<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style></style></head><body bgcolor=white lang=EN-GB link=blue vlink=purple><div class=WordSection1>Hi Andrew,<o:p></o:p><o:p> </o:p>Thanks for that, it’s been a while before I’ve been able to try the steps in <a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/renewing-subsystem-certificates.html#renewing-certificates-using-certutil">https://access.redhat.com/site/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/renewing-subsystem-certificates.html#renewing-certificates-using-certutil</a><o:p></o:p><o:p> </o:p>Below are the results of those steps.<o:p></o:p><o:p> </o:p>Step 3 resulted in:<o:p></o:p><o:p> </o:p>#certutil -K -d .<o:p></o:p>certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"<o:p></o:p>Enter Password or Pin for "NSS Certificate DB":<o:p></o:p>< 0> rsa 422b5af15b44ea69130671f9eea3c047c0ad0080 (orphan)<o:p></o:p>< 1> rsa 7ee73faba7c4f1a027f5b309d9175089a8a6f084 Server-Cert cert-pki-ca<o:p></o:p>< 2> rsa 7bfe57e8f1adbe5d00f945be6cb167ce905dac3f ocspSigningCert cert-pki-ca<o:p></o:p>< 3> rsa 78b0a760918b4a9ec312cc75408a23e551dbd615 caSigningCert cert-pki-ca<o:p></o:p>< 4> rsa 99c4c03f6dd0bd4c90933b62c4b023d942f79d9e subsystemCert cert-pki-ca<o:p></o:p>< 5> rsa 9b839620f5d6802fb4c938fe6f06bcc9a1de8a85 auditSigningCert cert-pki-ca<o:p></o:p><o:p> </o:p><pre style='margin-bottom:12.0pt;mso-line-height-alt:10.35pt;background:whitesmoke;vertical-align:baseline'><o:p> </o:p></pre>Step 4 resulted in:<o:p></o:p>#cp -r /var/lib/pki-ca/alias /tmp/alias/<o:p></o:p>#cd /tmp/alias/<o:p></o:p>#certutil -D -n "Server-Cert cert-pki-ca" -d .<o:p></o:p>#certutil -D -n "ocspSigningCert cert-pki-ca" -d .<o:p></o:p>#certutil -D -n "caSigningCert cert-pki-ca" -d .<o:p></o:p>#certutil -D -n "subsystemCert cert-pki-ca" -d .<o:p></o:p>#certutil -D -n "auditSigningCert cert-pki-ca" -d .<o:p></o:p><o:p> </o:p><o:p> </o:p>Step 5 resulted in:<o:p></o:p>#certutil -d . -R -k "NSS Certificate DB:cert-pki-ca" -s "<snip>" -a -o <snip>.req2.txt<o:p></o:p>certutil: NSS Certificate DB:cert-pki-ca is neither a key-type nor a nickname: security library: bad database.<o:p></o:p>#certutil -d . -R -k "NSS Certificate DB:cert-pki-ca" -s "CN=OCSP Signing Certificate,<snip>" -a -o OCSP.req2.txt<o:p></o:p>certutil: NSS Certificate DB:cert-pki-ca is neither a key-type nor a nickname: security library: bad database.<o:p></o:p>#certutil -d . -R -k "NSS Certificate DB:cert-pki-ca" -s "CN=<snip>" -a -o <snip>.req2.txt<o:p></o:p>certutil: NSS Certificate DB:cert-pki-ca is neither a key-type nor a nickname: security library: bad database.<o:p></o:p>#certutil -d . -R -k "NSS Certificate DB:cert-pki-ca" -s "CN=CA Subsystem Certificate,<snip>" -a -o CASub.req2.txt<o:p></o:p>certutil: NSS Certificate DB:cert-pki-ca is neither a key-type nor a nickname: security library: bad database.<o:p></o:p>#certutil -d . -R -k "NSS Certificate DB:cert-pki-ca" -s "CN=CA Audit Signing Certificate,<snip>" -a -o CAAudit.req2.txt<o:p></o:p>certutil: NSS Certificate DB:cert-pki-ca is neither a key-type nor a nickname: security library: bad database.<o:p></o:p>#<o:p></o:p><o:p> </o:p><o:p> </o:p>I also tried the blow for the key-type or nickname and got the equivalent results:<o:p></o:p>#certutil -d . -R -k "caSigningCert cert-pki-ca" ...etc<o:p></o:p>#certutil -d . -R -k "ocspSigningCert cert-pki-ca" ...etc<o:p></o:p>#certutil -d . -R -k "Server-Cert cert-pki-ca" ...etc<o:p></o:p>#certutil -d . -R -k "subsystemCert cert-pki-ca" ...etc<o:p></o:p>#certutil -d . -R -k "auditSigningCert cert-pki-ca" ...etc<o:p></o:p><pre style='margin-bottom:12.0pt;mso-line-height-alt:10.35pt;background:whitesmoke;vertical-align:baseline'><o:p> </o:p></pre>Please could you help me with these errors.<o:p></o:p><o:p> </o:p>Thank you.<o:p></o:p> <o:p></o:p>Richard Thomas Senior Network Engineer direct +44 (0)1252 644 265 switchboard +44 (0)1252 776755 email <a href="mailto:firstname.lastname@the-logic-group.com" target="_blank" title="blocked::mailto:firstname.lastname@the-logic-group.com">richard.thomas@the-logic-group.com</a><o:p></o:p><o:p> </o:p><o:p> </o:p><o:p> </o:p><o:p> </o:p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>From: Andrew Wnuk [mailto:awnuk@redhat.com] Sent: 18 October 2013 18:27 To: Richard Thomas Cc: pki-users@redhat.com Subject: Re: [Pki-users] CA Administrator of Instance pki-ca<o:p></o:p></div></div><o:p> </o:p><div>On 10/17/2013 08:36 AM, Richard Thomas wrote:<o:p></o:p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'>Hi Andrew,<o:p></o:p> <o:p></o:p>Thanks for that, I’ve been using certutil on a set of files that I have copied from /var/lib/pki-ca/alias/ to /tmp/alias/ so that I can practice on non live certificate database files.<o:p></o:p> <o:p></o:p>Here is what I have done whilst in the /tmp/alias/ directory:<o:p></o:p> <o:p></o:p>$certutil -d . -L<o:p></o:p> <o:p></o:p>Certificate Nickname Trust Attributes<o:p></o:p> SSL,S/MIME,JAR/XPI<o:p></o:p>ocspSigningCert cert-pki-ca u,u,u<o:p></o:p>subsystemCert cert-pki-ca u,u,u<o:p></o:p>caSigningCert cert-pki-ca CTu,Cu,Cu<o:p></o:p>Server-Cert cert-pki-ca u,u,u<o:p></o:p>auditSigningCert cert-pki-ca u,u,u<o:p></o:p> <o:p></o:p>$certutil -d . -A -n 'ocspSigningCert cert-pki-ca' -t 'u,u,u' -a -i '/tmp/OCSP Signing Certificate-2013-2014.pem'<o:p></o:p>$certutil -d . -A -n 'subsystemCert cert-pki-ca' -t 'u,u,u' -a -i '/tmp/CA Subsystem Certificate-2013-2014.pem'<o:p></o:p>$certutil -d . -A -n 'caSigningCert cert-pki-ca' -t 'CTu,Cu,Cu' -a -i '/tmp/OCSP Signing Certificate-2013-2014.pem'<o:p></o:p>$certutil -d . -A -n 'Server-Cert cert-pki-ca' -t 'u,u,u' -a -i '/tmp/<primary server>-2013-2014.pem'<o:p></o:p>$certutil -d . -A -n 'auditSigningCert cert-pki-ca' -t 'u,u,u' -a -i '/tmp/CA Audit Signing Certificate-2013-2014.pem'<o:p></o:p> <o:p></o:p>$certutil -d . -L<o:p></o:p> <o:p></o:p>Certificate Nickname Trust Attributes<o:p></o:p> SSL,S/MIME,JAR/XPI<o:p></o:p> <o:p></o:p>ocspSigningCert cert-pki-ca u,u,u<o:p></o:p>subsystemCert cert-pki-ca u,u,u<o:p></o:p>subsystemCert cert-pki-ca u,u,u<o:p></o:p>ocspSigningCert cert-pki-ca CTu,Cu,Cu<o:p></o:p></blockquote>OCSP trust bits should stay as "u,u,u" <o:p></o:p>caSigningCert cert-pki-ca CTu,Cu,Cu<o:p></o:p>Server-Cert cert-pki-ca u,u,u<o:p></o:p>auditSigningCert cert-pki-ca u,u,u<o:p></o:p>Server-Cert cert-pki-ca u,u,u<o:p></o:p>auditSigningCert cert-pki-ca u,u,u<o:p></o:p> <o:p></o:p> <o:p></o:p> <o:p></o:p>I have a few queries about what I have done….