Bug 608086 - CC: CA, OCSP, and DRM need to add more audit calls

git-svn-id: svn+ssh://svn.fedorahosted.org/svn/pki/trunk@1130 c9f7a03b-bd48-0410-a16d-cbbf54688b0b

16 files changed, 339 insertions, 187 deletions

diff --git a/pki/base/ca/shared/conf/CS.cfg b/pki/base/ca/shared/conf/CS.cfg
index 8a4b37594..21b0963f7 100644
--- a/pki/base/ca/shared/conf/CS.cfg
+++ b/pki/base/ca/shared/conf/CS.cfg
@@ -799,7 +799,8 @@ log.instance.SignedAudit._001=## Signed Audit Logging
 log.instance.SignedAudit._002=##
 log.instance.SignedAudit.bufferSize=512
 log.instance.SignedAudit.enable=true
-log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE,PRIVATE_KEY_ARCHIVE_PROCESSED,KEY_RECOVERY_REQUEST,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_PROCESSED,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_PROCESSED,SERVER_SIDE_KEYGEN_REQUEST
+# Available Audit events: AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
+log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
 log.instance.SignedAudit.expirationTime=0
 log.instance.SignedAudit.fileName=[PKI_INSTANCE_PATH]/logs/signedAudit/ca_audit
 log.instance.SignedAudit.flushInterval=5
diff --git a/pki/base/common/src/LogMessages.properties b/pki/base/common/src/LogMessages.properties
index 28616d370..9866175b8 100644
--- a/pki/base/common/src/LogMessages.properties
+++ b/pki/base/common/src/LogMessages.properties
@@ -1941,29 +1941,59 @@ LOGGING_SIGNED_AUDIT_LOG_EXPIRATION_CHANGE_4=<type=LOG_EXPIRATION_CHANGE>:[Audit
 #    so should be seen logged right following the certificate request, if selected
 # ReqID must be the certificate enrollment request ID associated with the
 #    CA archive option (even if the request was originally submitted via
-#    an RA)
+#    an RA) (this field is set to the "EntityID" in caase of server-side key gen)
 # ArchiveID must be the DRM request ID associated with the enrollment ID,
 #     ReqID (this field will be "N/A" when logged by the CA)
 #
-LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_4=<type=PRIVATE_KEY_ARCHIVE>:[AuditEvent=PRIVATE_KEY_ARCHIVE][SubjectID={0}][Outcome={1}][ReqID={2}][ArchiveID={3}] private key archive request
+LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_4=<type=PRIVATE_KEY_ARCHIVE_REQUEST>:[AuditEvent=PRIVATE_KEY_ARCHIVE_REQUEST][SubjectID={0}][Outcome={1}][ReqID={2}][ArchiveID={3}] private key archive request
 #
-# LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED
+# LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED
 # - used when user private key archive request is processed
 #    this is when DRM receives and processed the request
 # PubKey must be the base-64 encoded public key associated with
 #    the private key to be archived
 #
-LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED_3=<type=PRIVATE_KEY_ARCHIVE_PROCESSED>:[AuditEvent=PRIVATE_KEY_ARCHIVE_PROCESSED][SubjectID={0}][Outcome={1}][PubKey={2}] private key archive request processed
+LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED_3=<type=PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED>:[AuditEvent=PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED][SubjectID={0}][Outcome={1}][PubKey={2}] private key archive request processed
+#
+# LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS
+# - used when user private key export request is made and processed with success
+# - this is used in case of server-side keygen when keys generated on the server
+#   need to be transported back to the client
+# EntityID must be the id that represents the client
+# PubKey must be the base-64 encoded public key associated with
+#    the private key to be archived
+#
+LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS_4=<type=PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS>:[AuditEvent=PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS][SubjectID={0}][Outcome={1}][EntityID={2}][PubKey={3}] private key export request processed with success
+#
+# LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE
+# - used when user private key export request is made and processed with failure
+# - this is used in case of server-side keygen when keys generated on the server
+#   need to be transported back to the client
+# EntityID must be the id that represents the client
+# PubKey must be the base-64 encoded public key associated with
+#    the private key to be archived
+#
+LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE_4=<type=PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE>:[AuditEvent=PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE][SubjectID={0}][Outcome={1}][EntityID={2}][PubKey={3}] private key export request processed with failure
 #
 # LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST
 # - used when server-side key generation request is made
 #    This is for tokenkeys
-LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_3=<type=SERVER_SIDE_KEYGEN_REQUEST>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST][SubjectID={0}][Outcome={1}][AgentID={2}] server-side key generation request processed
+# EntityID must be the representation of the subject that will be on the certificate when issued
+LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_3=<type=SERVER_SIDE_KEYGEN_REQUEST>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST][SubjectID={0}][Outcome={1}][EntityID={2}] server-side key generation request processed
+#
+# LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS
+# - used when server-side key generation request has been processed with success
+#    This is for tokenkeys
+# EntityID must be the representation of the subject that will be on the certificate when issued
+# PubKey must be the base-64 encoded public key associated with
