<div dir="ltr"><div><div>Thanks. The problem is that i have to specify multiple entries, and this is when things go weird. policyset.serverCertSet.5.constraint.class_id=noConstraintImpl <a href="http://policyset.serverCertSet.5.constraint.name">policyset.serverCertSet.5.constraint.name</a>=No Constraint policyset.serverCertSet.5.default.class_id=authInfoAccessExtDefaultImpl <a href="http://policyset.serverCertSet.5.default.name">policyset.serverCertSet.5.default.name</a>=AIA Extension Default policyset.serverCertSet.5.default.params.authInfoAccessADEnable_0=true policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_0=URIName policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0= policyset.serverCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1 policyset.serverCertSet.5.default.params.authInfoAccessCritical=false policyset.serverCertSet.5.default.params.authInfoAccessADEnable_1=true policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_1=URI policyset.serverCertSet.5.default.params.authInfoAccessADLocation_1=<a href="http://server1/cert1.crt">http://server1/cert1.crt</a> policyset.serverCertSet.5.default.params.authInfoAccessADMethod_1=1.3.6.1.5.5.7.48.2 policyset.serverCertSet.5.default.params.authInfoAccessADEnable_2=true policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_2=URI policyset.serverCertSet.5.default.params.authInfoAccessADLocation_2=<a href="http://server2/cert2.crt">http://server2/cert2.crt</a> policyset.serverCertSet.5.default.params.authInfoAccessADMethod_2=1.3.6.1.5.5.7.48.2 policyset.serverCertSet.5.default.params.authInfoAccessADEnable_3=true policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_3=URI policyset.serverCertSet.5.default.params.authInfoAccessADLocation_3=ldap:///CN=someconnectionstring policyset.serverCertSet.5.default.params.authInfoAccessADMethod_3=1.3.6.1.5.5.7.48.2 policyset.serverCertSet.5.default.params.authInfoAccessCritical=false policyset.serverCertSet.5.default.params.authInfoAccessNumADs=4 </div>What happens in dogtag is that the first field is filled out with values, but there are empty records following like so : Record #0 Method:1.3.6.1.5.5.7.48.1 Location Type:URIName Location:<a href="http://dogtaginstance:8080/ca/ocsp">http://dogtaginstance:8080/ca/ocsp</a> Enable:true Record #1 Method: Location Type: Location: Enable:false Record #2 Method: Location Type: Location: Enable:false Record #3 Method: Location Type: Location: Enable:false </div>And i have to fill them out manually. Then the fields get passed to the certificate. What could possibly be wrong here? </div><div class="gmail_extra"> <div class="gmail_quote">2016-01-14 19:36 GMT+01:00 John Magne <<a href="mailto:jmagne@redhat.com" target="_blank">jmagne@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Here is an example in the file we ship DomainController.cfg There are others in the directory /var/lib/pki/pki-tomcat/ca/profiles/ca if you need more: policyset.set1.5.default.class_id=authInfoAccessExtDefaultImpl <a href="http://policyset.set1.5.default.name" rel="noreferrer" target="_blank">policyset.set1.5.default.name</a>=AIA Extension Default policyset.set1.5.default.params.authInfoAccessADEnable_0=true policyset.set1.5.default.params.authInfoAccessADLocationType_0=URIName policyset.set1.5.default.params.authInfoAccessADLocation_0=<a href="http://localhost.localdomain:9180/ca/ee/ca/getCRL?crlIssuingPoint=MasterCRL&op=getCRL&crlDisplayType=cachedCRL&submit=Submit" rel="noreferrer" target="_blank">http://localhost.localdomain:9180/ca/ee/ca/getCRL?crlIssuingPoint=MasterCRL&op=getCRL&crlDisplayType=cachedCRL&submit=Submit</a> policyset.set1.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.2 policyset.set1.5.default.params.authInfoAccessCritical=false policyset.set1.5.default.params.authInfoAccessNumADs=1 <div><div class="h5"> ----- Original Message ----- > From: "marcin kowalski" <<a href="mailto:yoshi314@gmail.com">yoshi314@gmail.com</a>> > To: <a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a> > Sent: Thursday, January 14, 2016 5:00:56 AM > Subject: [Pki-users] [dogtag] CA Issuers fields in authinfoaccess extension - how? > > Hi all ; I am running a subordinate ca dogtag instance, and i would like to > copy AuthInfoExtension fields from the master ca cert into final > certificates signed in dogtag > > I am struggling to add a few caIssuers fields to authInfoExtension fields in > issued certificates > > the fields in question are to be like so (from openssl output of the master > ca certificate) > > CA Issuers - URI: <a href="http://server/name.crt" rel="noreferrer" target="_blank">http://server/name.crt</a> > CA Issuers - URI: <a href="http://backupserver/name.crt" rel="noreferrer" target="_blank">http://backupserver/name.crt</a> > > > Are there any examples out there so that i can figure this out? > </div></div>> _______________________________________________ > Pki-users mailing list > <a href="mailto:Pki-users@redhat.com">Pki-users@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/pki-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/pki-users</a> </blockquote></div> </div>