<o:p></o:p> <o:p></o:p> <o:p></o:p><![if !supportLists]>1) <![endif]>The old and new certificates are in the database store, so how does DogTag know when to use the old and new certificates? <o:p></o:p> Dogtag requests certificates by nickname. NSS library is providing the best choice based on nickname provided by Dogtag. To avoid any potential problem, you may choose to remove old certificates before importing the new certificates as suggested in the following documentation: <a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/renewing-subsystem-certificates.html#renewing-certificates-using-certutil">https://access.redhat.com/site/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/renewing-subsystem-certificates.html#renewing-certificates-using-certutil</a> <o:p></o:p><![if !supportLists]>2) <![endif]>E.G. Would I also have to update each ca.<cert type>.cert= parameter of /etc/pki-ca/CS.cfg with the new b64-encoded certificate? E.G. ca.audit_signing.cert=, ca.ocsp_signing.cert= etc.<o:p></o:p><![if !supportLists]>3) <![endif]>I notice the following differences between original and new CA Audit Signing Certificates (may be on the others, but haven’t looked yet). Is this anything to worry about?<o:p></o:p> <o:p></o:p>Original:<o:p></o:p> Identifier: Authority Key Identifier - 2.5.29.35<o:p></o:p> Critical: no <o:p></o:p> Key Identifier: <o:p></o:p> <snip><o:p></o:p> Identifier: Key Usage: - 2.5.29.15<o:p></o:p> Critical: yes <o:p></o:p> Key Usage: <o:p></o:p> Digital Signature <o:p></o:p> Non Repudiation <o:p></o:p> Identifier: Authority Info Access: - 1.3.6.1.5.5.7.1.1<o:p></o:p> Critical: no <o:p></o:p> Access Description: <o:p></o:p> Method #0: ocsp<o:p></o:p> Location #0: URIName: <a href="http://">http://</a><primary server name>:9180/ca/ocsp<o:p></o:p> Identifier: Extended Key Usage: - 2.5.29.37<o:p></o:p> Critical: no <o:p></o:p> Extended Key Usage: <o:p></o:p> 1.3.6.1.5.5.7.3.4<o:p></o:p> <o:p></o:p> <o:p></o:p>New cert that I generated:<o:p></o:p> <o:p></o:p> Extensions: <o:p></o:p> Identifier: Authority Key Identifier - 2.5.29.35<o:p></o:p> Critical: no <o:p></o:p> Key Identifier: <o:p></o:p> 77:2E:A7:DA:1D:1C:AF:3A:2A:5C:09:02:80:B8:DD:31:<o:p></o:p> 28:05:51:9A<o:p></o:p> Identifier: Subject Key Identifier - 2.5.29.14<o:p></o:p> Critical: no <o:p></o:p> Key Identifier: <o:p></o:p> B9:B9:F0:09:0C:A2:F3:E4:A2:D3:F6:B9:63:6B:EA:2C:<o:p></o:p> 96:52:22:55<o:p></o:p> Identifier: Key Usage: - 2.5.29.15<o:p></o:p> Critical: yes <o:p></o:p> Key Usage: <o:p></o:p> Digital Signature <o:p></o:p> Non Repudiation<o:p></o:p> Key usage is the same so it should work as this is just auditing certificate. <o:p></o:p> <o:p></o:p> <o:p></o:p>Thanks again,<o:p></o:p> <o:p></o:p>Richard Thomas Senior Network Engineer direct +44 (0)1252 644 265 switchboard +44 (0)1252 776755 email <a href="mailto:firstname.lastname@the-logic-group.com" target="_blank" title="blocked::mailto:firstname.lastname@the-logic-group.com">richard.thomas@the-logic-group.com</a><o:p></o:p> <o:p></o:p> <o:p></o:p> <o:p></o:p> <o:p></o:p> <o:p></o:p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>From: Andrew Wnuk [<a href="mailto:awnuk@redhat.com">mailto:awnuk@redhat.com</a>] Sent: 17 October 2013 01:43 To: Richard Thomas Cc: <a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a> Subject: Re: [Pki-users] CA Administrator of Instance pki-ca<o:p></o:p></div></div> <o:p></o:p><div><tt>On 10/16/2013 06:31 AM, Richard Thomas wrote:</tt><o:p></o:p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><tt>Hi Andrew,</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Thanks for your email, I got past that issue once I made some edits to some .cfg files in /var/lib/pki-ca/profiles/ca/ (shown at the bottom of this email).</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>That meant I could get as far as "Install a certificate" and I got a choice of the following when doing so:</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Certificate Manager CA Signing Certificate(s)</tt><o:p></o:p><tt>o) OCSP Signing Certificate(s)</tt><o:p></o:p><tt>o) SSL Server Certificate(s)</tt><o:p></o:p><tt>o) Cross-signed Certificate(s)</tt><o:p></o:p><tt>o) Other Certificate(s)</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Please could you let me know which of the above option I should select.</tt><o:p></o:p></blockquote> <tt>The first 3 options should work for your CA but you are missing entries for subsytem and audit certificates.</tt> <tt>You may import certificates manually using certutil.</tt> <tt>For this you need to</tt><o:p></o:p><ol start=1 type=1><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo5'><tt>stop your CA</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo5'><tt>change directory to /var/lib/pki-ca/alias/</tt><o:p></o:p></li></ol><pre style='margin-left:36.0pt;text-indent:-18.0pt;mso-list:l1 level1 lfo5'><![if !supportLists]>3. <![endif]><tt>check current content of CA's NSS-DB by running</tt><o:p></o:p></pre><pre style='margin-left:36.0pt;text-indent:-18.0pt;mso-list:l1 level1 lfo5'><![if !supportLists]>4. <![endif]><tt>certutil -d . -L</tt><o:p></o:p></pre><ol start=5 type=1><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo5'><tt>import certificates using identical trust bits and nicknames </tt> <tt>certutil -d . -A -n '<nickname>' -t '<trust>' -a -i '<file including b64-encoded certificate>'</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo5'><tt>start your CA</tt><o:p></o:p></li></ol> <tt>If you need to alter nicknames, please reflect this in CS.cfg file.</tt> <o:p></o:p><tt> </tt><o:p></o:p><tt>Thank you.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Richard.