQEBBQAEggEAF8VwCqiExnQyPQvdPV8vYFIvV0OGJ5AuyurIQQ0y3zeb6Jjc<o:p></o:p> h4j6LilwV0BnUjdH9G2t4gGWUbbUVxciaXy0lgcZnO7C39ptc8tPfcfnD5gwRXdj<o:p></o:p> jLjWTRa6IBhBvgZS6/tQ1uiWXygSnTVl9renZSBixKrnUSaRO5vHl4IsMWp4J8/p<o:p></o:p> 39DY2zncvP/oq4bMKe5priZEjgbZkgFI9IuleQM80pzTHayWlChx2M5Cg5pDrBLc<o:p></o:p> k0lZeVLQ6Vg5V3yRGSsXNrxkexYZkRFGQkZ/6gsLmj1nPPVGjhjbtoEGtQZGpXaW<o:p></o:p> xD+nWyv2TUDge1OzIYj326scX3z3+YXcw2J23zCABgkqhkiG9w0BBwEwEQYFKw4D<o:p></o:p> AgcECJgYnlIa2DxtoIAEggNgaTC2AhLM52T8guE2jr4YTK1UlcwDpN8yRJNRyuK7<o:p></o:p> vtDjx5aPx3+qTRJAOdeulV3pYK+3dpmddJoePGFpW/MaKBgAOpZVi/gk6LxnfKG4<o:p></o:p> l+gwPR7y3EyXXCyank553tceF08lPoPMfkRCe01le5EW2PKKH9y7JeqvVkxIjhI8<o:p></o:p> vaYKmARCLAtC4fXexjnjMxFKISctLTIJqqDfCn6T7h2j61jIAB4wABmTKjh1fwp5<o:p></o:p> +bR+enbCG33KY9taeDHvgAYl0XOi8IQ370dI57I72383RCcQdAa9qdMSnhquMyZL<o:p></o:p> GS1zBnWrW9wMbMWkIRjR+1nGguS+6qBP4IekOuifoi/LHkSz/uOUuEi0cintRRy6<o:p></o:p> TsQEimydfIRfGrpcpaPCksHYUp/QZOSsQz9xAb/u6xMJMYRxKEw8q80xSniZP+dr<o:p></o:p> HwfRThoJuxZcr3bpnRuEt2fYd1MgASeNTuZyLV4UJgdAZKAid74S0oi20OTSJyJE<o:p></o:p> +GScqV/loZ4kJByE7fk3ZzCEWjOBhbzFzkoJ0vCxnRsq2eiyiTmTQvl4CM24q84f<o:p></o:p> SNvUT3UE2NryGV8DSVuyUb0HX97x8Ii0l+pcciylWWy0W5qBhVlo5ns8aDfP4xqg<o:p></o:p> blXv13hVIZPRs2KYFinK1ptOf2dBdYI8AFRx4eq85HGTd4J9yy5qIPjMfTVCNJz1<o:p></o:p> GLHFCIAQrClFehHvVrny0tO88B9/Xky9I6ReRPdz8kZ6GBCkTBS3I+4Km7uyo2Bd<o:p></o:p> XE5XlBJhaVboApZIwLNaf24eqH/L9pG6O+BhzKQEFqDYmpIzWslIsBqtMPFWD5E/<o:p></o:p> x/v8O2Pj0b+Tmkky+VYv8gdEkOy6LPX2J4YH86PljJDEoSqhmSeeVFuGCbaRa60L<o:p></o:p> NevoUzoQ3qCl/Brob7nDrOWeE1uJBWcDBs/CeFUvB0mfniIp0iDUOiTpWVm7drwv<o:p></o:p> EMObPE+5SijzwFnj5HIgSpmHZUjFR9JcRfuG6E3u7BrDl1wS6U5lfb7Oqro2T6PF<o:p></o:p> DB1+bL7NzCqF1nOYEDELOSrMxvk8/JQMxkBdrNx592FunoMEz8oAPbK5Lvt8oqE8<o:p></o:p> YcULZMb56Zp4S/L4P/8jV5KB9peXhxWhvU4qqXGeBBQSjggBxAURUZni5HaRrzv4<o:p></o:p> nUIyUuaf0fv3QY3tIi9hKaH8AAAAAAAAAAAAAA==<o:p></o:p> -----END PKCS7-----<o:p></o:p> ".<o:p></o:p> 2016-08-22 10:05:26 [22292] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:26 [22292] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:26 [22292] Skipping NSS internal slot (NSS Generic Crypto Services).<o:p></o:p> 2016-08-22 10:05:26 [22292] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag<o:p></o:p> 2016-08-22 10:05:26 [22292] error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error<o:p></o:p> 2016-08-22 10:05:26 [22292] error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag<o:p></o:p> 2016-08-22 10:05:26 [22292] error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Error decrypting bulk key: SEC_ERROR_BAD_DATA.