[Pki-users] Creating a sub-ca under an external CA?

[Michael StJohns]

On 4/4/2010 6:37 PM, Arshad Noor wrote:
> I believe your problem may be due to the fact that your self-signed
> Root CA certificate does not contain the AuthorityKeyIdentifier (AKI)
> extension - it only has the SubjectKeyIdentifier (SKI) extension.
>
I tried issuing a new root cert with the AKI (and then doing a rebuild 
of the whole CA) - no luck. But thanks for the suggestion.

But - I did find out why my chain wasn't being accepted.  It turns out 
that even though step 3 requires an armored Base64 value (e.g. 
-----BEGIN CERTIFICATE----- -----END CERTIFICATE-----), step 2 only 
wants the unarmored Base64 value of the PKCS7 chain object.  It also 
doesn't appear to care whether or not the chain contains the new CA 
certificate for this instance.  At least now the certs are ending up in 
the database even if the chains still don't seem to work.

I'm going to - tomorrow - try and replicate exactly the extensions and 
settings as generated for Root and CA that are wholly Dogtag in certs 
that I genrate.  It shouldn't be this difficult.  Part of the issue is 
that there isn't enough feedback or checking for this branch of the 
setup scripts...

When I do "certutil -V -u V -d . -n "Server-Cert <instance>" in the 
<instance>/alias directory I still get a

certutil -V -u V -d . -n "Server-Cert cert-fake"
certutil: certificate is invalid: Peer's Certificate issuer is not 
recognized.

Mike