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Here’s what I did to be able to "Renew certificate to be manually approved by agents".</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Edit file /var/lib/pki-ca/profiles/ca/caServerCert.cfg</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Change:</tt><o:p></o:p><tt>visible=false</tt><o:p></o:p><tt>enable=false</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>To:</tt><o:p></o:p><tt>visible=true</tt><o:p></o:p><tt>enable=true</tt><o:p></o:p><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Edit file /var/lib/pki-ca/profiles/ca/caOCSPCert.cfg</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Change:</tt><o:p></o:p><tt>visible=false</tt><o:p></o:p><tt>enable=false</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>To:</tt><o:p></o:p><tt>visible=true</tt><o:p></o:p><tt>enable=true</tt><o:p></o:p><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Edit file /var/lib/pki-ca/profiles/ca/caSignedLogCert.cfg</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Change:</tt><o:p></o:p><tt>visible=false</tt><o:p></o:p><tt>enable=false</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>To:</tt><o:p></o:p><tt>visible=true</tt><o:p></o:p><tt>enable=true</tt><o:p></o:p><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p> visible=true makes enrollment visible on enrollment list page enable=true enables specific enrollment profile Both changes are fine. <o:p></o:p><tt>service pki-cad restart</tt><o:p></o:p><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><tt>From:</tt><tt> Andrew Wnuk [<a href="mailto:awnuk@redhat.com">mailto:awnuk@redhat.com</a>] </tt> <tt>Sent:</tt><tt> 15 October 2013 17:41</tt> <tt>To:</tt><tt> Richard Thomas</tt> <tt>Cc:</tt><tt> <a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a></tt> <tt>Subject:</tt><tt> Re: [Pki-users] CA Administrator of Instance pki-ca</tt><o:p></o:p></div></div><tt> </tt><o:p></o:p><div><tt>On 10/15/2013 02:35 AM, Richard Thomas wrote:</tt><o:p></o:p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><tt>Hi Andrew,</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Thanks again for getting back to me.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Unfortunately, I didn’t get very far.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>I’ve shown below what I have done and what it resulted in:</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Go to the <server>:9443/ca/agent/ca URL and list the certificates stored in Dogtag.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Make a note of of the Certificate Serial Numbers of the following certificates and change the hex value into decimal:</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>CN=OCSP Signing Certificate E.G. 2</tt><o:p></o:p><tt>CN=<primary server> E.G. 3</tt><o:p></o:p><tt>CN=CA Subsystem Certificate E.G. 4</tt><o:p></o:p><tt>CN=CA Audit Signing Certificate E.G. 5</tt><o:p></o:p><tt>CN=<secondary server> E.G. 268369921</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Go to the <server>:9444/ca/ee/ca URL</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Click on "Renewal: Renew certificate to be manually approved by agents"</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Submit each of the Certificate Serial Numbers noted above and make a note of the request ID</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>For each Certificate Serial Number listed above that I submit, I get the following:</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Sorry, your request is not submitted. The reason is "Profile caServerCert Not Found".</tt><o:p></o:p></blockquote> <tt>Check if caServerCert.cfg is listed under /var/lib/pki-ca/profiles/ca and then check if /var/lib/pki-ca/conf/CS.cfg includes</tt><o:p></o:p><tt>profile.list= . . . ,caServerCert, . . .</tt> <tt>. . .</tt> <tt>profile.caServerCert.class_id=caEnrollImpl</tt> <tt>profile.caServerCert.config=/var/lib/pki-ca/profiles/ca/caServerCert.cfg</tt> <tt>. . .</tt><o:p></o:p> <o:p></o:p><tt> </tt><o:p></o:p><tt>Please could you help me further.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Many thanks.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Richard.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><tt>From:</tt><tt> Andrew Wnuk [<a href="mailto:awnuk@redhat.com">mailto:awnuk@redhat.com</a>] </tt> <tt>Sent:</tt><tt> 12 October 2013 00:47</tt> <tt>To:</tt><tt> Richard Thomas</tt> <tt>Cc:</tt><tt> <a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a></tt> <tt>Subject:</tt><tt> Re: [Pki-users] CA Administrator of Instance pki-ca</tt><o:p></o:p></div></div><tt> </tt><o:p></o:p><div><tt>On 10/11/2013 07:04 AM, Richard Thomas wrote:</tt><o:p></o:p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><tt>Hi Andrew,</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Thanks for those tips, I had some success, then difficulty and then success.</tt><o:p></o:p><tt>Below is what I did, with some of my comments inline.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Before I get to that though, there are some other certificates that are due to run out soon, but I think they should be easier to renew.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>The Common Name of those other certificates are:</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) CN=OCSP Signing Certificate</tt><o:p></o:p><tt>o) CN=<servername></tt><o:p></o:p><tt>o) CN=CA Subsystem Certificate</tt><o:p></o:p><tt>o) CN=CA Audit Signing Certificate</tt><o:p></o:p></blockquote> <tt>As I noticed below, that your server provides option to "Renew certificate to be manually approved by agents".</tt> <tt>You should used this option for all your renewals.</tt> <tt>Then start pkiconsole go to "System Keys and Certificates", select "Local Certificates", click on "Add/Renew", "Next" and "Install a certificate"</tt> <o:p></o:p><tt> </tt><o:p></o:p><tt>Please could you help me and let me know what steps I should take for renewing these too.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Thank you.