<o:p></o:p> 2016-08-22 10:05:26 [22292] Succeeded in decrypting enveloped data.<o:p></o:p> 2016-08-22 10:05:26 [22292] Succeeded in decrypting enveloped data.<o:p></o:p> 2016-08-22 10:05:26 [21621] Certificate submission postprocessing complete.<o:p></o:p> 2016-08-22 10:05:26 [21621] Child status = 0.<o:p></o:p> 2016-08-22 10:05:26 [21621] Child output:<o:p></o:p> "{"certificate":"-----BEGIN CERTIFICATE-----\nMIIDKjCCAhKgAwIBAgIIBVULrGtczBowDQYJKoZIhvcNAQEFBQAwIDEeMBwGA1UE\nAwwVaUNPTSBLdW5kZTEgRGV2IFN1YkNBMB4XDTE2MDgyMjA3NTUyNloXDTI2MDYw\nOTE0MjYxMVowEzERMA8GA1UEAwwIaHVza3kxMDAwggEiMA0GCSqGSIb3DQEBAQUA\nA4IBDwAwggEKAoIBAQCwj6TZXwh2TD1UJuEc/LhjgUF91BJ4OOpjt2uOyfTsGaFO\nDykz0tEWyXRk7mkHQeqC/isVD0CYz6bhks2HwwqMAIc37eaz/uEIPQu4rz59gUMl\nVkh93YOtX2JlsQ0y0QPuwIGgb3Z1NX8MbhlE0GpLrb2vY8Y0TpBjwGpbagaMRPgz\nyP2v62jau9xn+72VTjOxNImJH/8V1UTDl1gt0lR2XH5dMeo+weVW8ZUvgDykhQDj\nq4V/trRW+556owhPv2ALBpuubp99d2rfPSdWnLg7JCtpIEIGq9KcEIfV1Bq/d4zb\n3PVrb1xZIb2vCOYyijUr8OCpgMslTM1WiKdIw9GTAgMBAAGjdTBzMAwGA1UdEwEB\n/wQCMAAwHwYDVR0jBBgwFoAUp+pgIuSdJoXPRmZ6unXbKtfB2NowEwYDVR0lBAww\nCgYIKwYBBQUHAwIwHQYDVR0OBBYEFCKFlaNB18Tf7Njwy/8I1aDPge3DMA4GA1Ud\nDwEB/wQEAwIFoDANBgkqhkiG9w0BAQUFAAOCAQEAho5avfYElYPaUxr9diXxG4aA\nVijNIiGXa6FmOwmMmR2h2UUqn11doNbkR+Zv4FFjMqdlWQh4aMLhn6Z0+ahSx3NY\nHG0saJfV88loRb+zC03yOyPIjEmFo4d2Vc+CsXAQ49ElHVKjqqC3JaMrma/EfMQ2\nW6Sc8x55smgPXjPLf8VytHdjH/ZeCDFbBYqs8CS0JbjP2UppEjwWAv4r8QH8VWuz\n97kxRpXFVTXb/gJUCxNqJRCU1aFTfO1L6x9BzfVKJX73nyAuQmZ+090PJIFCTTx/\nexdeoX0EBPeGmV7XjAO5GqGq+P6i3oeJ/Z8Kvug0XzlUSc55SMbc+z2B07GVIA==\n-----END CERTIFICATE-----\n","key_checked":true}<o:p></o:p> "<o:p></o:p> 2016-08-22 10:05:26 [21621] Issued certificate is "-----BEGIN CERTIFICATE-----<o:p></o:p> MIIDKjCCAhKgAwIBAgIIBVULrGtczBowDQYJKoZIhvcNAQEFBQAwIDEeMBwGA1UE<o:p></o:p> AwwVaUNPTSBLdW5kZTEgRGV2IFN1YkNBMB4XDTE2MDgyMjA3NTUyNloXDTI2MDYw<o:p></o:p> OTE0MjYxMVowEzERMA8GA1UEAwwIaHVza3kxMDAwggEiMA0GCSqGSIb3DQEBAQUA<o:p></o:p> A4IBDwAwggEKAoIBAQCwj6TZXwh2TD1UJuEc/LhjgUF91BJ4OOpjt2uOyfTsGaFO<o:p></o:p> Dykz0tEWyXRk7mkHQeqC/isVD0CYz6bhks2HwwqMAIc37eaz/uEIPQu4rz59gUMl<o:p></o:p> Vkh93YOtX2JlsQ0y0QPuwIGgb3Z1NX8MbhlE0GpLrb2vY8Y0TpBjwGpbagaMRPgz<o:p></o:p> yP2v62jau9xn+72VTjOxNImJH/8V1UTDl1gt0lR2XH5dMeo+weVW8ZUvgDykhQDj<o:p></o:p> q4V/trRW+556owhPv2ALBpuubp99d2rfPSdWnLg7JCtpIEIGq9KcEIfV1Bq/d4zb<o:p></o:p> 