+#    the private key to be archived
+LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS_4=<type=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS][SubjectID={0}][Outcome={1}][EntityID={2}][PubKey={3}] server-side key generation request processed with success
 #
-# LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_PROCESSED
-# - used when server-side key generation request has been processed
+# LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE
+# - used when server-side key generation request has been processed with failure
 #    This is for tokenkeys
-LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_PROCESSED_3=<type=SERVER_SIDE_KEYGEN_PROCESSED>:[AuditEvent=SERVER_SIDE_KEYGEN_PROCESSED][SubjectID={0}][Outcome={1}][AgentID={2}] server-side key generation request processed
+# EntityID must be the representation of the subject that will be on the certificate when issued
+LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE_3=<type=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE][SubjectID={0}][Outcome={1}][EntityID={2}] server-side key generation request processed with failure
 #
 # LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST
 # - used when key recovery request is made
@@ -1979,7 +2009,7 @@ LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_4=<type=KEY_RECOVERY_REQUEST>:[AuditEv
 # PubKey must be the base-64 encoded public key associated with
 #    the private key to be recovered
 #
-LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_ASYNC_4=<type=KEY_RECOVERY_REQUEST>:[AuditEvent=KEY_RECOVERY_REQUEST][SubjectID={0}][Outcome={1}][RequestID={2}][PubKey={3}] asynchronous key recovery request made
+LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_ASYNC_4=<type=KEY_RECOVERY_REQUEST_ASYNC>:[AuditEvent=KEY_RECOVERY_REQUEST_ASYNC][SubjectID={0}][Outcome={1}][RequestID={2}][PubKey={3}] asynchronous key recovery request made
 #
 # LOGGING_SIGNED_AUDIT_KEY_RECOVERY_AGENT_LOGIN
 # - used when DRM agents login as recovery agents to approve
@@ -1990,21 +2020,21 @@ LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_ASYNC_4=<type=KEY_RECOVERY_REQUEST>:[A
 #
 LOGGING_SIGNED_AUDIT_KEY_RECOVERY_AGENT_LOGIN_4=<type=KEY_RECOVERY_AGENT_LOGIN>:[AuditEvent=KEY_RECOVERY_AGENT_LOGIN][SubjectID={0}][Outcome={1}][RecoveryID={2}][RecoveryAgent={3}] key recovery agent login
 #
-# LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED
+# LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED
 # - used when key recovery request is processed
 # RecoveryID must be the recovery request ID
 # RecoveryAgents must be a comma-separated list of
 #       UIDs of the recovery agents approving this request
 #
-LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_4=<type=KEY_RECOVERY_PROCESSED>:[AuditEvent=KEY_RECOVERY_PROCESSED][SubjectID={0}][Outcome={1}][RecoveryID={2}][RecoveryAgents={3}] key recovery request processed
+LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_4=<type=KEY_RECOVERY_REQUEST_PROCESSED>:[AuditEvent=KEY_RECOVERY_REQUEST_PROCESSED][SubjectID={0}][Outcome={1}][RecoveryID={2}][RecoveryAgents={3}] key recovery request processed
 #
-# LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_ASYNC
+# LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_ASYNC
 # - used when key recovery request is processed
 # RequestID must be the recovery request ID
 # RecoveryAgents must be a comma-separated list of
 #       UIDs of the recovery agents approving this request
 #
-LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_ASYNC_4=<type=KEY_RECOVERY_PROCESSED>:[AuditEvent=KEY_RECOVERY_PROCESSED][SubjectID={0}][Outcome={1}][ReQUESTID={2}][RecoveryAgents={3}] asynchronous key recovery request processed
+LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_ASYNC_4=<type=KEY_RECOVERY_REQUEST_PROCESSED_ASYNC>:[AuditEvent=KEY_RECOVERY_REQUEST_PROCESSED_ASYNC][SubjectID={0}][Outcome={1}][RequestID={2}][RecoveryAgents={3}] asynchronous key recovery request processed
 #
 # LOGGING_SIGNED_AUDIT_KEY_GEN_ASYMMETRIC
 # - used when asymmetric keys are generated
diff --git a/pki/base/common/src/com/netscape/certsrv/kra/IKeyService.java b/pki/base/common/src/com/netscape/certsrv/kra/IKeyService.java
index 5c2da2d08..75dd7594a 100644
--- a/pki/base/common/src/com/netscape/certsrv/kra/IKeyService.java
+++ b/pki/base/common/src/com/netscape/certsrv/kra/IKeyService.java
@@ -104,7 +104,7 @@ public interface IKeyService {
      * <li>signed.audit LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST used whenever
      * a user private key recovery request is made (this is when the DRM
      * receives the request)
-     * <li>signed.audit LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED used whenever
+     * <li>signed.audit LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED used whenever
      * a user private key recovery request is processed (this is when the DRM
      * processes the request)
      * </ul>
diff --git a/pki/base/common/src/com/netscape/cms/profile/common/EnrollProfile.java b/pki/base/common/src/com/netscape/cms/profile/common/EnrollProfile.java
index d5e6d1299..e36f5b385 100644
--- a/pki/base/common/src/com/netscape/cms/profile/common/EnrollProfile.java
+++ b/pki/base/common/src/com/netscape/cms/profile/common/EnrollProfile.java
@@ -1167,7 +1167,20 @@ public abstract class EnrollProfile extends BasicProfile
     public void populateInput(IProfileContext ctx, IRequest request)
         throws EProfileException {
         super.populateInput(ctx, request);
+    }
+
+    public void populate(IRequest request)
+        throws EProfileException {
+        super.populate(request);
+
+    }
 
