Hi Richard,
Ah, that's the problem then. The .new file is remaining and the contents
aren't being rolled into the index.txt file. All I've done is upgrade from
OpenSSL 0.9.7c to OpenSSL 0.9.7d, however we have some patches in our ca.c
file to support Delta CRLs which I don't think should matter in this case.
Here's a dump of the commands that are being run during this test, and the
resulting index.txt* files that exist after the last command:
openssl req -x509 -new -sha1 -nodes -config request.cnf -keyout newkey.pem
-out newcrt.pem
openssl req -new -sha1 -nodes -config request.cnf -keyout newkey.pem -out
newreq.pem
openssl ca -cert root_cert.pem -keyfile root_key.pem -name
certificate_authority -days 365
-md sha1 -config issue.cnf.1384 -batch -out newcrt.pem -outdir .
-infiles newreq.pem
openssl req -new -sha1 -nodes -config request.cnf -keyout newkey.pem -out
newreq.pem
openssl ca -cert ca1_cert.pem -keyfile ca1_key.pem -name end_entity -days
365 -md sha1
-config issue.cnf.2372 -batch -out newcrt.pem -outdir . -infiles
newreq.pem
openssl req -new -sha1 -nodes -config request.cnf -keyout newkey.pem -out
newreq.pem
openssl ca -cert ca1_cert.pem -keyfile ca1_key.pem -name end_entity -days
365 -md sha1
-config /issue.cnf.2660 -batch -out newcrt.pem -outdir . -infiles
newreq.pem
openssl ocsp -issuer ca1_cert.pem -cert ca1_ee1_cert.pem -reqout
ca1_ee1_req_unsigned.der -no_nonce
openssl ocsp -issuer ca1_cert.pem -cert ca1_ee1_cert.pem -reqout
ca1_ee1_req_signed.der
-signer ca1_ee1_cert.pem -signkey ca1_ee1_key.pem -sign_other
ca1_cert.pem -no_nonce
openssl ocsp -index index.txt -text -resp_no_certs -port 19916 -CA
ca1_cert.pem -rsigner ca1_cert.pem -rkey ca1_key.pem
index.txt
V 050319032211Z 01 unknown /C=US/O=Root/OU=CA1
V 050319032215Z 02 unknown /C=US/O=Root/OU=CA1/CN=ee1
index.txt.attr
unique_subject = yes
index.txt.attr.new
unique_subject = yes
index.txt.attr.old
unique_subject = yes
index.txt.new
V 050319032211Z 01 unknown /C=US/O=Root/OU=CA1
V 050319032215Z 02 unknown /C=US/O=Root/OU=CA1/CN=ee1
V 050319032218Z 03 unknown /C=US/O=Root/OU=CA1/CN=ee2
Regards,
Steven Reddie
Manager, Development - eTrust R&D
Computer Associates (Australia)
[EMAIL PROTECTED]
Phone: +61 3 8416 5613
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard Levitte - VMS
Whacker
Sent: Friday, 19 March 2004 1:47 PM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: Re: New CA index subfiles (.attr, .attr.new, .attr.old, .new)
In message <[EMAIL PROTECTED]> on Fri, 19 Mar 2004
11:33:07 +1100, "Steven Reddie" <[EMAIL PROTECTED]> said:
smr> Hi Richard,
smr>
smr> I'm confused by changes to the "openssl ca" command changes in
smr> 0.9.7d that now spit out several CA index files. Previously we got
smr> a single index.txt files, but now are seeing also index.txt.attr,
smr> index.txt.attr.new, index.txt.attr.old, and index.txt.new.
smr>
smr> We have some scripts that issue and revoke certificates, specifying
smr> index.txt as the CA index file. This all worked well as everything
smr> was in the one file. Now, it seems that we need to specify
smr> index.txt when issuing certificates, but index.txt.new when
smr> revoking certificates and when using the ocsp command.
smr>
smr> Is there something I can do to get the original behaviour, or can
smr> you clarify whether I do need to specify different CA index files
smr> for each command as I've found.
Previous versions of openssl also created index.txt.new as a temporary work
file. That hasn't changed. index.txt.attr is an extra file that contains
some extra attributes for index.txt. Right now, there's only one attribute
that indicates if multiple records with the same subject are OK or not.
Can you tell me exactly what the problem is? The .new files should
disappear after an operation...
-----
Please consider sponsoring my work on free software.
See http://www.free.lp.se/sponsoring.html for details.
--
Richard Levitte \ Tunnlandsv�gen 52 \ [EMAIL PROTECTED]
[EMAIL PROTECTED] \ S-168 36 BROMMA \ T: +46-708-26 53 44
\ SWEDEN \
Procurator Odiosus Ex Infernis -- [EMAIL PROTECTED]
Member of the OpenSSL development team: http://www.openssl.org/
Unsolicited commercial email is subject to an archival fee of $400. See
<http://www.stacken.kth.se/~levitte/mail/> for more info.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