3PVrb1xZIb2vCOYyijUr8OCpgMslTM1WiKdIw9GTAgMBAAGjdTBzMAwGA1UdEwEB<o:p></o:p> /wQCMAAwHwYDVR0jBBgwFoAUp+pgIuSdJoXPRmZ6unXbKtfB2NowEwYDVR0lBAww<o:p></o:p> CgYIKwYBBQUHAwIwHQYDVR0OBBYEFCKFlaNB18Tf7Njwy/8I1aDPge3DMA4GA1Ud<o:p></o:p> DwEB/wQEAwIFoDANBgkqhkiG9w0BAQUFAAOCAQEAho5avfYElYPaUxr9diXxG4aA<o:p></o:p> VijNIiGXa6FmOwmMmR2h2UUqn11doNbkR+Zv4FFjMqdlWQh4aMLhn6Z0+ahSx3NY<o:p></o:p> HG0saJfV88loRb+zC03yOyPIjEmFo4d2Vc+CsXAQ49ElHVKjqqC3JaMrma/EfMQ2<o:p></o:p> W6Sc8x55smgPXjPLf8VytHdjH/ZeCDFbBYqs8CS0JbjP2UppEjwWAv4r8QH8VWuz<o:p></o:p> 97kxRpXFVTXb/gJUCxNqJRCU1aFTfO1L6x9BzfVKJX73nyAuQmZ+090PJIFCTTx/<o:p></o:p> exdeoX0EBPeGmV7XjAO5GqGq+P6i3oeJ/Z8Kvug0XzlUSc55SMbc+z2B07GVIA==<o:p></o:p> -----END CERTIFICATE-----<o:p></o:p> ".<o:p></o:p> 2016-08-22 10:05:26 [21621] Certificate issued (0 chain certificates, 0 roots).<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'NEED_TO_SAVE_CERT'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') taking writing lock<o:p></o:p> 2016-08-22 10:05:26 [21621] No hooks set for pre-save command.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'START_SAVING_CERT'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'SAVING_CERT'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:26 [22293] No duplicate nickname entries.<o:p></o:p> 2016-08-22 10:05:26 [22293] No duplicate subject name entries.<o:p></o:p> 2016-08-22 10:05:26 [22293] Imported certificate "husky100", got nickname "husky100".<o:p></o:p> 2016-08-22 10:05:26 [22293] Removed name from old key.<o:p></o:p> 2016-08-22 10:05:26 [22293] Error shutting down NSS.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'SAVED_CERT'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'NEED_TO_SAVE_CA_CERTS'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'START_SAVING_CA_CERTS'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'SAVING_CA_CERTS'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'NEED_TO_READ_CERT'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'READING_CERT'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:26 [22295] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:26 [22295] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:26 [22295] Found token 'NSS Generic Crypto Services'.<o:p></o:p> 2016-08-22 10:05:26 [22295] Cert storage slot still needs user PIN to be set.