+    /**
+     * Passes the request to the set of constraint policies
+     * that validate the request against the profile.
+     */
+    public void validate(IRequest request)
+        throws ERejectException {
         String auditMessage = null;
         String auditSubjectID = auditSubjectID();
         String auditRequesterID = auditRequesterID(request);
@@ -1230,34 +1243,8 @@ public abstract class EnrollProfile extends BasicProfile
 
             audit(auditMessage);
         }
-        // } catch( EProfileException eAudit1 ) {
-        //     // store a message in the signed audit log file
-        //     auditMessage = CMS.getLogMessage(
-        //                        LOGGING_SIGNED_AUDIT_PROFILE_CERT_REQUEST,
-        //                        auditSubjectID,
-        //                        ILogger.FAILURE,
-        //                        auditRequesterID,
-        //                        auditProfileID,
-        //                        auditCertificateSubjectName );
-        //
-        //     audit( auditMessage );
-        // }
-    }
-
-    public void populate(IRequest request)
-        throws EProfileException {
-        super.populate(request);
-
-    }
 
-    /**
-     * Passes the request to the set of constraint policies
-     * that validate the request against the profile.
-     */
-    public void validate(IRequest request)
-        throws ERejectException {
         super.validate(request);
-        X509CertInfo info = request.getExtDataInCertInfo(REQUEST_CERTINFO);
         Object key = null;
 
