<div dir="ltr"><div class="gmail_default" style="font-size:small">Yes, I think the uid is caadmin too. I didn't do the installation, but I inherit the config file used during installation, which lists among other things, the values of pki_admin_uid, pki_admin_password, and pki_client_pkcs12_password.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">After digging around some more, I found this page about how to setup a new CA admin:</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style=""><a href="http://pki.fedoraproject.org/wiki/CA_Admin_Setup">http://pki.fedoraproject.org/wiki/CA_Admin_Setup</a><br></div><div class="gmail_default" style=""><br></div><div class="gmail_default" style="">But when I execute the following command (replacing CA Admin password and nickname appropriately from the values in config file):<br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="">pki -c <CA admin password> -n <CA admin nickname> ca-user-add newcaadmin --fullName "CA Admin"<br></div><div class="gmail_default" style=""><br></div><div class="gmail_default" style="">I got: ResteasyIOException: IOException</div><div class="gmail_default" style=""><br></div><div class="gmail_default" style="">I think it is because the default CA Admin certificate was not installed into a database. I tried to do that following:</div><div class="gmail_default" style=""><br></div><div class="gmail_default" style=""><a href="http://pki.fedoraproject.org/wiki/Default_CA_Admin">http://pki.fedoraproject.org/wiki/Default_CA_Admin</a><br></div><div class="gmail_default" style=""><br></div><div class="gmail_default" style="">but at the following command (replacing Secret123 with our secret)</div><div class="gmail_default" style=""><br></div><div class="gmail_default" style="">pki -c Secret123 client-cert-import --pkcs12 ~/.dogtag/pki-tomcat/ca_admin_cert.p12 --pkcs12-password ~/.dogtag/pki-tomcat/ca/pkcs12_password.conf<br></div><div class="gmail_default" style=""><br></div><div class="gmail_default" style="">I got: </div><div class="gmail_default" style=""><br></div><div class="gmail_default" style=""><div class="gmail_default">Error: Unrecognized option: --pkcs12</div><div class="gmail_default">usage: client-cert-import [OPTIONS]</div><div class="gmail_default"> --ca-cert <path> Import CA certificate file</div><div class="gmail_default"> --ca-server Import CA certificate from CA server</div><div class="gmail_default"> --cert <path> Import certificate file</div><div class="gmail_default"><br></div><div class="gmail_default">I switched to </div><div class="gmail_default"><br></div><div class="gmail_default">pki -c Secret123 -n caadmin client-cert-import --cert ~/.dogtag/pki-tomcat/ca_admin_cert.p12</div></div><div class="gmail_default" style=""><br></div><div class="gmail_default" style="">to get "Import failed"</div><div class="gmail_default" style=""><br></div><div class="gmail_default" style="">I seem to get stuck at installing either the old cert or the new one. Do you know what the commands are to install cert?</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Apr 25, 2016 at 4:17 PM, John Magne <span dir="ltr"><<a href="mailto:jmagne@redhat.com" target="_blank">jmagne@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I suspect the uid is probably caadmin, which is the default, if you left it that way.<br> <span class="im HOEnZb"><br> ----- Original Message -----<br> From: "Ha T. Lam" <<a href="mailto:hatlam@gmail.com">hatlam@gmail.com</a>><br> </span><div class="HOEnZb"><div class="h5">To: "John Magne" <<a href="mailto:jmagne@redhat.com">jmagne@redhat.com</a>><br> Cc: <a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a><br> Sent: Monday, April 25, 2016 3:12:35 PM<br> Subject: Re: [Pki-users] How to renew the admin certificate<br> <br> Hi John,<br> <br> Thank you very much for your quick reply. I've managed to get ssh -X sorted<br> out because when I typed<br> <br> pkiconsole <a href="https://ca02.mycompany.com:8433/ca" rel="noreferrer" target="_blank">https://ca02.mycompany.com:8433/ca</a><br> <br> I get a dialog box asking for User ID and Password. From our conf file, I<br> put in the pki_admin_uid and pki_admin_password, the dialog box went away,<br> but nothing else happened. I also tried using pki_client_pkcs12_password<br> but with the same result. Looking at the log<br> file /var/log/pki/pki-tomcat/localhost_access_log.2016-04-25.txt, I see<br> <br> "POST /ca/auths HTTP/1.0" 200 27<br> <br> At this point, I'm not sure if it's because I put in the wrong<br> authentication or if I'm still having problem with the pkiconsole. I've<br> been trying to setup vncserver as you recommended but haven't had much luck.<br> <br> I stumbled on the pki commands and it looks like I can use them to install<br> client certificate, are they equivalent to the pkiconsole?<br> <br> Thanks,<br> Ha<br> <br> <br> On Mon, Apr 25, 2016 at 11:10 AM, John Magne <<a href="mailto:jmagne@redhat.com">jmagne@redhat.com</a>> wrote:<br> <br> > Hello:<br> ><br> > Your approach seems reasonable:<br> ><br> > Perhaps you might want to start a vncserver on there and<br> > come in that way. There has been issues with using the console over ssh.<br> ><br> ><br> ><br> ><br> ><br> > ----- Original Message -----<br> > > From: "Ha T. Lam" <<a href="mailto:hatlam@gmail.com">hatlam@gmail.com</a>><br> > > To: <a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a><br> > > Sent: Sunday, April 24, 2016 9:29:07 PM<br> > > Subject: [Pki-users] How to renew the admin certificate<br> > ><br> > > Hi all,<br> > ><br> > > We have a Dog Tag system hosted on Fedora inside a VirtualBox, our admin<br> > > certificate has unfortunately expired, so the web interface complains<br> > that<br> > > the cert is invalid. I've managed to rewind the clock and authorized<br> > myself<br> > > a PKI Administrator certificate following this thread:<br> > ><br> > > <a href="https://www.redhat.com/archives/pki-users/2013-October/msg00008.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/pki-users/2013-October/msg00008.html</a><br> > ><br> > > I'm now trying to import the new certificate into the system. The thread<br> > > mentioned doing it through the pkiconsole, but I have not been able to<br> > get<br> > > it to work, when I typed:<br> > ><br> > > pkiconsole <a href="https://ca02.mycompany.com:8433/ca" rel="noreferrer" target="_blank">https://ca02.mycompany.com:8433/ca</a><br> > ><br> > > I don't get any error message, but I don't see any console either. I<br> > suspect<br> > > this is because I'm ssh-ing into a virtualbox and the display is not set<br> > > correctly.<br> > ><br> > > My questions are:<br> > > 1. Does the process I mentioned above make sense? I'm new to dogtag and<br> > still<br> > > learning about it.<br> > > 2. If I'm on the right track, is there a command line option for<br> > pkiconsole?<br> > ><br> > > Thank you for your help,<br> > > Ha<br> > ><br> > > _______________________________________________<br> > > Pki-users mailing list<br> > > <a href="mailto:Pki-users@redhat.com">Pki-users@redhat.com</a><br> > > <a href="https://www.redhat.com/mailman/listinfo/pki-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/pki-users</a><br> ><br> </div></div></blockquote></div><br></div>