Hi everyone,
(please CC on reply, as I am not yet subscribed)
I am currently using gpgsm as somekind of PKI CA. It allows me to keep
the CA private key stored on a smartcard, and create/sign different
X.509 end-entity certs through the --gen-key --batch mode.
ATM (with gpgsm (GnuPG) 2.2.4) , due to [1], gpgsm cannot sign
certificate for which a public key has been imported but without an
associated private key to it (disregarding the self-signing situation):
[--gen-key --batch]
gpgsm: line 1: error getting key by keygrip 'D3513A1E...48E0BDB6D35': No
such file or directory
gpgsm: error creating certificate request: No such file or directory
<GPG Agent>
unable to load certificate
Typical X.509 PKI setups do not require the CA to have access to the
entity private key for issuing a corresponding X.509 certificate. I
still manage to fake that around by creating a corresponding private key
file with the correct keygrip under private-keys-v1.d/ , but this is at
best a really dirty hack.
Would it make sense to relax the test in [1] and allow certificate
creation when we are not issuing a self-sign cert?
Thanks,
[1] https://github.com/gpg/gnupg/blob/master/sm/certreqgen.c#L712
--
Jean-Yves Migeon
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