<o:p></o:p> 2016-08-22 10:05:26 [22295] Found token 'NSS Certificate DB'.<o:p></o:p> 2016-08-22 10:05:26 [22295] Located the certificate "husky100".<o:p></o:p> 2016-08-22 10:05:26 [22295] Read value "0" from "/proc/sys/crypto/fips_enabled".<o:p></o:p> 2016-08-22 10:05:26 [22295] Not attempting to set NSS FIPS mode.<o:p></o:p> 2016-08-22 10:05:26 [21621] No hooks set for post-save command.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'NEED_TO_NOTIFY_ISSUED_SAVED'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') now.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') releasing writing lock<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'NOTIFYING_ISSUED_SAVED'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') on traffic from 11.<o:p></o:p> 2016-08-22 10:05:26 [22296] 0x1d Certificate named "husky100" in token "NSS Certificate DB" in database "/tmp/nssdb" issued by CA and saved.<o:p></o:p> 2016-08-22 10:05:26 [21621] Request2('husky100') moved to state 'MONITORING'<o:p></o:p> 2016-08-22 10:05:26 [21621] Will revisit Request2('husky100') soon.<o:p></o:p> <div style="mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm"> 2016-08-22 10:05:31 [21621] Will revisit Request2('husky100') in 86400 seconds.<o:p></o:p> </div> <o:p> </o:p> Besides this "Error reading request, expected PKCS7 data” which always shows up and “Error decrypting bulk key: SEC_ERROR_BAD_DATA” errors (?) finally the cert is issued and stored into the nSS DB.<o:p></o:p> <o:p> </o:p> Certificate:<o:p></o:p> Data:<o:p></o:p> Version: 3 (0x2)<o:p></o:p> Serial Number: 8344117917752670949 (0x73cc4309839ebae5)<o:p></o:p> Signature Algorithm: sha1WithRSAEncryption<o:p></o:p> Issuer: CN=mx_kd3<o:p></o:p> Validity<o:p></o:p> Not Before: Aug 19 16:03:29 2016 GMT<o:p></o:p> Not After : Aug 2 15:23:36 2017 GMT<o:p></o:p> Subject: CN=mx_pre2<o:p></o:p> Subject Public Key Info:<o:p></o:p> Public Key Algorithm: rsaEncryption<o:p></o:p> Public-Key: (2048 bit)<o:p></o:p> Modulus:<o:p></o:p> 00:89:01:fc:d4:a0:5c:df:8d:b6:f6:e3:49:8c:93:<o:p></o:p> 77:7a:1e:26:34:4e:37:90:c3:6c:b0:e0:5d:a7:47:<o:p></o:p> 8e:81:8f:d8:04:d5:c0:03:26:1a:a5:49:c8:82:98:<o:p></o:p> 40:25:34:2e:43:c5:7d:cc:10:0e:b0:13:26:25:c0:<o:p></o:p> 3d:87:15:fc:7f:90:6d:3d:2f:d6:ce:31:1f:af:38:<o:p></o:p> 3f:8c:e9:fc:01:4c:a6:c5:3f:82:cb:c0:f8:8c:e7:<o:p></o:p> 30:75:ba:68:b8:69:a6:6b:6c:04:a3:58:fb:b0:10:<o:p></o:p> 