[Pki-users] getting NEED_TO_NOTIFY_ISSUED_SAVE_FAILED with dogtag-submit

[Steve Neuharth]

Yes, very observant. I noticed that as well. The difference was that
client.pem had some bag information in it:





*Bag Attributes    friendlyName: PKI Administrator for test.org
<http://test.org>    localKeyID: 4F E5 46 3D foo 64 1F
E4subject=/O=test.org <http://test.org> Security
Domain/emailAddress=caadmin at test.org/CN=PKI
<http://caadmin@test.org/CN=PKI> Administratorissuer=/O=test.org
<http://test.org> Security Domain/CN=CA Signing Certificate*
while cert.pem does not. otherwise, they contain the same cert data.

--password was just in there because it was in my command history, I have
since stripped the password off of the key (openssl --norsa) and curl does
work without the --password switch.

I'm actually planning on using automatically approved certs eventually and
so it is my desire to use either username/password or cert/key
authentication to facilitate that. I just noticed that the dogtag-submit
does not seem to use my cert/key pair when I specify them.

Does certificate authentication work for you in dogtag-submit?

On Tue, Apr 7, 2015 at 2:22 PM, Nalin Dahyabhai <nalin at redhat.com> wrote:

> On Tue, Apr 07, 2015 at 01:58:24PM -0500, Steve Neuharth wrote:
> > HA! yep, re-requesting the cert using version 0.77.1 solved this... I can
> > request a cert and after a manual approval, I'm able to download and
> > monitor the cert. THANK YOU!
> >
> > I'm also having another problem. When I try to use dogtag-submit like
> this:
> >
> > */usr/libexec/certmonger/dogtag-submit -E
> > https://dogtag.test.org:8443/ca/ee/ca
> > <https://dogtag.test.org:8443/ca/ee/ca> -A
> > https://dogtag.test.org:8443/ca/agent/ca
> > <https://dogtag.test.org:8443/ca/agent/ca> -T caAgentServerCert -i
> > /tmp/test/ca.crt -c /tmp/test/cert.pem -k /tmp/test/key.pem*
> >
> > I get this:
> >
> > *Request ID '20150404113812':        status: CA_REJECTED        ca-error:
> > Server at "https://dogtag.test.org:8443/ca/ee/ca/profileSubmit
> > <https://dogtag.test.org:8443/ca/ee/ca/profileSubmit>" replied: Invalid
> > Credential.        stuck: yes        key pair storage:
> > type=FILE,location='/etc/ssl/get2cert.key'        certificate:
> > type=FILE,location='/etc/ssl/get2cert.crt'        CA: DogtagAuto
> > issuer:        subject:        expires: unknown        pre-save
> > command:        post-save command:        track: yes        auto-renew:
> yes*
> > however, when I use curl like this:
> >
> > *curl
> > "