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Anyway, back to what I did to get the admin certificate updated.</tt><o:p></o:p><tt>Your steps are still numbered, the ones that I did around them are identified with o)</tt><o:p></o:p><tt>Here goes:</tt><o:p></o:p><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Edit /var/lib/pki-ca/profiles/ca/caUserCert.cfg</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>Change:</tt><o:p></o:p><tt>visible=false</tt><o:p></o:p><tt>enable=false</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>To:</tt><o:p></o:p><tt>visible=true</tt><o:p></o:p><tt>enable=true</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Restart service "pki-cad"</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>1. Go to EE interface (typically <a href="https://">https://</a><hostname>:9444/ca/ee/ca/) and select "Manual User Dual-Use Certificate Enrollment"</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>2. Fill out the form and submit request</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>3. Go to Agent interface (typically <a href="https://">https://</a><hostname>:9443/ca/agent/ca/) and approve submitted request</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>4. Return to EE interface, select "Retrieval" tab and "Check Request Status".</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>5. Type in request number and press submit.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>6. Click on issued certificate serial number.</tt><o:p></o:p><tt>>I did "List Certificates", went to the last page and found the certificate that way</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>7. Go to the end of page displaying certificate and press "Import Your Certificate"</tt><o:p></o:p><tt>>I got "The server returned an invalid client certificate. Error 207 (net::ERR_CERT_INVALID)"</tt><o:p></o:p> <tt>This probably means that browser which generated certificate request (and the key) is not the same browser used to import certificate.</tt> <o:p></o:p><tt> </tt><o:p></o:p><tt>> So having got stuck at this point, I figured I could use what I had done before and then use your pkiconsole instructions.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>> The below is end-to-end from what I started off on my own and then across to the second half of your instructions.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Go to the <server>:9444/ca/ee/ca URL</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Click on "Renewal: Renew certificate to be manually approved by agents" (make a note of the number)</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Go to the <server>:9443/ca/agent/ca URL to approve my request. (Use the number above)</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Go to the <server>:9444/ca/ee/ca URL to retrieve the certificate. (Use the number above) and click on the Issued certificate</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Extract the Base 64 encoded part of the certificate and save as <new certificate name>.pem</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Transfer <old certificate bundle name>.p12 and <new certificate name>.pem to a machine with openssl installed on it</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) On a machine with openssl installed on it, submit following command:</tt><o:p></o:p><tt>$openssl pkcs12 -in <old certificate bundle name>.p12 -out <old certificate bundle name>.pem -nodes</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Copy <old certificate bundle name>.pem to <new certificate bundle name>.pem</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Update <new certificate bundle name>.pem by replacing the relevant part of it with the contents of <new certificate name>.pem</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Cut the key part of <new certificate bundle name>.pem and create <certificate name>.key from it</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Submit following command:</tt><o:p></o:p><tt>$openssl pkcs12 -export -in <new certificate bundle name>.pem -inkey <certificate name>.key -out <new certificate bundle name>.p12 </tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Transfer <new certificate bundle name>.p12 to the machine with the web browser that you want to access Dog Tag from.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>o) Import <new certificate bundle name>.p12 into the machine.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>8. Start pkiconsole (typically by running "pkiconsole <a href="https://">https://</a>`hostname`:9445/ca")</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>9. Select "Users and Groups" and select your admin entry.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>10. Press "Certificates" button then "Import" and paste in the contents of <new certificate name>.pem, then OK and "Done"</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>11. Clear SSL cache in the browser or restart your browser.</tt><o:p></o:p><tt> </tt><o:p></o:p><tt>12. You should now be able to use your new certificate to access Agent interface</tt><o:p></o:p><tt>>YES – I can now access the agent interface using the new certificate J</tt><o:p></o:p><tt> </tt><o:p></o:p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><tt>From:</tt><tt> Andrew Wnuk [<a href="mailto:awnuk@redhat.com">mailto:awnuk@redhat.com</a>] </tt> <tt>Sent:</tt><tt> 08 October 2013 19:26</tt> <tt>To:</tt><tt> Richard Thomas</tt> <tt>Cc:</tt><tt> <a href="mailto:pki-users-bounces@redhat.com">pki-users-bounces@redhat.com</a></tt> <tt>Subject:</tt><tt> Re: [Pki-users] CA Administrator of Instance pki-ca</tt><o:p></o:p></div></div><tt> </tt><o:p></o:p><div><tt>On 10/07/2013 11:41 AM, Richard Thomas wrote:</tt><o:p></o:p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><pre><tt>Hi Andrew,</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Thanks very much for sending this to me.