94:4b:a2:f6:bd:24:f7:75:97:c0:f2:4e:ee:d9:df:<o:p></o:p> 7b:61:8b:46:a9:d4:46:96:05:31:e5:60:87:3e:8d:<o:p></o:p> 9b:8e:b2:f6:0f:03:1f:b7:49:1d:83:ec:9f:66:b1:<o:p></o:p> f9:76:dd:dd:c5:b6:fa:52:5f:56:ce:2e:00:87:11:<o:p></o:p> 90:6d:ba:c3:d7:fd:19:e0:64:c1:5d:0b:62:59:ad:<o:p></o:p> 61:80:a7:76:d4:08:39:6b:2e:6f:05:68:c9:10:b4:<o:p></o:p> 9f:3e:b9:d0:63:9f:7d:e1:a7:74:4f:f8:f4:17:34:<o:p></o:p> f5:bf:ab:c6:bf:b9:48:80:59:ec:00:41:de:8b:46:<o:p></o:p> 30:9d:8c:2b:d4:f3:2e:bd:39:e6:da:cd:d9:32:04:<o:p></o:p> 55:04:29:26:66:0f:ac:ac:d2:bf:b1:19:56:62:0a:<o:p></o:p> 56:69<o:p></o:p> Exponent: 65537 (0x10001)<o:p></o:p> X509v3 extensions:<o:p></o:p> X509v3 Subject Key Identifier: <o:p></o:p> D7:06:53:64:27:62:69:3B:ED:79:B2:6A:D8:94:DD:EE:B6:9C:51:44<o:p></o:p> X509v3 Basic Constraints: critical<o:p></o:p> CA:FALSE<o:p></o:p> X509v3 Authority Key Identifier: <o:p></o:p> keyid:8C:DB:52:66:8F:60:01:FA:58:8D:82:06:01:25:9C:2C:7D:D0:A0:14<o:p></o:p> <o:p> </o:p> X509v3 Key Usage: critical<o:p></o:p> Digital Signature, Key Encipherment<o:p></o:p> X509v3 Extended Key Usage: <o:p></o:p> TLS Web Client Authentication<o:p></o:p> Signature Algorithm: sha1WithRSAEncryption<o:p></o:p> 45:a1:0c:9b:7b:20:31:0a:90:53:21:b8:d5:e2:05:0f:29:10:<o:p></o:p> 77:d6:3a:44:38:9d:4a:d0:19:30:99:b9:41:0e:b1:4b:0e:c2:<o:p></o:p> 35:36:ce:98:5f:0a:54:88:3b:91:d1:fb:df:e5:6f:57:f9:04:<o:p></o:p> 0d:51:bf:c5:50:c3:c6:4d:88:a0:73:31:99:63:85:69:81:66:<o:p></o:p> 93:5c:c3:bf:3f:ef:50:cc:db:de:fe:95:43:64:f0:2c:66:c1:<o:p></o:p> f0:64:6f:8d:75:53:54:48:28:92:05:e1:21:a2:d6:fe:e3:1e:<o:p></o:p> 5a:af:87:ba:45:06:39:47:5a:b8:df:1c:d8:cc:cf:6a:4a:ac:<o:p></o:p> 08:92:7c:5b:08:9b:d5:0b:6d:49:33:c3:8f:a3:2c:50:4e:50:<o:p></o:p> ae:d3:61:27:09:8c:de:c3:04:91:e0:f9:0e:aa:63:49:84:5e:<o:p></o:p> cc:03:78:14:6e:cc:c3:5e:46:3b:56:6c:ae:20:7b:ce:51:8a:<o:p></o:p> 78:eb:6b:4b:80:45:45:f3:3f:14:b6:d0:6a:99:d4:46:ad:d2:<o:p></o:p> 0f:4d:99:4d:31:34:1f:4f:a3:19:92:45:8f:89:29:7e:4e:e7:<o:p></o:p> 43:b2:15:4d:df:8a:66:70:c4:5d:b0:e3:d8:13:77:c2:51:98:<o:p></o:p> 67:7d:b4:3c:95:71:54:05:06:1f:69:ae:fc:b1:00:b4:88:84:<o:p></o:p> da:e0:85:ae<o:p></o:p> subject= /CN=mx_pre2<o:p></o:p> issuer= /CN=mx_kd3<o:p></o:p> -----BEGIN PUBLIC