Hi, sorry, I just noticed the question after Dalini wrote the answer...
>> cmds->scepCheckRequest: renewal allowed >> cmds->scepCheckRequest: multiple certificates matched this request, not >> yet implemented > >> It looks like SCEP beleives that a certificate already matches the >> request. Any idea where I can look?? >> > cmds->scepCheckRequest: multiple certificates matched this request, not > yet implemented The function you are using is "renewal". I wanted to do the following when receiving a request for an already existing cert, use the data of this certicate as a template for the new one (in particular Role and RA, which is not contained in the cert request itself, in addition a future version should extract e. g. SubjectAltNames from the existing certs and add them to the new cert request). This is easy if only one single previous certificate exists: use this certificate as template. What has happened here is that the SCEP interface has identified that there are multiple (valid) certificates with the matching DN. Currently it does not know how to handle this: which certificate should be chosen as template for the new request? I think the correct reaction might be to determine the certificate with the latest NotBefore (NotAfter?) date and use this as a reference for the newly received request. If you need this feature, I could implement it. We will need this in our project, too. > a seconde problem with this could be the openssl, since in the 0.9.7 > series openssl doesn't support issuing of certificates with the same dn > either (micha wrote a patch for the c version, this can be adopted for > later version with some minor changes, and its a quite small patch, so > not to much effort) It's not OpenSSL, this is clearly caused by ambiguity in the OpenCA database. Martin ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_ide95&alloc_id396&op=click _______________________________________________ Openca-Users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openca-users
