One of the things I would like to do with my OpenCA is automate certificate 
management on some of our unix (Linux/Solaris) servers.

The OpenCA installation (Mandriva 2006.0 using packages in the distribution) 
is working fine, and I have issued certs for VPN access etc using it.

openca-scep doesn't seem the best tool to use for this (it seems that a lot of 
scripting would be required). I tried with autosscep 
(http://autosscep.spe.net/), which has apparently been tested with OpenCA in 
the past, and it seems (mostly) to succeed:


# autosscep autosscep.conf
autosscep: Reading config file
        host: ra.telkomsa.net
        port: 80
        dir: /cgi-bin/openca/scep/scep
autosscep: cannot open local file: '/etc/ssl/cacert.pem'
autosscep: CA file missing, trying request reom server
autosscep: requesting CA certificate
autosscep: scep msg: 
GET /cgi-bin/openca/scep/scep?operation=GetCACert&message=CAIdentifier 
HTTP/1.0
Host: ra.telkomsa.net

autosscep: server returned status code 200
autosscep: MIME header: application/x-x509-ca-ra-cert
autosscep: valid response from server (reply: 3)

autosscep: n.0 -> found certificate with
  subject: /C=ZA/O=TelkomInternet/OU=Build Team/CN=TelkomInternet Root 
CA/[EMAIL PROTECTED]
autosscep: cannot open local file: '/etc/ssl/certs/jabber.pem'
Certificate Sign, CRL Signautosscep: Checking config file values
autosscep: Signature algorithm specified: sha1
autosscep: starting autoscep, version 0.9.28b  20 September 2004
autosscep: Checking certificate -- > jabber.pem
autosscep: Certificate jabber.pem is going to expire (or is missing)
autosscep: Looking for the CA data
autosscep: CA founded!!
autosscep: Starting certificate enrollment for -- > jabber.pem
autosscep: New request
autosscep: Creating request FROM CONFIG FILE DATA data for 'jabber.pem'
Certificate Request:
    Data:
        Version: 3 (0x3)
        Subject: C=ZA, ST=Gauteng, L=Centurion, O=Telkom Internet, OU=Build 
Team, CN=telkomsa.net/[EMAIL PROTECTED]
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:d8:3b:34:00:9e:2b:9a:29:f9:b7:e5:a9:1b:57:
                    0e:3e:54:b4:bd:d4:8f:4a:0f:47:c0:13:a7:2f:2f:
                    b4:57:4a:73:0a:ce:ed:e0:be:23:d8:c6:24:e5:18:
                    4d:3b:bc:e8:09:da:a8:86:4f:52:e9:f1:5f:b6:7b:
                    11:49:97:c8:73:ca:34:ba:de:6b:83:ab:b1:24:36:
                    cd:2f:b2:53:c5:4a:e2:51:e4:5c:ca:40:f7:46:93:
                    37:5d:53:63:47:2d:0c:9e:78:b6:bd:b0:48:80:85:
                    64:33:80:f6:1f:3e:08:dd:c5:a2:bb:87:d6:e7:42:
                    d6:1c:b1:85:9a:c0:77:d9:c9
                Exponent: 65537 (0x10001)
        Attributes:
        Requested Extensions:
            X509v3 Key Usage:
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Basic Constraints: critical
                CA:FALSE
            Netscape Cert Type:
                SSL Server
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            Netscape Comment:
                Web Server
    Signature Algorithm: sha1WithRSAEncryption
        7d:df:c9:b5:8f:82:48:aa:c2:d5:25:c8:6d:3d:c3:f5:e2:5f:
        44:1a:1b:f8:4c:fc:bf:ad:fa:10:3e:ef:1e:89:56:4c:e4:a3:
        fd:90:86:c8:c5:b9:38:60:b3:49:7a:8d:5c:97:1d:28:ae:a8:
        4d:b6:15:70:3d:a1:4c:9f:f1:57:04:54:3c:09:b3:3d:27:0e:
        60:0e:7a:cb:65:14:d9:6d:f6:4a:61:a7:79:25:c8:11:f3:e1:
        e7:78:4a:a3:b9:95:d0:f8:da:8b:67:0c:4d:f1:65:15:62:dc:
        00:92:e9:9f:f6:4f:f4:e1:13:92:20:8d:ec:29:5f:3c:72:a7:
        1f:42
autosscep: generating selfsigned certificate
autosscep: sending certificate request
autosscep: transaction_ID = 9ED1FF2A39914185BDCE81FC8AD0F232
autosscep: creating inner PKCS#7
autosscep: data payload size: 598 bytes
Segmentation fault (core dumped)




When I log into the CA interface, I don't see the request. I have seen 
requests arrive in the CSR page, but in that case the requests don't seem to 
have any of the information (eg subjectDN) that is present in the .csr file 
on the client (generated by autosscep).

Has anyone got this setup working?

Current versions:
openca-common-0.9.2.2-2mdk
openca-doc-0.9.2.2-2mdk
openca-ocspd-1.0.3-3mdk
openca-scep-0.9.2-4mdk
openca-sv-0.9.94-6mdk
openca-web-interfaces-ca-0.9.2.2-2mdk
openca-web-interfaces-ldap-0.9.2.2-2mdk
openca-web-interfaces-node-0.9.2.2-2mdk
openca-web-interfaces-pub-0.9.2.2-2mdk
openca-web-interfaces-ra-0.9.2.2-2mdk
openca-web-interfaces-scep-0.9.2.2-2mdk
perl-OpenCA-AC-0.9.60.2.3-2mdk
perl-OpenCA-Configuration-1.5.3-4mdk
perl-OpenCA-CRL-0.9.24-2mdk
perl-OpenCA-Crypto-0.9.14-2mdk
perl-OpenCA-DB-2.0.5-5mdk
perl-OpenCA-DBI-0.9.115.2.5-2mdk
perl-OpenCA-LDAP-0.9.11-2mdk
perl-OpenCA-Log-0.9.14-2mdk
perl-OpenCA-OpenSSL-0.9.135.2.4-2mdk
perl-OpenCA-PKCS7-0.9.19-3mdk
perl-OpenCA-REQ-0.9.61-3mdk
perl-OpenCA-Session-0.9.7-2mdk
perl-OpenCA-StateMachine-0.9.6-5mdk
perl-OpenCA-Tools-0.4.3-5mdk
perl-OpenCA-TRIStateCGI-1.5.5-5mdk
perl-OpenCA-UI-HTML-0.9.23-2mdk
perl-OpenCA-X509-0.9.57-2mdk
perl-OpenCA-XML-Cache-0.9.14-2mdk



Regards,
Buchan


-- 
Buchan Milne
ISP Systems Specialist
B.Eng,RHCE(803004789010797),LPIC-2(LPI000074592)

Attachment: pgpVLgOywWPv3.pgp
Description: PGP signature

Reply via email to