problem still persists. I turned on some debugging stuff on Cisco 836, which tells some interesting things:
% Time to Re-enroll trust_point ca.taunusstein.net%
% Start certificate enrollment ..
% The fully-qualified domain name in the certificate will be: t-dsl.cf.cfvpn
% The subject name in the certificate will be: t-dsl.cf.cfvpn
% The serial number in the certificate will be: 53233907
% The IP address in the certificate is 192.168.0.244
% Certificate request sent to Certificate Authority
% The certificate request fingerprint will be displayed.
% The 'show crypto pki certificate' command will also show the fingerprint.
Apr 26 16:31:49.404: CRYPTO_PKI: Sending CA Certificate Request:
GET /cgi-bin/scep/pkiclient.exe?operation=GetCACert&message=ca.taunusstein.net HTTP/1.0
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Cisco PKI)
Apr 26 16:31:49.408: CRYPTO_PKI: http connection opened
Apr 26 16:31:49.560: CRYPTO_PKI: HTTP response header:
HTTP/1.1 200 OK
Date: Mon, 26 Apr 2004 16:31:49 GMT
Server: Apache/1.3.29 (Debian GNU/Linux)
Set-Cookie: CGISESSID=f5471353bc2ee9a5bad9438996a89690; path=/
Connection: close
Content-Type: application/x-x509-ca-ra-cert
Content-Type indicates we have received CA and RA certificates.
Apr 26 16:31:49.560: CRYPTO_PKI:crypto_process_ca_ra_cert(trustpoint=ca.taunusstein.net)
Apr 26 16:31:49.732: The PKCS #7 message contains 1 certificates.
Apr 26 16:31:49.740: CRYPTO_PKI: transaction PKCSReq completed
Apr 26 16:31:49.740: CRYPTO_PKI: status:
Apr 26 16:31:49.884: CRYPTO_PKI:Write out pkcs#10 content:315
30 82 01 37 30 81 E2 02 01 00 30 4C 31 4A 30 0F
<hex stuff deleted>
58 E1 56 A1 C8 29 D5 28 7B B4 2A
Apr 26 16:31:49.920: CRYPTO_PKI: Fingerprint: 7F66FDA0 BBEE46E9 3AC163FA 9DE29996
Apr 26 16:31:49.924:
Apr 26 16:31:49.924: CRYPTO_PKI: status = 0: failed to select RA encrypt cert
Apr 26 16:31:49.924: CRYPTO_PKI:Enveloped Data for trustpoint ca.taunusstein.net...
Apr 26 16:31:50.060: CRYPTO_PKI:Insert Selfsigned Certificate:
30 82 01 46 30 81 F1 02 20 35 36 37 39 31 38 30
<hex stuff deleted>
68 BC 9E F0 AE AA D8 1D F0 11
Apr 26 16:31:50.116: E ../cert-c/source/cms.c(78) : Error #707h
Apr 26 16:31:50.116: E SCEPSignMessage(104) : Error #2h
Apr 26 16:31:50.116: CRYPTO_PKI: status = 1799: failed to sign the data
Apr 26 16:31:50.116: CRYPTO_PKI: status = 65535: PKCS7 wrapping failed.
Apr 26 16:31:50.120: CRYPTO_PKI: status = 0: failed to create pkcsreq message
Apr 26 16:31:50.120: CRYPTO_PKI: status = 65535: fail to send out pkcsreq
t-dsl#
Content type says there is a CA and a RA certificate, but there is a CA certificate only. Later that dump tells it cannot decrypt RA part, which is not enclosed (I think so...)
OpenCA is running with openssl 0.9.7c. Other functions of OpenCA are fully operable, certificates can be requested, approved and issued.
regards
Christian
Michael Bell writes:
should cause openca-sv and openca-scep to fail. The result is that you cannot issue certificates (openca-sv) and SCEP does not work (openca-scep)
------------------------------------------------------- This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek For a limited time only, get FREE Ground shipping on all orders of $35 or more. Hurry up and shop folks, this offer expires April 30th! http://www.thinkgeek.com/freeshipping/?cpg=12297 _______________________________________________ Openca-Users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/openca-users
