<div>Hi Alee</div><div><br></div><div>I take some time to debug the perl cgi.</div><div>I found the error caused by decode method</div><div><br></div><div>after I change it, it works.</div><div><br></div><div>/sscep enroll -f sscep.conf -E 3des -S sha1</div><div>....</div><div><div>CN's of request and certificate matched!</div><div>./sscep: writing cert</div><div>-----BEGIN CERTIFICATE-----</div><div>MIIC8DCCAdigAwIBAgIBCjANBgkqhkiG9w0BAQsFADBHMSQwIgYDVQQKExtsb2Nh</div><div>bGRvbWFpbiBTZWN1cml0eSBEb21haW4xHzAdBgNVBAMTFkNBIFNpZ25pbmcgQ2Vy</div><div>dGlmaWNhdGUwHhcNMTMwNTAyMTEwOTAwWhcNMTUwNDIyMTEwOTAwWjAXMRUwEwYD</div><div>VQQDEwwxMC42NC43OS4yMzQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOAV</div><div>TYAh2vWcLWys4AMGEs9qbUeg/IkG9R944fHnaR9+uwqA+cZVNwmOl/Qwvk3GINiS</div><div>JQKlhR1wxf4AHeCACtfN7fk+ckjOngx+PN4GLGwZyTAPSWEFCK7vzGqrFWyqAibL</div><div>eeKzhhXiWkoHqQYkOoboAKY2OEvHuwKDod5xT3q/AgMBAAGjgZowgZcwHwYDVR0j</div><div>BBgwFoAUs0FtabRcZ2tq6VfsBCXKQKzoWsAwRQYIKwYBBQUHAQEEOTA3MDUGCCsG</div><div>AQUFBzABhilodHRwOi8vbG9jYWxob3N0LmxvY2FsZG9tYWluOjgwODAvY2Evb2Nz</div><div>cDAOBgNVHQ8BAf8EBAMCBeAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME</div><div>MA0GCSqGSIb3DQEBCwUAA4IBAQBzRKjf0ebDVjhIOuYFhbE/Htful4oLtCcQI2sZ</div><div>xjr9uWUITEVZNCWONUJ2pZKT+9KefE8zCjRd8tliyKjUZOO4VYpO+TDfe4KsQMSe</div><div>2Lrd35g35iUXOhqi2IVXLjQT6mdEWuYKwIGRl98pyoLMz9MZKbLdnrGkhYZHxA9n</div><div>EMds+7VmYdw3orZDaD4UmMqZL6FfNazjTKK1VlOWDL75QeVGGv9lNXbWqB+EUAZp</div><div>U0mc/dip2R3wZRwygHE7cKs/lvheI9GkoQYLSLWzKcS2M2JiSOiwrEfi+zMWF71O</div><div>DRbD6S2b8tl8k/f9WCwgLgKisw3TKRyJV+FLb5LdapE7lMQi</div><div>-----END CERTIFICATE-----</div><div>./sscep: certificate written as ./local.crt</div></div><div><br></div><div>sorry , I didn't change the default value according to (http://pki.fedoraproject.org/wiki/SCEP_in_Dogtag#SSCEP_Configuration)</div><div>Because first time I use firefox's keymanager.</div><div><br></div><div>Thanks very much!</div><div><br></div><div>sbaa</div><div><br></div><div><br></div><div><br></div><div><br></div><div><div><br></div><div><br></div><div style="font-size: 12px;font-family: Arial Narrow;padding:2px 0 2px 0;">------------------ 原始邮件 ------------------</div><div style="font-size: 12px;background:#efefef;padding:8px;"><div><b>发件人:</b> "骷髅猫"<sbaa@vip.qq.com>;</div><div><b>发送时间:</b> 2013年5月2日(星期四) 下午5:24</div><div><b>收件人:</b> "alee"<alee@redhat.com>; <wbr></div><div><b>抄送:</b> "Pki-users"<Pki-users@redhat.com>; <wbr></div><div><b>主题:</b> 回复：回复：回复： [Pki-users] "SecurityDomain HTTPSAdmin URL not found "</div></div><div><br></div><div>Hi Alee</div><div><br></div><div>some update</div><div><br></div><div>I try another scep client sscep (<a href="https://github.com/certnanny/sscep" style="font-family: Calibri, sans-serif; font-size: 11pt; ">https://github.com/certnanny/sscep</a>)</div><div><br></div><div>got the same result:</div><div><br></div><div><div>./sscep: server returned status code 500</div><div>./sscep: mime_err: HTTP/1.1 500 Internal Server Error</div><div>Date: Thu, 02 May 2013 09:13:20 GMT</div><div>Server: Apache</div><div>Content-Length: 333</div><div>Connection: close</div><div>Content-Type: text/html; charset=iso-8859-1</div><div><br></div><div><h1>Software error:</h1></div><div><pre>Could not find pkiclient.xml in /var/lib/pki-ra/docroot/ee/scep/ at /var/lib/pki-ra/docroot/ee/scep/pkiclient.cgi line 81.