         try {
diff --git a/pki/base/common/src/com/netscape/cms/servlet/csadmin/NamePanel.java b/pki/base/common/src/com/netscape/cms/servlet/csadmin/NamePanel.java
index 63b0d6595..78c9837c2 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/csadmin/NamePanel.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/csadmin/NamePanel.java
@@ -252,14 +252,19 @@ public class NamePanel extends WizardPanelBase {
                     boolean done = config.getBoolean("preop.NamePanel.done");
                     c.setDN(dn);
                 } catch (Exception e) {
+                    String instanceId = config.getString("service.instanceID", "");
                     if (select.equals("clone") || dnUpdated) {
                         c.setDN(dn);
                     } else if (count != 0 && override && (cert.equals("") || certreq.equals(""))) {
                         CMS.debug("NamePanel subsystemCount = "+count);
-                        c.setDN(dn + " "+count+ ((o_sd)? (",O=" + domainname):""));
+                        c.setDN(dn + " "+count+ 
+                          ((!instanceId.equals(""))? (",OU=" + instanceId):"") +
+                          ((o_sd)? (",O=" + domainname):""));
                         config.putBoolean(PCERT_PREFIX+certTag+".updatedDN", true);
                     } else {
-                        c.setDN(dn + ((o_sd)? (",O=" + domainname):""));
+                        c.setDN(dn + 
+                            ((!instanceId.equals(""))? (",OU=" + instanceId):"") +
+                            ((o_sd)? (",O=" + domainname):""));
                         config.putBoolean(PCERT_PREFIX+certTag+".updatedDN", true);
                     }
                 }
diff --git a/pki/base/common/src/com/netscape/cms/servlet/key/RecoverBySerial.java b/pki/base/common/src/com/netscape/cms/servlet/key/RecoverBySerial.java
index 7882b815f..499c1a80c 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/key/RecoverBySerial.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/key/RecoverBySerial.java
@@ -200,8 +200,12 @@ public class RecoverBySerial extends CMSServlet {
               int requiredNumber = mService.getNoOfRequiredAgents();
               header.addIntegerValue("noOfRequiredAgents", requiredNumber);
             } else {
-              ctx.put(SessionContext.RECOVERY_ID,
-                req.getParameter("recoveryID"));
+                String recoveryID = req.getParameter("recoveryID");
+
+                if (recoveryID != null && !recoveryID.equals("")) {
+                  ctx.put(SessionContext.RECOVERY_ID,
+                    req.getParameter("recoveryID"));
+                }
               byte pkcs12[] = process(form, argSet, header, 
                     req.getParameter(IN_SERIALNO), 
                     req.getParameter("localAgents"),
diff --git a/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileProcessServlet.java b/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileProcessServlet.java
index 0bce4b248..535adee2b 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileProcessServlet.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileProcessServlet.java
@@ -50,7 +50,6 @@ public class ProfileProcessServlet extends ProfileServlet {
     private String mAuthorityId = null;
     private Nonces mNonces = null;
 
-    private final static byte EOL[] = { Character.LINE_SEPARATOR };
     private final static String SIGNED_AUDIT_CERT_REQUEST_REASON =
         "requestNotes";
     private final static String LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED =
@@ -910,8 +909,8 @@ public class ProfileProcessServlet extends ProfileServlet {
             // extract all line separators from the "base64Data"
             StringBuffer sb = new StringBuffer();
             for (int i = 0; i < base64Data.length(); i++) {
-                if (base64Data.substring(i, i).getBytes() != EOL) {
-                    sb.append(base64Data.substring(i, i));
+                  if (!Character.isWhitespace(base64Data.charAt(i))) {
+                    sb.append(base64Data.charAt(i));
                 }
             }
             cert = sb.toString();
diff --git a/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java b/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java
index 841bd84ce..6e99f0baa 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java
@@ -58,7 +58,6 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {
     private String requestBinary = null;
     private String requestB64 = null;
 
-    private final static byte EOL[] = { Character.LINE_SEPARATOR };
     private final static String[]
         SIGNED_AUDIT_AUTOMATED_REJECTION_REASON = new String[] {
             
@@ -824,8 +823,8 @@ profile, IRequest req) {
             // extract all line separators from the "base64Data"
             StringBuffer sb = new StringBuffer();
             for (int i = 0; i < base64Data.length(); i++) {
-                if (base64Data.substring(i, i).getBytes() != EOL) {
-                    sb.append(base64Data.substring(i, i));
+                if (!Character.isWhitespace(base64Data.charAt(i))) {
+                    sb.append(base64Data.charAt(i));
                 }
             }
             cert = sb.toString();
diff --git a/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java b/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java
index c7a99de5e..1c6097f48 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java
@@ -65,7 +65,6 @@ public class ProfileSubmitServlet extends ProfileServlet {
     private String mReqType = null;
     private String mAuthorityId = null;
 
