Hi again. :-)
I wrote a small patch for lib/cmds/scepPKIOperation and
lib/funktions/misc-utils.lib and added the necsessary error handling:
~# cd $OPENCADIR/openca/lib/cmds/ && patch scepPKIOperation <
scepPKIOperation.patch
scepPKIOperation.patch:
--- scepPKIOperation.orig 2006-07-14 20:07:56.000000000 +0200
+++ scepPKIOperation 2006-07-14 20:06:58.000000000 +0200
@@ -115,11 +115,11 @@
$ChainDir = getRequired ("ChainDir");
- foreach (qw(ScepAllowEnrollment ScepAllowRenewal ScepDefaultRole
+ foreach my $value (qw(ScepAllowEnrollment ScepAllowRenewal
ScepDefaultRole
ScepDefaultRA ScepRenewalRDNMatch
ScepKeepSubjectAltName ScepAutoApprove)) {
- my $val = getRequired($_);
- eval "\$$_ = \$val";
+ my $val = getRequired($value);
+ eval "\$$value = \$val";
}
$p7_file = getRequired ( 'tempdir' ) . "/scep_pkiOp_$$.p7";
now the scep client gets:
"HTTP/1.1 200 OK\r
Date: Fri, 14 Jul 2006 15:26:04 GMT\r
Server: Apache\r
Set-Cookie: CGISESSID=5491a77b57ebf2c19f9c0c88b042e4fe; path=/\r
Connection: close\r
Content-Type: text/html\r
\r
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";>
<html xmlns="http://www.w3.org/1999/xhtml"; lang="C"
xml:lang="C"><head><title>Configuration Error</title>
</head><body bgcolor="#FFFFFF"><CENTER><BR><HR
WIDTH=80%><BR></CENTER><OL><OL><H1><FONT COLOR=red>Error
690</FONT></H1><OL> <B>Configuration Error</B>. Missing Configuration
Keyword : ScepDefaultRA.</OL></OL></OL>
</PRE><CENTER><HR WIDTH=80%></CENTER>
<FONT SIZE="+0">
</BODY>
</HTML>
"
And for printing it into stderr.log (because the client perhaps isn't
interested in):
~# cd $OPENCADIR/openca/lib/functions && patch misc-utils.lib <
misc-utils.lib.patch
misc-utils.lib.patch:
--- misc-utils.lib.orig 2006-07-14 20:14:15.000000000 +0200
+++ misc-utils.lib 2006-07-14 20:15:06.000000000 +0200
@@ -118,6 +118,7 @@
## If there is an Error, just send the missing
## parameter error to the browser
+ print STDERR "ERROR: Missing Configuration Keyword :
$name\n";
configError( i18nGettext ("Missing Configuration Keyword :
__KEY__", "__KEY__", $name) );
}
if there is a configuration error. Please test it. It works for me.
HTH and a nice Weekend
Ralf
Ralf Hornik Mailings schrieb:
> Dear list,
>
> finally I fixed this problem. After a deep flight into the OpenCA code I
> found the following in openca/lib/cmds/scepPKIOperation:
>
> ---8<---
> ...
> sub cmdscepPKIOperation
> ...
> foreach (qw(ScepAllowEnrollment ScepAllowRenewal ScepDefaultRole
> ScepDefaultRA ScepRenewalRDNMatch
> ScepKeepSubjectAltName ScepAutoApprove)) {
> my $val = getRequired($_);
> eval "\$$_ = \$val";
> }
> ...
> --->8---
>
> I estimate that EACH of the values is required and my scep.conf.template
> shows:
>
> ---8<---
> ## ============== [ General Section ] =========================
>
> ScepAllowEnrollment "YES"
> ScepAllowRenewal "YES"
> ScepKeepSubjectAltName "YES"
>
> ScepRenewalRDNMatch ""
>
> # Defaults for initial enrollment
> ScepDefaultRole "User"
> #ScepDefaultRA "MyRA"
>
> ScepAutoApprove "NO"
> --->8---
>
> 'ScepDefaultRA' was uncommented...so the compilation of
> cmdScepPKIOperation failed. After uncommenting this value the compilation
> was successfull.