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>The first thing I'd like to point out is that I'm using the pre-Red Hat enterprise variant of DogTag (dogtag-pki-1.3.0-2.el5)</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I have been trying to adapt the instructions as best I can and have so nearly got there, but not quite..</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I have been referring to chapter 4.8.2 of that article by going to the <server>:9444/ca/ee/ca URL and the only 2 Certificate Profiles I have to choose from are:</tt><o:p></o:p></pre><pre><tt>o) Renewal: Renew certificate to be manually approved by agents</tt><o:p></o:p></pre><pre><tt>o) Cisco VPN Client Enrolment</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>The second option is for end users of our Cisco VPN to generate new certificates with, so I don't do anything with that.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>The first option looked promising, as it asked for a certificate number, so I used the <server>:9443/ca/agent/ca URL to find the certificate number of the current "CA Administrator of Instance pki-ca" certificate, make a note of it and enter it into the certificate renewal page.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I then use the <server>:9443/ca/agent/ca URL to approve my request.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Back to the <server>:9444/ca/ee/ca URL to retrieve the certificate.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I then updated the .p12 (.pfx) certificate with the one that appeared from the step above, with quite a bit of open_ssl commands, but I am confident that my new .p12 has everything in it as before (including the private key), with the exception of the "CA Administrator of Instance pki-ca" certificate being my updated one instead of the current one.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I manage to import it into by machine's browser and when I navigate to <server>:9443/ca/agent/ca, the new certificate comes up as an option to present to Dog Tag, so things are looking good at this stage and I select it.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>After that is where the first thing looks different, but I wasn't too worried about. I get a message saying "Request For Permission to Use a Key", so I grant permission.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Then things don't look go at all, as once I'm past that, all the pages say "Invalid Credential".</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I have probably gone about things in a way that's more complicated than it should be and I guess it's because I'm using an earlier version of Dog Tag.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Do you have any ideas where I have gone wrong with this please.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Thank you very much.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Richard.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre></blockquote> <tt>Unfortunately your version is old enough to miss new renewal profiles, which would make your task easier.</tt> <tt>Here is a simple way to renew your CA administrator certificate:</tt><o:p></o:p><ol start=1 type=1><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Go to EE interface (typically <a href="https://">https://</a><hostname>:9444/ca/ee/ca/) and select "Manual User Dual-Use Certificate Enrollment"</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Fill out the form and submit request</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Go to Agent interface (typically <a href="https://">https://</a><hostname>:9443/ca/agent/ca/) and approve submitted request</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Return to EE interface, select "Retrieval" tab and "Check Request Status".</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Type in request number and press submit.</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Click on issued certificate serial number.</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Go to the end of page displaying certificate and press "Import Your Certificate"</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Start pkiconsole (typically by running "pkiconsole <a href="https://">https://</a>`hostname`:9445/ca")</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Select "Users and Groups" and select your admin entry.</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Press "Certificates" button then "Import" and paste in your new base64 encoded certificate, then OK and "Done"</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>Clear SSL cache in the browser or restart your browser.</tt><o:p></o:p></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo9'><tt>You should now be able to use your new certificate to access Agent interface</tt><o:p></o:p></li></ol><tt>Thanks,</tt> <tt>Andrew</tt> <o:p></o:p><pre><tt> </tt><o:p></o:p></pre><pre><tt>________________________________________</tt><o:p></o:p></pre><pre><tt>From: <a href="mailto:pki-users-bounces@redhat.com">pki-users-bounces@redhat.com</a> [<a href="mailto:pki-users-bounces@redhat.com">pki-users-bounces@redhat.com</a>] On Behalf Of Andrew Wnuk [<a href="mailto:awnuk@redhat.com">awnuk@redhat.com</a>]</tt><o:p></o:p></pre><pre><tt>Sent: Thursday, October 03, 2013 6:05 PM</tt><o:p></o:p></pre><pre><tt>To: <a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a></tt><o:p></o:p></pre><pre><tt>Subject: Re: [Pki-users] CA Administrator of Instance pki-ca</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Hi Richard,</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>You can renew certificate using: <a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/renewing-certificates.html">https://access.redhat.com/site/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/renewing-certificates.html</a></tt><o:p></o:p></pre><pre><tt>and then add new certificate to CA administrator entry using console.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Best,</tt><o:p></o:p></pre><pre><tt>Andrew</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>On 10/03/2013 08:49 AM, Richard Thomas wrote:</tt><o:p></o:p></pre><pre><tt>Hi all,</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I hope someone would be able to help me with this.