-    private final static byte EOL[] = { Character.LINE_SEPARATOR };
     private final static String[]
         SIGNED_AUDIT_AUTOMATED_REJECTION_REASON = new String[] {
             
@@ -1504,8 +1503,9 @@ public class ProfileSubmitServlet extends ProfileServlet {
             // extract all line separators from the "base64Data"
             StringBuffer sb = new StringBuffer();
             for (int i = 0; i < base64Data.length(); i++) {
-                if (base64Data.substring(i, i).getBytes() != EOL) {
-                    sb.append(base64Data.substring(i, i));
+                if (!Character.isWhitespace(base64Data.charAt(i))) {
+                    sb.append(base64Data.charAt(i));
+
                 }
             }
             cert = sb.toString();
diff --git a/pki/base/kra/shared/conf/CS.cfg b/pki/base/kra/shared/conf/CS.cfg
index f827c4d14..3636af443 100644
--- a/pki/base/kra/shared/conf/CS.cfg
+++ b/pki/base/kra/shared/conf/CS.cfg
@@ -236,7 +236,8 @@ log.instance.SignedAudit._001=## Signed Audit Logging
 log.instance.SignedAudit._002=##
 log.instance.SignedAudit.bufferSize=512
 log.instance.SignedAudit.enable=true
-log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE,PRIVATE_KEY_ARCHIVE_PROCESSED,KEY_RECOVERY_REQUEST,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_PROCESSED,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_PROCESSED,SERVER_SIDE_KEYGEN_REQUEST
+# Available Audit events: AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
+log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
 log.instance.SignedAudit.expirationTime=0
 log.instance.SignedAudit.fileName=[PKI_INSTANCE_PATH]/logs/signedAudit/kra_cert-kra_audit
 log.instance.SignedAudit.flushInterval=5
diff --git a/pki/base/kra/src/com/netscape/kra/EnrollmentService.java b/pki/base/kra/src/com/netscape/kra/EnrollmentService.java
index c1aed4725..307f01518 100644
--- a/pki/base/kra/src/com/netscape/kra/EnrollmentService.java
+++ b/pki/base/kra/src/com/netscape/kra/EnrollmentService.java
@@ -92,12 +92,12 @@ public class EnrollmentService implements IService {
         LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST =
         "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_4";
     private final static String
-        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED =
-        "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED_3";
+        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED =
+        "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED_3";
     private final static String LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST =
         "LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_4";
-    private final static String LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED =
-        "LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_4";
+    private final static String LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED =
+        "LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_4";
     /**
      * Constructs request processor.
      * <P>
@@ -455,7 +455,7 @@ public class EnrollmentService implements IService {
             // store a message in the signed audit log file
             auditPublicKey = auditPublicKey(rec);
             auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED,
+                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,
                         auditSubjectID,
                         ILogger.SUCCESS,
                         auditPublicKey);
diff --git a/pki/base/kra/src/com/netscape/kra/KeyRecoveryAuthority.java b/pki/base/kra/src/com/netscape/kra/KeyRecoveryAuthority.java
index ce2a03b20..fd5537c31 100644
--- a/pki/base/kra/src/com/netscape/kra/KeyRecoveryAuthority.java
+++ b/pki/base/kra/src/com/netscape/kra/KeyRecoveryAuthority.java
@@ -120,16 +120,16 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
         LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST =
         "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_4";
     private final static String
-        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED =
-        "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED_3";
+        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED =
+        "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED_3";
     private final static String LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST =
         "LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_4";
     private final static String LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_ASYNC =
         "LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_ASYNC_4";
-    private final static String LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED =
-        "LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_4";
-    private final static String LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_ASYNC =
-        "LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_ASYNC_4";
+    private final static String LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED =
+        "LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_4";
+    private final static String LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_ASYNC =
+        "LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_ASYNC_4";
 
