<div dir="ltr">How do you modify your profile? I've followed the redhat documentation and stuff doesn't work. As such I feel like I'm missing something based on how you are talking.<div><br></div><div>How do you submit new requests? Through the Web UI or command line with the pki command? <div><br></div><div>If via the WebUI does the agents page change when you change the profile configurations? </div><div><br></div><div>Thanks</div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, 17 Nov 2016 at 08:08 Supper Florian 6342 sIT <<a href="mailto:Florian.Supper@s-itsolutions.at">Florian.Supper@s-itsolutions.at</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="DE-AT" link="blue" vlink="purple" class="gmail_msg">
<div class="m_-7288392998828887005WordSection1 gmail_msg">
<p class="MsoNormal gmail_msg"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d" class="gmail_msg">Hi Ian,<u class="gmail_msg"></u><u class="gmail_msg"></u></span></p>
<p class="MsoNormal gmail_msg"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d" class="gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></span></p>
<p class="MsoNormal gmail_msg"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d" class="gmail_msg">There is an redhat documentation available for dogtag version 8 and 9. They might help you.<u class="gmail_msg"></u><u class="gmail_msg"></u></span></p>
<p class="MsoNormal gmail_msg"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d" class="gmail_msg">In my case, I mostly copy an existing profile and made the changes I’ve need in the copied one.<u class="gmail_msg"></u><u class="gmail_msg"></u></span></p>
<p class="MsoNormal gmail_msg"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d" class="gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></span></p>
<p class="MsoNormal gmail_msg"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d" class="gmail_msg">BR<u class="gmail_msg"></u><u class="gmail_msg"></u></span></p>
<p class="MsoNormal gmail_msg"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d" class="gmail_msg">Florian<u class="gmail_msg"></u><u class="gmail_msg"></u></span></p>
<p class="MsoNormal gmail_msg"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d" class="gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></span></p>
<p class="MsoNormal gmail_msg"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d" class="gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></span></p>
<p class="MsoNormal gmail_msg"><b class="gmail_msg"><span lang="DE" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"" class="gmail_msg">Von:</span></b><span lang="DE" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"" class="gmail_msg"> Ian Koenig [mailto:<a href="mailto:iguy@ionsphere.org" class="gmail_msg" target="_blank">iguy@ionsphere.org</a>]
<br class="gmail_msg">
<b class="gmail_msg">Gesendet:</b> Dienstag, 15. November 2016 19:57<br class="gmail_msg">
<b class="gmail_msg">An:</b> Supper Florian 6342 sIT; Ian Koenig; <a href="mailto:pki-users@redhat.com" class="gmail_msg" target="_blank">pki-users@redhat.com</a><br class="gmail_msg">
<b class="gmail_msg">Betreff:</b> Re: [Pki-users] SubjectAltName - how?<u class="gmail_msg"></u><u class="gmail_msg"></u></span></p></div></div><div lang="DE-AT" link="blue" vlink="purple" class="gmail_msg"><div class="m_-7288392998828887005WordSection1 gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg">Thanks Supper. Is there a clear documentation on how to create a new certificate profile that is visible via the WebUI?<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg">I tried this process:<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg">1) pki -C client_password.txt -n caadmin ca-server-show --output caServerSANCert.cfg --raw caServerCert<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"> a) Add in the lines you specified above to caServerSANCert.cfg<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"> b) Update the line profileID to be caServerSANCert<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg">4) pki -C client_password.txt -n caadmin ca-profile-add --raw caServerSANCert.cfg<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg">5) Approve this new profile.<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg">What happens when I attempt to issue a cert request via the WebUI, there are no inputs for me to fill in like the default caServerCert profile. Just some text about Cert profile and description, then Inputs in bold and a Submit button.
