Need to find a way to improve the SCEP debug log on CA and RA. One difficulty is when there is a Java exception, there is "only" the PKI operation string and its message, not other particular info or reason. The PKCS #7 message has some information, but it is generally not clear what may be happening when problems happen.
A RA debug log typically looks like this:
Thu Oct 17 15:54:03 CST 2013 - Thu Oct 17 15:54:03 CST 2013 - Param operation='PKIOperation' Thu Oct 17 15:54:03 CST 2013 - Thu Oct 17 15:54:03 CST 2013 - Param message='MIIG5AYJKoZIhvcNAQcCoIIG1TCCBtECAQExDjAMBggqhkiG9w0CBQUAMIIDPwYJ ...
And the CA debug log also look similar:
[17/Oct/2013:15:54:03]http-9444-Processor24: operation=PKIOperation [17/Oct/2013:15:54:03]http-9444-Processor24: message=MIIG5AYJKoZIhvcNAQcCoIIG1TCCBtECAQExDjAMBggqhkiG9w0CBQUAMIIDPwYJ
Example of exception following the previous CA debug log entry:
org.mozilla.jss.asn1.InvalidBERException: SEQUENCE(item #3) >> SET at org.mozilla.jss.asn1.SET$Template.decode(SET.java:726) at org.mozilla.jss.asn1.SET$OF_Template.decode(SET.java:874) at org.mozilla.jss.asn1.SEQUENCE$Template.decode(SEQUENCE.java:402) at org.mozilla.jss.pkcs7.SignedData$Template.decode(SignedData.java:415) at org.mozilla.jss.pkcs7.SignedData$Template.decode(SignedData.java:409)
In this case, although the message seemed "clean", it would have helped to get more details from the SCEP unwrapping sequence during the ASN1 reading/conversion, why something unexpected happened in JSS.
For now you can use pretty print from nss-tool:
rpm -ql nss-tools | grep '/pp' /usr/lib64/nss/unsupported-tools/pp
which will show in your case that SCEP request includes certificate with incorrect version 4
/usr/lib64/nss/unsupported-tools/pp -t pkcs7 -a -i scep-req.txt . . . Certificate List: Certificate (1): Data: Version: 4 (0x3) ---> It should say Version: 3 (0x2) Serial Number: AE3C7CD6BCECB3B8B72E63F4F91ED8D4 . . .
where currently allowed versions specified in RFC 5280 are:
. . . Version ::= INTEGER { v1(0), v2(1), v3(2) } . . .
see: http://tools.ietf.org/html/rfc5280#section-4.1
Metadata Update from @msauton: - Issue assigned to awnuk - Issue set to the milestone: UNTRIAGED
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/1380
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Metadata Update from @dmoluguw: - Issue close_status updated to: migrated - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.