KEY-----<o:p></o:p> MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiQH81KBc34229uNJjJN3<o:p></o:p> eh4mNE43kMNssOBdp0eOgY/YBNXAAyYapUnIgphAJTQuQ8V9zBAOsBMmJcA9hxX8<o:p></o:p> f5BtPS/WzjEfrzg/jOn8AUymxT+Cy8D4jOcwdbpouGmma2wEo1j7sBCUS6L2vST3<o:p></o:p> dZfA8k7u2d97YYtGqdRGlgUx5WCHPo2bjrL2DwMft0kdg+yfZrH5dt3dxbb6Ul9W<o:p></o:p> zi4AhxGQbbrD1/0Z4GTBXQtiWa1hgKd21Ag5ay5vBWjJELSfPrnQY5994ad0T/j0<o:p></o:p> FzT1v6vGv7lIgFnsAEHei0YwnYwr1PMuvTnm2s3ZMgRVBCkmZg+srNK/sRlWYgpW<o:p></o:p> aQIDAQAB<o:p></o:p> -----END PUBLIC KEY-----<o:p></o:p> <div style="mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm"> SHA1 Fingerprint=C3:B6:32:E9:70:E8:0F:98:A5:77:8E:96:13:5B:F8:40:63:37:29:7E<o:p></o:p> </div> <o:p> </o:p> So the question is why certmonger fails to verify signature on server response depending on which server I try.<o:p></o:p> <o:p> </o:p> What is included in the checks ? hostname of clients/servers? <o:p></o:p> <o:p> </o:p> How can I debug this ? I’m not an experienced C programmer and was just able to apply that GetCACertchain fix in scep.c and build certmonger with that. <o:p></o:p> <o:p> </o:p> Peter<o:p></o:p> </div> <table border=0 cellpadding=5 style="FONT-FAMILY: Arial; FONT-SIZE:1em;"> <tbody> <tr> <td align="center"><IMG alt="automechanika" src="http://www.knorr-bremse.de/disclaimer/automechanika.png" height=20 width=184> </td> <td align="center"><IMG alt="InnoTrans" src="http://www.knorr-bremse.de/disclaimer/innotrans.png" height=95 width=95> </td> <td align="center"><IMG alt="IAA" src="http://www.knorr-bremse.de/disclaimer/iaa.png" height=35 width=149> </td> </tr> <tr> <td align="center"> automechanika 13.09.-17.09.2016 Messe Frankfurt Hall 3.0 Stand G98 + E91</td> <td align="center"> InnoTrans 20.09.-23.09.2016 Messe Berlin Hall 1.2b Stand 104 + 210</td> <td align="center"> IAA 22.09.-29.09.2016 Messe Hannover Hall 17 Stand A30 + D131</td> </tr> </tbody> </table> Knorr-Bremse IT-Services GmbH Sitz: München Geschäftsführer: Helmut Draxler (Vorsitzender), Harald Jessen, Harald Schneider Registergericht München, HR B 167 268 This transmission is intended solely for the addressee and contains confidential information. If you are not the intended recipient, please immediately inform the sender and delete the message and any attachments from your system. Furthermore, please do not copy the message or disclose the contents to anyone unless agreed otherwise. To the extent permitted by law we shall in no way be liable for any damages, whatever their nature, arising out of transmission failures, viruses, external influence, delays and the like. </body> </html>