<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg">Thanks<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg">ian<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<div class="gmail_msg">
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
</div>
</div>
<p class="MsoNormal gmail_msg"><u class="gmail_msg"></u> <u class="gmail_msg"></u></p>
<div class="gmail_msg">
<div class="gmail_msg">
<p class="MsoNormal gmail_msg">On Tue, 15 Nov 2016 at 03:22 Supper Florian 6342 sIT <<a href="mailto:Florian.Supper@s-itsolutions.at" class="gmail_msg" target="_blank">Florian.Supper@s-itsolutions.at</a>> wrote:<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm" class="gmail_msg">
<p class="MsoNormal gmail_msg">Hi,<br class="gmail_msg">
You have to add the following lines into your certificate profile..<br class="gmail_msg">
<br class="gmail_msg">
policyset.ServerProfile.10.constraint.class_id=noConstraintImpl<br class="gmail_msg">
<a href="http://policyset.ServerProfile.10.constraint.name" class="gmail_msg" target="_blank">policyset.ServerProfile.10.constraint.name</a>=No Constraint<br class="gmail_msg">
policyset.ServerProfile.10.constraint.subjAltNameExtCritical=false<br class="gmail_msg">
policyset.ServerProfile.10.default.class_id=userExtensionDefaultImpl<br class="gmail_msg">
<a href="http://policyset.ServerProfile.10.default.name" class="gmail_msg" target="_blank">policyset.ServerProfile.10.default.name</a>=User Supplied Extension Default<br class="gmail_msg">
policyset.ServerProfile.10.default.params.userExtOID=2.5.29.17<br class="gmail_msg">
<br class="gmail_msg">
Then the SAN's will be added to the certificate.<br class="gmail_msg">
<br class="gmail_msg">
BR<br class="gmail_msg">
Florian<br class="gmail_msg">
<br class="gmail_msg">
-----Ursprüngliche Nachricht-----<br class="gmail_msg">
Von: <a href="mailto:pki-users-bounces@redhat.com" class="gmail_msg" target="_blank">pki-users-bounces@redhat.com</a> [mailto:<a href="mailto:pki-users-bounces@redhat.com" class="gmail_msg" target="_blank">pki-users-bounces@redhat.com</a>] Im Auftrag von Ian Koenig<br class="gmail_msg">
Gesendet: Montag, 14. November 2016 19:18<br class="gmail_msg">
An: <a href="mailto:pki-users@redhat.com" class="gmail_msg" target="_blank">pki-users@redhat.com</a><br class="gmail_msg">
Betreff: [Pki-users] SubjectAltName - how? [bayes][heur][html-removed]<br class="gmail_msg">
<br class="gmail_msg">
Hi all,<br class="gmail_msg">
<br class="gmail_msg">
I have Dogtag 10 . 3 . 3 installed from COPR (at)pki effort onto a CentOS 7 . 2<br class="gmail_msg">
(build 1511) system.<br class="gmail_msg">
<br class="gmail_msg">
I can request and approve various different certs through the system<br class="gmail_msg">
successfully and have it working properly with SSL client certificates in<br class="gmail_msg">
Chrome.<br class="gmail_msg">
<br class="gmail_msg">
What I haven't been able to figure out is how to generate a server SSL Cert<br class="gmail_msg">
that has SubjectAltName entries in it. An example cnf file I have tried<br class="gmail_msg">
is<br class="gmail_msg">
<br class="gmail_msg">
[ . . . ]<br class="gmail_msg">
[ v3_req ]<br class="gmail_msg">
<br class="gmail_msg">
# Extensions to add to a certificate request<br class="gmail_msg">
<br class="gmail_msg">
basicConstraints = CA : FALSE<br class="gmail_msg">
keyUsage = nonRepudiation, digitalSignature, keyEncipherment<br class="gmail_msg">
subjectAltName = (at)alt_names<br class="gmail_msg">
<br class="gmail_msg">
[ alt_names ]<br class="gmail_msg">
DNS . 1 = demo . myhome . com<br class="gmail_msg">
DNS . 2 = demo<br class="gmail_msg">
DNS . 3 = demo . prod . myhome . com<br class="gmail_msg">
<br class="gmail_msg">
[ . . . ]<br class="gmail_msg">
<br class="gmail_msg">
This generates a valid CSR with the SubjectAltNames in it. However when I<br class="gmail_msg">
send it through to be approved on Dogtag, the SAN gets removed. How do I<br class="gmail_msg">
setup a profile in Dogtag to allow this CSR with SAN get approved?<br class="gmail_msg">
<br class="gmail_msg">
Thanks<br class="gmail_msg">
ian<br class="gmail_msg">
_______________________________________________<br class="gmail_msg">
Pki-users mailing list<br class="gmail_msg">
Pki-users(at)redhat . com<br class="gmail_msg">
https : / / www . redhat . com / mailman / listinfo / pki-users<u class="gmail_msg"></u><u class="gmail_msg"></u></p>
</blockquote>
</div>
</div></div></blockquote></div>