</div><div></pre></div><div><p></div><div>For help, please send mail to the webmaster (<a href="mailto:you@example.com">you@example.com</a>), giving this error message </div><div>and the time and date of the error.</div><div><br></div><div></p></div><div><br></div><div>./sscep: wrong (or missing) MIME content type</div><div>./sscep: error while sending message</div></div><div><div><br></div><div>I am not sure what version is stable and recommended.</div><div><br></div><div>Thanks</div><div>Sbaa</div><div><br></div><div style="font-size: 12px;font-family: Arial Narrow;padding:2px 0 2px 0;">------------------ 原始邮件 ------------------</div><div style="font-size: 12px;background:#efefef;padding:8px;"><div><b>发件人:</b> "骷髅猫"<sbaa@vip.qq.com>;</div><div><b>发送时间:</b> 2013年4月30日(星期二) 下午2:33</div><div><b>收件人:</b> "alee"<alee@redhat.com>; <wbr></div><div><b>抄送:</b> "Pki-users"<Pki-users@redhat.com>; <wbr></div><div><b>主题:</b> 回复：回复：回复： [Pki-users] "SecurityDomain HTTPSAdmin URL not found "</div></div><div><br></div><div>Hi Alee</div><div><br></div><div>I used firefox's keymanager plugin to do some simple test. Just connect to RA server and click next and next ,then encontered this error. </div><div>But I did't go through any source about pkiclient.cgi ,so I 'm not sure where introduce the file pkiclient.xml.</div><div><br></div><div>another question,</div><div>If the client request can choose some file which used by server cgi internally, is there any security risk?</div><div><div><br></div><div>Best Regards</div><div>sbaa</div><div><br></div><div style="font-size: 12px;font-family: Arial Narrow;padding:2px 0 2px 0;">------------------ 原始邮件 ------------------</div><div style="font-size: 12px;background:#efefef;padding:8px;"><div><b>发件人:</b> "alee"<alee@redhat.com>;</div><div><b>发送时间:</b> 2013年4月30日(星期二) 中午1:06</div><div><b>收件人:</b> "骷髅猫"<sbaa@vip.qq.com>; <wbr></div><div><b>抄送:</b> "Pki-users"<Pki-users@redhat.com>; <wbr></div><div><b>主题:</b> Re: 回复：回复： [Pki-users] "SecurityDomain HTTPSAdmin URL not found "</div></div><div><br></div>I don't see anything in the code about pkiclient.xml.<br><br>Can you detail exactly what you did to test SCEP?<br>Thanks, <br>Ade<br><br>On Sun, 2013-04-28 at 15:13 +0800, 骷髅猫 wrote:<br>> Hi Alee<br>> <br>> <br>> Thank you, I finished the configuration for RA server by disable<br>> SElinux<br>> But when I test the SCEP feature, I got such error:<br>> In error log:<br>> [Sun Apr 28 03:05:56.891164 2013] [:error] [pid 1822:tid<br>> 140696560207616] [Sun Apr 28 03:05:56 2013] -e: Could not find<br>> pkiclient.xml in /var/lib/pki-ra/docroot/ee/scep/<br>> at /var/lib/pki-ra/docroot/ee/scep/pkiclient.cgi line 81.