> https://dogtag.test.org:8443/ca/ee/ca/profileSubmit?profileId=caAgentServerCert&cert_request_type=pkcs10&cert_request=-----BEGINTE+REQUEST-----%0AMIIFBjCCAu4CAQAwgYUxGzAZBgNVBAoTElRhcmdldCBDb3Jwb3JhdGlvbjEdMBsG%0AA1UECxMUcjUwOSBJbnRlcm1lZGlhdGUgQ0ExFDASBgNVBAcTC01pbm5lYXBvbGlz%0AMRIwEAYDVQQIEwlNaW5uZXNvdGExCzAJBgNVBAYTAlVTMRAwDgYDVQQDEwdyNTA5%0AIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAodOjRhEbG3mKbZPN%0As7dtJgBHBvGksFBvnVXyK2DuY5%2FE7RayxvroQRG42gs5oiEkT4QaCBJlXfsv6NCp%0AiB7btiO9EGlSGcfofAE1ek0plHlh0wtdVJQLMGqbgeaIF8KjV%2FKVBvOtWFjHLLb3%0A92910oUvUxwNffRSDMaOqyAZHdio8r5xUy8zk6dHmpTAdUPSFcmpLaquohCn2cF7%0AAIS0DQ%2Bi0LDSyN1zhbiOTmgT3RiHL%2F5ajZ83VJf3A08FFxGrNCjWdgokBtG4q0FC%0ADCZscy4TJf7BdhVoYBfAwv2G%2FhYiwu7HLwTScGcuIpkMenObO11rtCHrfasb2uLc%0AC2LAxyQ6ML%2FRE8MGzoNXmRLNYx3RdwTPhF73CnmsLt%2BJCgHC7PbRLSk8b6rS9Q7t%0AX8K2Zyx9caU9YDik0ot7bNH1NKFPJUQlAKJ1UAN%2FOjjgDLSsftlc1aPti0d%2Fi70o%0AlGDTj77Zw4T7vdX1h6F8cZTb3u2SmdO00QHZjxn8wsX9QEB7uCuJIg6a9Ui2XlSZ%0A%2BIEtHUEOGq4AEM24bkToaE1qSTXPjGHI41%2BbuOaPDEisganiupnHAhxptqakbpau%0AXY4%2FXEbPFYCAWZd5%2BBcA7KjbOD2l3v6J2ihmB6fOWSp5o08eOmPVy3dB7pfJwx%2F6%0AnHkLKDyeCwV54R5LabuiPjsimVcCAwEAAaA7MDkGCSqGSIb3DQEJDjEsMCowCQYD%0AVR0TBAIwADAdBgNVHQ4EFgQUYW7uTfOlF%2FmwpgUnTr1mapcS2CQwDQYJKoZIhvcN%0AAQELBQADggIBAJVTFpOE1UMuYxAMdaishs7SSnwFuGi55DI6sHe1nIEenlHe4AgE%0AsoQcfCcHv8RvFmE4BHtYEHyDgNc7mraCNmf1j3lPb3nqe33PiEIA6PdB6hjYNB45%0AvklV3N%2FIsHauVg%2FlAm6pCc7oaCJPqLgBc4eSPJd8xef64DuFVUxLSB1LQ3oTpw2T%0AC4Ydg0GCY7t7gZYWaaf5FIY41dtuXAkud5sxpUWwTgRH%2FO%2BrQNP5x8Uy2SKl2QXv%0AQJMzeRLfHdZyFY2utW9BChdmPD%2B%2FLJNwhr924RgzGty%2FrGK7SIAtj%2FRS6gadB2bV%0Ax6Ii9migA7PWDVi9XYzcGiGt1U5jbRsbGh%2Bie8N5MxIW672XqdPz9ocAFu7gfAws%0AnG7%2BcPOiTiEfivOHQ7HpDcSnD9DW2QHc92UzB3tl6vQQ7oQgI1YMtF30D7lOyL8C%0AQ8TcA5fQsVasMhaW78FSaIzJtEWjeQpyg8XCjNtB4Cz4txNaig6YdNer6kFoYiPh%0A5UNVH%2BmeFjJn1fhKq8Imyy6MwHHaZTDsU8I3uUGo6xyIPgKMkLrFsDSo8BumLUGJ%0A56hxNQGixzsO%2B1lIahjBr79Aevzb48l6woMeQBYfLNLKTm290BKXsVgrif19XQ3E%0AZgehMupo%2FZyXjY%2BX4YadNEb8kN5d2cvKCsnjO9urHfAiBPnZtZlYZl1Y%0A-----END+CERTIFICATE+REQUEST-----%0A&xml=true
> > --pass password --cacert /tmp/test/ca.crt --key /tmp/test/key.pem --cert
> > /tmp/test/client.pem*
> >
> > I get a valid response.
>
> Hmm, those two runs may not be using the same agent credentials.
>
> Is there a difference between the cert.pem that's being passed to
> dogtag-submit and the client.pem that's passed to curl?
>
> If the private key (key.pem) is encrypted, and curl is being passed the
> encryption password for it using its --pass option, dogtag-submit
> probably needs a -P or -p option to provide it with the same value.
>
> Alternately, if you're going to do manual approval at the server, you
> can skip the -A, -c, and -k flags when you run dogtag-submit, and it'll
> just poll periodically until the CA tells it that the request was either
> approved or rejected.
>
> HTH,
>
> Nalin
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/pki-users/attachments/20150407/8ac510b1/attachment.htm>