>
> Wouldn't it be better, to give a little bit more error handling here like:
>
> foreach $value (qw(ScepAllowEnrollment ScepAllowRenewal ScepDefaultRole
> ScepDefaultRA ScepRenewalRDNMatch
> ScepKeepSubjectAltName ScepAutoApprove)) {
> die "$value missing in configfile: $!" if not defined $value;
> my $val = getRequired($value);
>
> This would save much time and nerves. ;-)
>
> However, after fixing this and reading the other SCEP related mails SCEP
> works now. And I had not to make the scep direktive seperately. I think on
> OpenCA 0.9.2.5 this issue has been removed.
>
> Thanks
>
> Ralf
>
>
>>Ralf Hornik Mailings schrieb:
>>Hi Martin,
>>
>>Both debugging flags are enabled, there is no other output.
>>However, the openca-scep commands work, when I make it manually using the
>>shell.
>>
>>I think, the problem is on the webinterface.
>>
>>Regards
>>
>>Ralf
>>
>>
>>>Martin Bartosch schrieb:
>>>Hi,
>>>
>>>
>>>>The exact error output with debugging enabled is:
>>>
>>>there are no SCEP debug messages in the log file. Did you set both
>>>Debug flags to 1 in log.xml? Such as:
>>>
>>><openca>
>>> <debug>1</debug>
>>> <stderr>/usr/local/openca-0.9.2/var/log/stderr.log</stderr>
>>> <log>
>>> <debug>1</debug>
>>> <slots>
>>>...
>>>
>>>After setting this you should restart OpenCA.
>>>
>>>You should get debug messages like the sample below. Please post this
>>>output.
>>>
>>>cheers
>>>
>>>Martin
>>>
>>>
>>>OpenCA::AC-> access granted
>>>OpenCA::AC->initToken: starting
>>>OpenCA::AC->initToken: successfully finished
>>>cmds->cmdScepPKIOperation: execute5: /usr/local/bin/openca-scep -in /
>>>usr/local/openca-0.9.2/var/tmp/scep_pkiOp_12872.p7 -noout -print_transid
>>>cmds->cmdScepPKIOperation: Pipe returned error code 0
>>>cmds->cmdScepPKIOperation: tid:
>>>cmds->cmdScepPKIOperation: execute_bt: /usr/local/bin/openca-scep -
>>>in /usr/local/openca-0.9.2/var/tmp/scep_pkiOp_12872.p7 -keyfile /etc/
>>>certs/local/scep-key.pem -passin env:pwd -noout -print_scert > /usr/
>>>local/openca-0.9.2/var/tmp/scep_client_12872.crt
>>>cmds->cmdScepPKIOperation: Backtick expansion returned error code 0
>>>cmds->cmdScepPKIOperation: execute1: /usr/local/bin/openca-scep -in /
>>>usr/local/openca-0.9.2/var/tmp/scep_pkiOp_12872.p7 -noout -print_msgtype
>>>cmds->cmdScepPKIOperation: Pipe returned error code 0
>>>cmds->cmdScepPKIOperation: msgtype: PKCSReq (19)
>>>
>>>cmds->cmdScepPKIOperation: execute6: /usr/local/bin/openca-scep -in /
>>>usr/local/openca-0.9.2/var/tmp/scep_pkiOp_12872.p7 -keyfile /etc/
>>>certs/local/scep-key.pem -passin env:pwd -noout -print_req
>>>cmds->cmdScepPKIOperation: Pipe returned error code 0
>>>cmds->cmdScepPKIOperation: csr: -----BEGIN CERTIFICATE REQUEST-----
>>>...
>>>
>>>
>>>All the advantages of Linux Managed Hosting--Without the Cost and Risk!
>>>Fully trained technicians. The highest number of Red Hat certifications
>>>in
>>>the hosting industry. Fanatical Support. Click to learn more
>>>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
>>>_______________________________________________
>>>Openca-Users mailing list
>>>Openca-Users@lists.sourceforge.net
>>>https://lists.sourceforge.net/lists/listinfo/openca-users
>>>
>>
>>
>>--
>>
>>
>>
>>All the advantages of Linux Managed Hosting--Without the Cost and Risk!
>>Fully trained technicians. The highest number of Red Hat certifications in
>>the hosting industry. Fanatical Support. Click to learn more
>>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
>>_______________________________________________
>>Openca-Users mailing list
>>Openca-Users@lists.sourceforge.net
>>https://lists.sourceforge.net/lists/listinfo/openca-users
>>
>
>
>
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Openca-Users mailing list
Openca-Users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openca-users