     /**
      * Constructs an escrow authority.
@@ -695,7 +695,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
      * <li>signed.audit LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST used
      * whenever a user private key archive request is made (this is when the
      * DRM receives the request)
-     * <li>signed.audit LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED used
+     * <li>signed.audit LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED used
      * whenever a user private key archive request is processed (this is when
      * the DRM processes the request)
      * </ul>
@@ -765,7 +765,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
 
             // store a message in the signed audit log file
             auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED,
+                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,
                         auditSubjectID,
                         ILogger.SUCCESS,
                         auditPublicKey);
@@ -774,7 +774,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
         } catch (EBaseException eAudit1) {
             // store a message in the signed audit log file
             auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED,
+                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,
                         auditSubjectID,
                         ILogger.FAILURE,
                         auditPublicKey);
@@ -944,7 +944,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
      * <li>signed.audit LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST used whenever
      * a user private key recovery request is made (this is when the DRM
      * receives the request)
-     * <li>signed.audit LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED used whenever
+     * <li>signed.audit LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED used whenever
      * a user private key recovery request is processed (this is when the DRM
      * processes the request)
      * </ul>
@@ -1036,7 +1036,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
 
                 // store a message in the signed audit log file
                 auditMessage = CMS.getLogMessage(
-                            LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED,
+                            LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
                             auditSubjectID,
                             ILogger.SUCCESS,
                             auditRecoveryID,
@@ -1050,7 +1050,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
             } else {
                 // store a message in the signed audit log file
                 auditMessage = CMS.getLogMessage(
-                            LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED,
+                            LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
                             auditSubjectID,
                             ILogger.FAILURE,
                             auditRecoveryID,
@@ -1063,7 +1063,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
         } catch (EBaseException eAudit1) {
             // store a message in the signed audit log file
             auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED,
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
                         auditSubjectID,
                         ILogger.FAILURE,
                         auditRecoveryID,
@@ -1084,7 +1084,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
      * <li>signed.audit LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST used whenever
      * a user private key recovery request is made (this is when the DRM
      * receives the request)
-     * <li>signed.audit LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED used whenever
+     * <li>signed.audit LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED used whenever
      * a user private key recovery request is processed (this is when the DRM
      * processes the request)
      * </ul>
@@ -1133,7 +1133,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
 
                 // store a message in the signed audit log file
                 auditMessage = CMS.getLogMessage(
-                            LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_ASYNC,
+                            LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,
                             auditSubjectID,
                             ILogger.SUCCESS,
                             auditRecoveryID,
@@ -1147,7 +1147,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
             } else {
                 // store a message in the signed audit log file
                 auditMessage = CMS.getLogMessage(
-                            LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_ASYNC,
+                            LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,
                             auditSubjectID,
                             ILogger.FAILURE,
                             auditRecoveryID,
@@ -1160,7 +1160,7 @@ public class KeyRecoveryAuthority implements IAuthority, IKeyService, IKeyRecove
         } catch (EBaseException eAudit1) {
             // store a message in the signed audit log file
             auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_ASYNC,
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,
                         auditSubjectID,
                         ILogger.FAILURE,
                         auditRecoveryID,
diff --git a/pki/base/kra/src/com/netscape/kra/NetkeyKeygenService.java b/pki/base/kra/src/com/netscape/kra/NetkeyKeygenService.java
index 4f41eac7d..694e91ab3 100644
--- a/pki/base/kra/src/com/netscape/kra/NetkeyKeygenService.java
+++ b/pki/base/kra/src/com/netscape/kra/NetkeyKeygenService.java
@@ -97,15 +97,24 @@ public class NetkeyKeygenService implements IService {
         LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST =
         "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_4";
     private final static String
-        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED =
-        "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED_3";
+        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED =
+        "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED_3";
     // these need to be defined in LogMessages_en.properties later when we do this
     private final static String
-	LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST =
-	"LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_3";
+	    LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST =
+	    "LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_3";
     private final static String
-	LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_PROCESSED =
-	"LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_PROCESSED_3";
+	    LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS =
+	    "LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS_4";
+    private final static String
+	    LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE =
+	    "LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE_3";
+    private final static String
+        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS =
+        "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS_4";
+    private final static String
+        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE =
+        "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE_4";
     private IKeyRecoveryAuthority mKRA = null;
     private ITransportKeyUnit mTransportUnit = null;
     private IStorageKeyUnit mStorageUnit = null;
@@ -350,20 +359,20 @@ public class NetkeyKeygenService implements IService {
 	int keysize = Integer.parseInt(rKeysize);
 	auditSubjectID=rCUID+":"+rUserid;
 