\n<br>> <br>> <br>> on firefox:<br>> Software error:<br>> Could not find pkiclient.xml in /var/lib/pki-ra/docroot/ee/scep/ at /var/lib/pki-ra/docroot/ee/scep/pkiclient.cgi line 81.<br>> <br>> For help, please send mail to the webmaster (you@example.com), giving<br>> this error message and the time and date of the error. <br>> <br>> <br>> <br>> <br>> Thanks<br>> sbaa<br>> ------------------ 原始邮件 ------------------<br>> 发件人: "alee"<alee@redhat.com>;<br>> 发送时间: 2013年4月28日(星期天) 下午2:00<br>> 收件人: "骷髅猫"<sbaa@vip.qq.com>; <br>> 抄送: "Pki-users"<Pki-users@redhat.com>; <br>> 主题: Re: 回复： [Pki-users] "SecurityDomain HTTPS Admin URL not found<br>> "<br>> <br>> <br>> I ran into the same problem:<br>> <br>> The one you want is https://localhost.domain:8443<br>> <br>> I resolved this by setting selinux in permissive mode. I will file a<br>> bug against selinux policy on Monday.<br>> <br>> Ade<br>> <br>> On Sun, 2013-04-28 at 02:27 +0800, 骷髅猫 wrote:<br>> > Hi alee<br>> > <br>> > <br>> > I tried following urls<br>> > <br>> > <br>> > https://localhost.localdomain:8443<br>> > https://localhost.localdomain:8443/ca<br>> > http://localhost.localdomain:8080<br>> > http://localhost.localdomain:8080/ca<br>> > <br>> > <br>> > but all failed.<br>> > <br>> > <br>> > and i found some info in error log (/var/log/pki-ra/error_log )<br>> > GET /ca/admin/ca/getStatus HTTP/1.0<br>> > <br>> > <br>> > port: 8443<br>> > addr='localhost.localdomain'<br>> > family='2'<br>> > IP='127.0.0.1'<br>> > exit after PR_Connect with error -5985:<br>> > GET /ca/admin/ca/getStatus HTTP/1.0<br>> > <br>> > <br>> > port: 9445<br>> > addr='localhost.localdomain'<br>> > family='2'<br>> > IP='127.0.0.1'<br>> > exit after PR_Connect with error -5961:<br>> > <br>> > <br>> > ------------------ 原始邮件 ------------------<br>> > 发件人: "Ade Lee"<alee@redhat.com>;<br>> > 发送时间: 2013年4月28日(星期天) 凌晨1:04<br>> > 收件人: "骷髅猫"<sbaa@vip.qq.com>; <br>> > 抄送: "Pki-users"<Pki-users@redhat.com>; <br>> > 主题: Re: [Pki-users] "Security Domain HTTPS Admin URL not found "<br>> > <br>> > <br>> > What value are you putting in for your security domain?<br>> > <br>> > Ade<br>> > On Sat, 2013-04-27 at 23:39 +0800, 骷髅猫 wrote:<br>> > > Hi All<br>> > > I'am a new user of dogtag.<br>> > > I try the latest build 10.0.2.<br>> > > I install ca server success,but when I configure a ra subsystem, <br>> > > <br>> > > <br>> > > url :<br>> > > https://localhost.localdomain:12890/ra/admin/console/config/wizard<br>> > > <br>> > > <br>> > > it alwarys show error "Security Domain HTTPS Admin URL not found"<br>> > and<br>> > > " Create a New Security Domai" cannot be choose.<br>> > > any ideas?<br>> > > <br>> > > <br>> > > thanks<br>> > > <br>> > > <br>> > > _______________________________________________<br>> > > Pki-users mailing list<br>> > > Pki-users@redhat.com<br>> > > https://www.redhat.com/mailman/listinfo/pki-users<br>> > <br>> > <br>> > .<br>> > <br>> <br>> <br>> .<br>> <br><br><br>.<br></div></div></div>