pki.git/base/ca/shared/webapps, branch master

Ticket #2757 CMC enrollment profiles for system certificates

2017-07-07T23:51:22+00:00

This patch supports CMC-based system certificate requests.

This patch contains the following:
* The code in CMCAuth (agent-based) to check ssl client auth cert against the CMC signing cert
* The cmc-based system enrollment profiles:
caCMCauditSigningCert.cfg
caCMCcaCert.cfg
caCMCkraStorageCert.cfg
caCMCkraTransportCert.cfg
caCMCocspCert.cfg
caCMCserverCert.cfg
caCMCsubsystemCert.cfg
* new URI's in web.xml as new access points

Usage example can be found here:
http://pki.fedoraproject.org/wiki/PKI_10.4_CMC_Feature_Update_(RFC5272)#Examples_.28System_Certificates.29

Tocket2673- CMC: allow enrollment key signed (self-signed) CMC with identity proof

2017-05-17T18:45:14+00:00

This patch implements the self-signed CMC requests, where the request is signed by the public key of the underlying request (PKCS#10 or CRMF). The scenario for when this method is used is when there was no existing signing cert for the user has been issued before, and once it is issued, it can be used to sign subsequent cert requests by the same user. The new enrollment profile introduced is : caFullCMCSelfSignedCert.cfg The new option introduced to both CRMFPopClient and PKCS10Client is "-y" which will add the required SubjectKeyIdentifier to the underlying request. When a CMC request is self-signed, no auditSubjectID is available until Identification Proof (v2) is verified, however, the cert subject DN is recorded in log as soon as it was available for additional information. Auditing is adjusted. More will come in the next couple CMC patches.

Ticket #2717 CMC user-signed enrollment request

2017-04-29T02:56:09+00:00

This patch provides implementation that allows user-signed CMC requests
to be processed; The resulting certificate will bear the same subjectDN
as that of the signing cert;
The new uri to access is /ca/ee/ca/profileSubmitUserSignedCMCFull
where the new profile is to be used: caFullCMCUserSignedCert.cfg
which utilizes the new authentication plugin: CMCUserSignedAuth
and new profile default plugin: CMCUserSignedSubjectNameDefault
and new profile constraint plugin: CMCUserSignedSubjectNameConstraint

Added audit service and CLI to all subsystems.

2017-04-03T22:29:44+00:00

Previously the audit service and CLI were only available on TPS.
Now they have been added to all subsystems.

Change-Id: I3b472254641eb887289c5122df390c46ccd97d47

Added access banner for CA UI.

2017-02-23T23:20:23+00:00

All pages in CA UI have been modified to retrieve access banner
and display it once at the beginning of the SSL connection.

https://fedorahosted.org/pki/ticket/2582

Renamed index.html to index.jsp in CA UI.

2017-02-20T15:57:56+00:00

The index.html files in CA UI have been renamed to index.jsp such
that they can be protected by access banner.

https://fedorahosted.org/pki/ticket/2582

Removed all references to 'xenroll.dll'

2016-12-09T22:29:50+00:00

- PKI TRAC Ticket #2524 - Remove xenroll.dll from pki-core

UdnPwdDirAuth authentication plugin instance is not working.

2016-06-17T21:45:40+00:00

Ticket #1579 : UdnPwdDirAuth authentication plugin instance is not working.

Since this class no longer works, we felt it best to just remove it from the server.

This patch removes the references and files associated with this auth method.

Detect inability to submit ECC CSR on Chrome

2016-05-14T00:10:52+00:00

- PKI TRAC Ticket #2306 - Chrome Can Not Submit EC Client Cert Requests

Added Chrome keygen warning

2016-05-13T02:04:17+00:00

- PKI TRAC Ticket #2323 - Firefox Warning appears in EE page launched from
                          within Chrome