-       SessionContext sContext = SessionContext.getContext();
-       String agentId="";
-       if (sContext != null) {
+        SessionContext sContext = SessionContext.getContext();
+        String agentId="";
+        if (sContext != null) {
             agentId =
                 (String) sContext.get(SessionContext.USER_ID);
-       }
+        }
 
-                auditMessage = CMS.getLogMessage(
-			 LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST,
-                        auditSubjectID,
-                        ILogger.SUCCESS,
-			agentId);
+        auditMessage = CMS.getLogMessage(
+            LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST,
+              agentId,
+              ILogger.SUCCESS,
+              auditSubjectID);
 
-                audit(auditMessage);
+        audit(auditMessage);
 		    
 
         String rWrappedDesKeyString = request.getExtDataInString(IRequest.NETKEY_ATTR_DRMTRANS_DES_KEY);
@@ -384,7 +393,7 @@ public class NetkeyKeygenService implements IService {
             (wrapped_des_key.length > 0)) {
 
             // unwrap the DES key
-	    sk= (PK11SymKey) mTransportUnit.unwrap_sym(wrapped_des_key);
+            sk= (PK11SymKey) mTransportUnit.unwrap_sym(wrapped_des_key);
 
             /* XXX could be done in HSM*/
             KeyPair keypair = null;
@@ -399,41 +408,51 @@ public class NetkeyKeygenService implements IService {
                 request.setExtData(IRequest.RESULT, Integer.valueOf(4));
 
                 auditMessage = CMS.getLogMessage(
-			 LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_PROCESSED,
-                        auditSubjectID,
+                    LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,
+                        agentId,
                         ILogger.FAILURE,
-			 agentId);
+                      auditSubjectID);
 
                 audit(auditMessage);
 
                 return false;
-            } else {
-                CMS.debug("NetkeyKeygenService: finished generate key pair for " +rCUID+":"+rUserid);
-	CMS.debug("NetkeyKeygenService: server-side key generated at keysize "+keysize);
+            }
+            CMS.debug("NetkeyKeygenService: finished generate key pair for " +rCUID+":"+rUserid);
+
+            try {
+		        publicKeyData = keypair.getPublic().getEncoded();
+		        if (publicKeyData == null) {
+		            request.setExtData(IRequest.RESULT, Integer.valueOf(4));
+		            CMS.debug("NetkeyKeygenService: failed getting publickey encoded");
+		            return false;
+		        } else {
+		            //CMS.debug("NetkeyKeygenService: public key binary length ="+ publicKeyData.length);
+		            PubKey = base64Encode(publicKeyData);
+
+		            //CMS.debug("NetkeyKeygenService: public key length =" + PubKey.length());
+		            request.setExtData("public_key", PubKey);
+	    	    }
 
                 auditMessage = CMS.getLogMessage(
-			 LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_PROCESSED,
+                    LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,
+                        agentId,
+                        ILogger.SUCCESS,
                         auditSubjectID,
-			 ILogger.SUCCESS,
-			 agentId);
+                        PubKey);
 
                 audit(auditMessage);
 
-	    }
-
-            //...extract the private key handle (not privatekeydata)
-            java.security.PrivateKey privKey =
-                keypair.getPrivate();
+                //...extract the private key handle (not privatekeydata)
+                java.security.PrivateKey privKey =
+                    keypair.getPrivate();
 