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I have taken over a Dog Tag system and I have little knowledge of it.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I need to renew the “CA Administrator of Instance pki-ca” certificate, as it is running out in a few weeks.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Would someone be able to point me in the direction of any documentation on how to do this or let me know how to do it.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>I would massively appreciate any guidance on this.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Thanks in advance,</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>Richard.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>The world’s first PCI accreditation for a Point to Point Encryption application. Find out more…<a href="http://www.the-logic-group.com/pressrelease/Worlds-First-Accreditation-for-PCI-P2PE-Application"><http://www.the-logic-group.com/pressrelease/Worlds-First-Accreditation-for-PCI-P2PE-Application></a></tt><o:p></o:p></pre><pre><tt>The Logic Group</tt><o:p></o:p></pre><pre><tt>Enterprises Limited</tt><o:p></o:p></pre><pre><tt> Logic House</tt><o:p></o:p></pre><pre><tt>Waterfront Business Park</tt><o:p></o:p></pre><pre><tt>Fleet, Hampshire</tt><o:p></o:p></pre><pre><tt>GU51 3SB</tt><o:p></o:p></pre><pre><tt>United Kingdom phone</tt><o:p></o:p></pre><pre><tt>fax</tt><o:p></o:p></pre><pre><tt>email</tt><o:p></o:p></pre><pre><tt>web +44 1252 776 700</tt><o:p></o:p></pre><pre><tt>+44 1252 776 738</tt><o:p></o:p></pre><pre><tt><a href="mailto:info@the-logic-group.com">info@the-logic-group.com</a><a href="mailto:info@the-logic-group.com"><mailto:info@the-logic-group.com></a></tt><o:p></o:p></pre><pre><tt><a href="http://www.the-logic-group.com">www.the-logic-group.com</a><a href="http://www.the-logic-group.com"><http://www.the-logic-group.com></a> Registered in England</tt><o:p></o:p></pre><pre><tt>Number 2609323 [<a href="http://www.the-logic-group.com/UploadedImages/34e428b6-82a8-46f4-999d-89403051ff3c.jpg">http://www.the-logic-group.com/UploadedImages/34e428b6-82a8-46f4-999d-89403051ff3c.jpg</a>]</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>The Logic Group Enterprises Limited, Logic House, Waterfront Business Park, Fleet Road, Fleet,</tt><o:p></o:p></pre><pre><tt>Hampshire, GU51 3SB, United Kingdom. Registered in England. Registered No. 2609323</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>The information in this email and any attachments are confidential and may be legally privileged and protected by law. It is for the intended recipient only. If you are not the intended recipient you may not use, disclose, copy, distribute, print or rely on the content of this email or its attachments. If this email has been received by you in error please advise the sender and delete the email from your system.</tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><pre><tt>_______________________________________________</tt><o:p></o:p></pre><pre><tt>Pki-users mailing list</tt><o:p></o:p></pre><pre><tt><a href="mailto:Pki-users@redhat.com">Pki-users@redhat.com</a><a href="mailto:Pki-users@redhat.com"><mailto:Pki-users@redhat.com></a></tt><o:p></o:p></pre><pre><tt><a href="https://www.redhat.com/mailman/listinfo/pki-users">https://www.redhat.com/mailman/listinfo/pki-users</a></tt><o:p></o:p></pre><pre><tt> </tt><o:p></o:p></pre><tt> </tt><o:p></o:p><tt>The world's first PCI accreditation for a Point to Point Encryption application.</tt><tt> </tt><tt><a href="http://www.the-logic-group.com/pressrelease/Worlds-First-Accreditation-for-PCI-P2PE-Application">Find out more...</a></tt> <tt> </tt><o:p></o:p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=1000 style='width:750.0pt;border-collapse:collapse;float:none'><tr style='height:13.8pt'><td width=121 rowspan=2 valign=top style='width:90.75pt;border:dotted #D8D8D7 1.0pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'>The Logic Group Enterprises Limited <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=152 rowspan=2 valign=top style='width:114.0pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>Logic House Waterfront Business Park Fleet, Hampshire GU51 3SB United Kingdom <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=45 rowspan=2 valign=top style='width:33.75pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>phone fax email web <o:p></o:p></td><td width=151 rowspan=2 valign=top style='width:113.25pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>+44 1252 776 700 +44 1252 776 738 <a href="mailto:info@the-logic-group.com">info@the-logic-group.com</a> <a href="http://www.the-logic-group.com">www.the-logic-group.com</a> <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=84 rowspan=2 valign=top style='width:63.0pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>Registered in England Number 2609323 <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=137 rowspan=2 valign=top style='width:102.75pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><img border=0 width=32 height=32 id="_x0000_i1025" src="cid:image001.jpg@01CED4B1.64DF78B0" alt="http://www.the-logic-group.com/UploadedImages/34e428b6-82a8-46f4-999d-89403051ff3c.jpg"><o:p></o:p></td><td width=0 style='width:.3pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'></td></tr><tr style='height:13.8pt'><td width=0 style='width:.3pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'></td></tr></table><tt> </tt><o:p></o:p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=600 style='width:450.0pt;border-collapse:collapse;float:none'><tr style='height:59.25pt'><td style='border:dotted #D8D8D7 1.0pt;padding:0cm 0cm 0cm 0cm;height:59.25pt'>The Logic Group Enterprises Limited, Logic House, Waterfront Business Park, Fleet Road, Fleet, Hampshire, GU51 3SB, United Kingdom. Registered in England. Registered No. 2609323 <o:p></o:p>The information in this email and any attachments are confidential and may be legally privileged and protected by law. It is for the intended recipient only. If you are not the intended recipient you may not use, disclose, copy, distribute, print or rely on the content of this email or its attachments. If this email has been received by you in error please advise the sender and delete the email from your system. <o:p></o:p></td></tr></table><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p><tt>The world's first PCI accreditation for a Point to Point Encryption application.