[Pki-users] Certificate Policies

Wed Apr 24 17:19:02 UTC 2019

Hi, thanks for your answer

- in the profile, that policyset.caCertSet.list has p7                *DONE*
- the CA was restarted after the custom profile changes       *DONE*
- debug log   *DONE?*
[24/Apr/2019:12:45:33][http-bio-8443-exec-1]: RequestProcessor:
profileId=caClase1
[24/Apr/2019:12:46:29][localhost-startStop-1]: Start Profile Creation -
caClase1 caEnrollImpl com.netscape.cms.profile.common.CAEnrollProfile
[24/Apr/2019:12:46:29][localhost-startStop-1]: Done Profile Creation -
caClase1
[24/Apr/2019:12:46:29][localhost-startStop-1]: Registered Confirmation -
caClase1

Also looked for more logs...
I see and XML section for some reason i see this in the XML
<description>This default populates a Certificate Policies Extension to the
request. The default values are Criticality=true,
{PoliciesExt.num:1,{Enable:true,Policy
Id:1.3.6.1.4.1.6.1.1.1.1,PolicyQualifiers.num:,{CPSuri
Enable:true,UserNotice Enable:true,UserNoticeReference Organization:Company
text Here,UserNoticeReference Numbers:1,UserNoticeReference Explicit
Text:Some Text Here,CPS uri:http://url.com/}}}</description>

*BUTTTTT, if i go down in the file i see*
PoliciesExt.certPolicy0.enable:true&#xD;
PoliciesExt.certPolicy0.policyId:1.3.6.1.4.1.6.1.1.1.1&#xD;
PoliciesExt.certPolicy0.PolicyQualifiers.num:1&#xD;
PoliciesExt.certPolicy0.PolicyQualifiers0.CPSURI.enable:true&#xD;
PoliciesExt.certPolicy0.PolicyQualifiers0.CPSURI.value:http://url.com/&#xD;
PoliciesExt.certPolicy0.PolicyQualifiers0.usernotice.enable:*false*&#xD;
PoliciesExt.certPolicy0.PolicyQualifiers0.usernotice.noticeReference.organization:&#xD;
PoliciesExt.certPolicy0.PolicyQualifiers0.usernotice.noticeReference.noticeNumbers:&#xD;
PoliciesExt.certPolicy0.PolicyQualifiers0.usernotice.explicitText.value:&#xD;

*The last 3 lines are EMPTY.*

Jonathan Montero

IT Professional | IT Trainer
M: 809-609-3003
S: tuxmontero
E: jmrxto at gmail.com
A: Santo Domingo, DR

jonathanmontero.com

<https://www.linkedin.com/in/monterojonathan>
<https://twitter.com/tuxmontero> <https://www.facebook.com/jmrxto>
<https://github.com/tuxmontero>

On Wed, Apr 24, 2019 at 12:26 PM Marc Sauton <msauton at redhat.com> wrote:

> make sure:
> - in the profile, that policyset.caCertSet.list has p7
> - the CA was restarted after the custom profile changes
> - a review of the CA debug log, the profile you modified should be listed
> after a restart as, for example:
> [14/Feb/2019:00:30:49][localhost-startStop-1]: added plugin profile
> caServerCertEnrollImpl Server Certificate Enrollment Profile Certificate
> Authority Server Certificate Enrollment Profile
> com.netscape.cms.profile.common.ServerCertCAEnrollProfile
> [14/Feb/2019:00:31:43][localhost-startStop-1]: added plugin profile
> caServerCertEnrollImpl Server Certificate Enrollment Profile Certificate
> Authority Server Certificate Enrollment Profile
> com.netscape.cms.profile.common.ServerCertCAEnrollProfile
> [14/Feb/2019:00:31:45][localhost-startStop-1]: Start Profile Creation -
> caServerCert caEnrollImpl com.netscape.cms.profile.common.CAEnrollProfile
> [14/Feb/2019:00:31:45][localhost-startStop-1]: Done Profile Creation -
> caServerCert
> [14/Feb/2019:00:31:45][localhost-startStop-1]: Registered Confirmation -
> caServerCert
> and between the "Start" and "Done", there should be the details of the
> profile, with string "BasicProfile: createProfilePolicy" and more info
> - review the same debug log after enrollment, for more details.
> Thanks,
> Marc S.
>
> On Tue, Apr 23, 2019 at 9:23 PM Jonathan Montero <jmrxto at gmail.com> wrote:
>
>> Hi, I'm having an issue regarding the certificates policies.
>>
>> It is as follows...
>> policyset.caCertSet.p7.constraint.class_id=noConstraintImpl
>> policyset.caCertSet.p7.constraint.name=No Constraint
>> policyset.caCertSet.p7.default.class_id=certificatePoliciesExtDefaultImpl
>> policyset.caCertSet.p7.default.name=Certificate Policies Extension
>> Default
>> policyset.caCertSet.p7.default.params.Critical=true
>> policyset.caCertSet.p7.default.params.PoliciesExt.num=1
>> policyset.caCertSet.p7.default.params.PoliciesExt.certPolicy0.enable=true
>>
>> policyset.caCertSet.p7.default.params.PoliciesExt.certPolicy0.policyId=1.3.6.1.4.1.6.1.1.1.1
>>
>> policyset.caCertSet.p7.default.params.PoliciesExt.certPolicy0.PolicyQualifiers0.CPSURI.enable=true
>>
>> policyset.caCertSet.p7.default.params.PoliciesExt.certPolicy0.PolicyQualifiers0.CPSURI.value=
>> http://url.com/
>>
>> policyset.caCertSet.p7.default.params.PoliciesExt.certPolicy0.PolicyQualifiers0.usernotice.enable=true
>> policyset.caCertSet.p7.default.params.PoliciesExt.certPolicy0.PolicyQualifiers0.usernotice.explicitText.value=Some
>> Text Here
>>
>> policyset.caCertSet.p7.default.params.PoliciesExt.certPolicy0.PolicyQualifiers0.usernotice.noticeReference.noticeNumbers=1
>> policyset.caCertSet.p7.default.params.PoliciesExt.certPolicy0.PolicyQualifiers0.usernotice.noticeReference.organization=Company
>> text Here
>>
>>
>> So, with this configuration i got not all the result i want, don't know
>> why....
>>
>> i obtain
>> policyId=1.3.6.1.4.1.6.1.1.1.1
>>
>> Also
>> CPSURI.value=http://url.com/
>>
>> But can't get the explicitText.value and organization...
>>
>> For some reason, those 2 latter options don't appear in the certificate.
>>
>> What could this be?
>>
>>
>>
>>
>> Jonathan Montero
>>
>> IT Professional | IT Trainer
>> M: 809-609-3003
>> S: tuxmontero
>> E: jmrxto at gmail.com
>> A: Santo Domingo, DR
>>
>> jonathanmontero.com
>>
>> <https://www.linkedin.com/in/monterojonathan>
>> <https://twitter.com/tuxmontero> <https://www.facebook.com/jmrxto>
>> <https://github.com/tuxmontero>
>>
>> _______________________________________________
>> Pki-users mailing list
>> Pki-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/pki-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/pki-users/attachments/20190424/e43590d8/attachment.htm>