<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">Hi Nalinda,</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">I requested the certificate using 'Manual User Dual-Use Certificate Enrollment’ option.</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"> </font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">However, when I tried to import the generated certificate into Firefox browser, I get following error:</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><span class="Apple-tab-span" style="white-space:pre"></span>'This personal certificate can't be installed because you don't own the corresponding private key which was created when
the certificate was requested.'</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">To work around this, I manually created private key and CSR on the client machine using following steps:</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><br>
</font></div>
<blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px;">
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">1. Generate a new private key and Certificate Signing Request:</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><span class="Apple-tab-span" style="white-space:pre"></span>$ openssl req -out operator.csr -new -newkey rsa:2048 -nodes -keyout operator.key</font></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"><span style="font-size: 13px; font-family: Verdana;">2. Submit a CSR using ‘Manual Administrator Certificate Enrollment’ option via end user interface</span></div>
<div><span class="Apple-tab-span" style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 13px; white-space: pre;"></span><font face="Verdana"><span style="font-size: 13px;">(Note: Ensure that the Subject Name field is populated with the exact value as
it appears in the Subject attribute of CSR)</span></font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">3. Create a pkcs#12 file once the above CSR is approved:</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><span class="Apple-tab-span" style="white-space:pre"></span>$ openssl pkcs12 -export -out operator.p12 -inkey operator.key -in operator.cert -certfile ca.cert</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">4. Using </font><span style="font-family: Verdana; font-size: 13px;">PKIConsole, c</span><span style="font-size: 13px; font-family: Verdana;">reate a new user, add that user to
the "Certificate Manager Agents” group and associate the certificate (operator.cert) obtained in the step#3 above</span></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">5. Launch Firefox browser and import pkcs#12 file (operator.p12) under 'Your Certificates’ section</font></div>
</blockquote>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">With these steps, I can now successfully access agent interface. </font></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div><font face="Verdana"><span style="font-size: 13px;">So, I would like to know when and how 'Manual User Dual-Use Certificate Enrollment’ option is useful in overall solution.</span></font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;"><br>
</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">Thanks,</font></div>
<div style="color: rgb(0, 0, 0);"><font face="Verdana" style="font-size: 13px;">Mahendra</font></div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<br>
</div>
<span id="OLK_SRC_BODY_SECTION" style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Nalinda Herath <<a href="mailto:nali.mrt@gmail.com">nali.mrt@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Monday, March 30, 2015 at 10:22 PM<br>
<span style="font-weight:bold">To: </span>"Jain, Mahendra" <<a href="mailto:majain@verisign.com">majain@verisign.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a>" <<a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Pki-users] How to setup PKI Administrator user<br>
</div>
<div><br>
</div>
<div>
<div>
<p dir="ltr">Yes mahendra</p>
<div class="gmail_quote">On Mar 30, 2015 11:07 PM, "Jain, Mahendra" <<a href="mailto:Majain@verisign.com">Majain@verisign.com</a>> wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Hi Nalinda,</div>
<div><br>
</div>
<div>Thanks for the quick response. </div>
<div><br>
</div>
<div>How do I create a new user via the web interface?</div>
<div>Do you mean submit a 'Manual User Dual-Use Certificate Enrollment’ request via end user interface and once the request is approved, use that certificate when creating user via PKIConsole?</div>
<div> </div>
<div>Thanks,</div>
<div>Mahendra</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Nalinda Herath <<a href="mailto:nali.mrt@gmail.com" target="_blank">nali.mrt@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Monday, March 30, 2015 at 12:24 PM<br>
<span style="font-weight:bold">To: </span>"Jain, Mahendra" <<a href="mailto:majain@verisign.com" target="_blank">majain@verisign.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:pki-users@redhat.com" target="_blank">pki-users@redhat.com</a>" <<a href="mailto:pki-users@redhat.com" target="_blank">pki-users@redhat.com</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Pki-users] How to setup PKI Administrator user<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div class="gmail_default" style="font-family:courier new,monospace">Dear Mahendra,<br>
<br>
</div>
<div class="gmail_default" style="font-family:courier new,monospace">You can get it done through the pkiconsole.
<br>
<br>
</div>
<div class="gmail_default" style="font-family:courier new,monospace">first create a new user via the web interface.
<br>
<br>
Then open the pkiconsole, go to users and groups and add a new user for the system. Set the required attributes and add that user to the "Certificate Manager Agents" group. use the certificate of the new user created via the web interface.
<br>
<br>
</div>
<div class="gmail_default" style="font-family:courier new,monospace">hope this will help<br>
<br>
</div>
<div class="gmail_default" style="font-family:courier new,monospace">Regards,<br>
</div>
<div class="gmail_default" style="font-family:courier new,monospace">Nalinda<br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Mar 30, 2015 at 9:16 PM, Jain, Mahendra <span dir="ltr">
<<a href="mailto:Majain@verisign.com" target="_blank">Majain@verisign.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Hello All,</div>
<div><br>
</div>
<div>When I install the Dogtag Certificate System, the installation creates default PKI Administrator user (caadmin).</div>
<div>What is the procedure to setup additional PKI Administrator users so that they can also access agent interface?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Mahendra </div>
<h5><font color="gray">“This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed, and may contain information that is non-public, proprietary, privileged, confidential and exempt from disclosure
under applicable law or may be constituted as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this
message in error, notify sender immediately and delete this message immediately.”
</font></h5>
</div>
<br>
_______________________________________________<br>
Pki-users mailing list<br>
<a href="mailto:Pki-users@redhat.com" target="_blank">Pki-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/pki-users" target="_blank">https://www.redhat.com/mailman/listinfo/pki-users</a><br>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div><font face="georgia,serif"><font size="1">Best Regards,</font><br>
Nalinda<br>
</font><br>
</div>
</div>
</div>
</div>
</span></div>
</blockquote>
</div>
</div>
</div>
</span>
</body>
</html>