</tt><tt> </tt><tt><a href="http://www.the-logic-group.com/pressrelease/Worlds-First-Accreditation-for-PCI-P2PE-Application">Find out more...</a></tt> <tt> </tt><o:p></o:p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=1000 style='width:750.0pt;border-collapse:collapse;float:none'><tr style='height:13.8pt'><td width=121 rowspan=2 valign=top style='width:90.75pt;border:dotted #D8D8D7 1.0pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'>The Logic Group Enterprises Limited <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=152 rowspan=2 valign=top style='width:114.0pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>Logic House Waterfront Business Park Fleet, Hampshire GU51 3SB United Kingdom <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=45 rowspan=2 valign=top style='width:33.75pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>phone fax email web <o:p></o:p></td><td width=151 rowspan=2 valign=top style='width:113.25pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>+44 1252 776 700 +44 1252 776 738 <a href="mailto:info@the-logic-group.com">info@the-logic-group.com</a> <a href="http://www.the-logic-group.com">www.the-logic-group.com</a> <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=84 rowspan=2 valign=top style='width:63.0pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>Registered in England Number 2609323 <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=137 rowspan=2 valign=top style='width:102.75pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><img border=0 width=32 height=32 id="_x0000_i1026" src="cid:image001.jpg@01CED4B1.64DF78B0" alt="http://www.the-logic-group.com/UploadedImages/34e428b6-82a8-46f4-999d-89403051ff3c.jpg"><o:p></o:p></td><td width=0 style='width:.3pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'></td></tr><tr style='height:13.8pt'><td width=0 style='width:.3pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'></td></tr></table><tt> </tt><o:p></o:p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=600 style='width:450.0pt;border-collapse:collapse;float:none'><tr style='height:59.25pt'><td style='border:dotted #D8D8D7 1.0pt;padding:0cm 0cm 0cm 0cm;height:59.25pt'>The Logic Group Enterprises Limited, Logic House, Waterfront Business Park, Fleet Road, Fleet, Hampshire, GU51 3SB, United Kingdom. Registered in England. Registered No. 2609323 <o:p></o:p>The information in this email and any attachments are confidential and may be legally privileged and protected by law. It is for the intended recipient only. If you are not the intended recipient you may not use, disclose, copy, distribute, print or rely on the content of this email or its attachments. If this email has been received by you in error please advise the sender and delete the email from your system. <o:p></o:p></td></tr></table><tt> </tt><o:p></o:p><tt> </tt><o:p></o:p><tt>The world's first PCI accreditation for a Point to Point Encryption application.</tt><tt> </tt><tt><a href="http://www.the-logic-group.com/pressrelease/Worlds-First-Accreditation-for-PCI-P2PE-Application">Find out more...</a></tt> <tt> </tt><o:p></o:p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=1000 style='width:750.0pt;border-collapse:collapse;float:none'><tr style='height:13.8pt'><td width=121 rowspan=2 valign=top style='width:90.75pt;border:dotted #D8D8D7 1.0pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'>The Logic Group Enterprises Limited <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=152 rowspan=2 valign=top style='width:114.0pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>Logic House Waterfront Business Park Fleet, Hampshire GU51 3SB United Kingdom <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=45 rowspan=2 valign=top style='width:33.75pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>phone fax email web <o:p></o:p></td><td width=151 rowspan=2 valign=top style='width:113.25pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>+44 1252 776 700 +44 1252 776 738 <a href="mailto:info@the-logic-group.com">info@the-logic-group.com</a> <a href="http://www.the-logic-group.com">www.the-logic-group.com</a> <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=84 rowspan=2 valign=top style='width:63.0pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>Registered in England Number 2609323 <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><tt> </tt><o:p></o:p></td><td width=137 rowspan=2 valign=top style='width:102.75pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><img border=0 id="_x0000_i1027" src="http://www.the-logic-group.com/UploadedImages/34e428b6-82a8-46f4-999d-89403051ff3c.jpg"><o:p></o:p></td><td width=0 style='width:.3pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'></td></tr><tr style='height:13.8pt'><td width=0 style='width:.3pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'></td></tr></table> <o:p></o:p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=600 style='width:450.0pt;border-collapse:collapse;float:none'><tr style='height:59.25pt'><td style='border:dotted #D8D8D7 1.0pt;padding:0cm 0cm 0cm 0cm;height:59.25pt'>The Logic Group Enterprises Limited, Logic House, Waterfront Business Park, Fleet Road, Fleet, Hampshire, GU51 3SB, United Kingdom. Registered in England. Registered No. 2609323 <o:p></o:p>The information in this email and any attachments are confidential and may be legally privileged and protected by law. It is for the intended recipient only. If you are not the intended recipient you may not use, disclose, copy, distribute, print or rely on the content of this email or its attachments. If this email has been received by you in error please advise the sender and delete the email from your system. <o:p></o:p></td></tr></table> <o:p></o:p> <o:p></o:p>The world's first PCI accreditation for a Point to Point Encryption application. <a href="http://www.the-logic-group.com/pressrelease/Worlds-First-Accreditation-for-PCI-P2PE-Application">Find out more...</a> <o:p></o:p><table class=MsoNormalTable border=1 cellspacing=0 cellpadding=0 width=1000 style='width:750.0pt;border-collapse:collapse;border:none;float:none'><tr style='height:13.8pt'><td width=121 rowspan=2 valign=top style='width:90.75pt;border:dotted #D8D8D7 1.0pt;padding:0cm 0cm 0cm 0cm;height:13.8pt'>The Logic Group Enterprises Limited <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'> <o:p></o:p></td><td width=152 rowspan=2 valign=top style='width:114.0pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>Logic House Waterfront Business Park Fleet, Hampshire GU51 3SB United Kingdom <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'> <o:p></o:p></td><td width=45 rowspan=2 valign=top style='width:33.75pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>phone fax email web <o:p></o:p></td><td width=151 rowspan=2 valign=top style='width:113.25pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>+44 1252 776 700 +44 1252 776 738 <a href="mailto:info@the-logic-group.com">info@the-logic-group.com</a> <a href="http://www.the-logic-group.com">www.the-logic-group.com</a> <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'> <o:p></o:p></td><td width=84 rowspan=2 valign=top style='width:63.0pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'>Registered in England Number 2609323 <o:p></o:p></td><td width=10 rowspan=2 valign=top style='width:7.5pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'> <o:p></o:p></td><td width=137 rowspan=2 valign=top style='width:102.75pt;border:dotted #D8D8D7 1.0pt;border-left:none;padding:0cm 0cm 0cm 0cm;height:13.8pt'><img border=0 id="_x0000_i1028" src="http://www.the-logic-group.com/UploadedImages/34e428b6-82a8-46f4-999d-89403051ff3c.jpg"><o:p></o:p></td><td style='height:13.8pt;border:none' width=0 height=18></td></tr><tr style='height:13.8pt'><td style='height:13.8pt;border:none' width=0 height=18></td></tr></table><o:p> </o:p><table class=MsoNormalTable border=1 cellspacing=0 cellpadding=0 width=600 style='width:450.0pt;border-collapse:collapse;border:none;float:none'><tr style='height:59.25pt'><td style='border:dotted #D8D8D7 1.0pt;padding:0cm 0cm 0cm 0cm;height:59.25pt'>The Logic Group Enterprises Limited, Logic House, Waterfront Business Park, Fleet Road, Fleet, Hampshire, GU51 3SB, United Kingdom. Registered in England. Registered No. 2609323 <o:p></o:p>The information in this email and any attachments are confidential and may be legally privileged and protected by law. It is for the intended recipient only. If you are not the intended recipient you may not use, disclose, copy, distribute, print or rely on the content of this email or its attachments. If this email has been received by you in error please advise the sender and delete the email from your system. <o:p></o:p></td></tr></table><o:p> </o:p><o:p> </o:p></div>The world's first PCI accreditation for a Point to Point Encryption application. <A href="http://www.the-logic-group.com/pressrelease/Worlds-First-Accreditation-for-PCI-P2PE-Application">Find out more...</A> <?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p> </o:p> <TABLE style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-COLLAPSE: collapse; FLOAT: none; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" border=0 cellSpacing=0 cellPadding=0 width=1000> <TBODY> <TR> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" class=style1 vAlign=top rowSpan=2 width=121> The Logic Group Enterprises Limited </TD> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" vAlign=top rowSpan=2 width=10> </TD> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" vAlign=top rowSpan=2 width=152>Logic House Waterfront Business Park Fleet, Hampshire GU51 3SB United Kingdom </TD> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" vAlign=top rowSpan=2 width=10> </TD> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" vAlign=top rowSpan=2 width=45>phone fax email web </TD> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" vAlign=top rowSpan=2 width=151>+44 1252 776 700 +44 1252 776 738 info@the-logic-group.com www.the-logic-group.com </TD> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" vAlign=top rowSpan=2 width=10> </TD> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" vAlign=top rowSpan=2 width=84>Registered in England Number 2609323 </TD> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" vAlign=top rowSpan=2 width=10> </TD> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" vAlign=top rowSpan=2 width=137><IMG style="WIDTH: 129px; HEIGHT: 50px" src="http://www.the-logic-group.com/UploadedImages/34e428b6-82a8-46f4-999d-89403051ff3c.jpg"> </TD></TR> <TR></TR></TBODY></TABLE> <TABLE style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-COLLAPSE: collapse; FLOAT: none; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" border=0 cellSpacing=0 cellPadding=0 width=600> <TBODY> <TR> <TD style="BORDER-BOTTOM: #d8d8d7 1px dotted; BORDER-LEFT: #d8d8d7 1px dotted; BORDER-TOP: #d8d8d7 1px dotted; BORDER-RIGHT: #d8d8d7 1px dotted" height=79> The Logic Group Enterprises Limited, Logic House, Waterfront Business Park, Fleet Road, Fleet, Hampshire, GU51 3SB, United Kingdom. Registered in England. Registered No. 2609323 The information in this email and any attachments are confidential and may be legally privileged and protected by law. It is for the intended recipient only. If you are not the intended recipient you may not use, disclose, copy, distribute, print or rely on the content of this email or its attachments. If this email has been received by you in error please advise the sender and delete the email from your system. </TD></TR></TBODY></TABLE>  </body></html>