-            if (privKey == null) {
-                request.setExtData(IRequest.RESULT, Integer.valueOf(4));
-                CMS.debug("NetkeyKeygenService: failed getting private key");
-                return false;
-            } else {
-                CMS.debug("NetkeyKeygenService: got private key");
-            }
-                  
-            try {
+                if (privKey == null) {
+                    request.setExtData(IRequest.RESULT, Integer.valueOf(4));
+                    CMS.debug("NetkeyKeygenService: failed getting private key");
+                    return false;
+                } else {
+                    CMS.debug("NetkeyKeygenService: got private key");
+                }
 
 		if (sk == null) {
 		    CMS.debug("NetkeyKeygenService: no DES key");
@@ -472,22 +491,25 @@ public class NetkeyKeygenService implements IService {
 		if (wrappedPrivKeyString == null) {
 		    request.setExtData(IRequest.RESULT, Integer.valueOf(4));
 		    CMS.debug("NetkeyKeygenService: failed generating wrapped private key");
-		    return false;
-		} else {
-		    request.setExtData("wrappedUserPrivate", wrappedPrivKeyString);
-		}
+		    auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,
+                        agentId,
+                        ILogger.FAILURE,
+                        auditSubjectID,
+                        PubKey);
 
-		publicKeyData = keypair.getPublic().getEncoded();
-		if (publicKeyData == null) {
-		    request.setExtData(IRequest.RESULT, Integer.valueOf(4));
-		    CMS.debug("NetkeyKeygenService: failed getting publickey encoded");
+		    audit(auditMessage);
 		    return false;
 		} else {
-		    //CMS.debug("NetkeyKeygenService: public key binary length ="+ publicKeyData.length);
-		    PubKey = base64Encode(publicKeyData);
+		    request.setExtData("wrappedUserPrivate", wrappedPrivKeyString);
+		    auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,
+                        agentId,
+                        ILogger.SUCCESS,
+                        auditSubjectID,
+                        PubKey);
 
-		    //CMS.debug("NetkeyKeygenService: public key length =" + PubKey.length());
-		    request.setExtData("public_key", PubKey);
+		    audit(auditMessage);
 		}
 
 		iv_s = /*base64Encode(iv);*/com.netscape.cmsutil.util.Utils.SpecialEncode(iv);
@@ -506,6 +528,14 @@ public class NetkeyKeygenService implements IService {
 		    //
 		    //            mKRA.log(ILogger.LL_INFO, "KRA encrypts internal private");
 
+            auditMessage = CMS.getLogMessage(
+                LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST,
+                  agentId,
+                  ILogger.SUCCESS,
+                  auditSubjectID,
+                  auditArchiveID);
+
+            audit(auditMessage);
 		    CMS.debug("KRA encrypts private key to put on internal ldap db");
 		    byte privateKeyData[] =
 			mStorageUnit.wrap((org.mozilla.jss.crypto.PrivateKey) privKey);
@@ -556,8 +586,8 @@ public class NetkeyKeygenService implements IService {
 		    CMS.debug("NetkeyKeygenService: key archived for "+rCUID+":"+rUserid);
 
 		    auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_PROCESSED,
-                        auditSubjectID,
+                        LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,
+                        agentId,
                         ILogger.SUCCESS,
                         PubKey);
 
@@ -566,12 +596,11 @@ public class NetkeyKeygenService implements IService {
 		} //if archive
 
 		request.setExtData(IRequest.RESULT, Integer.valueOf(1));
-            } catch (Exception e) {
-                CMS.debug("NetKeyKeygenService: " + e.toString());
-		Debug.printStackTrace(e);
-                request.setExtData(IRequest.RESULT, Integer.valueOf(4));
-
-            }
+                } catch (Exception e) {
+                    CMS.debug("NetKeyKeygenService: " + e.toString());
+                    Debug.printStackTrace(e);
+                    request.setExtData(IRequest.RESULT, Integer.valueOf(4));
+                }
         } else 
             request.setExtData(IRequest.RESULT, Integer.valueOf(2));
                     
diff --git a/pki/base/kra/src/com/netscape/kra/TokenKeyRecoveryService.java b/pki/base/kra/src/com/netscape/kra/TokenKeyRecoveryService.java
index daafb8b7f..77752cffa 100644
--- a/pki/base/kra/src/com/netscape/kra/TokenKeyRecoveryService.java
+++ b/pki/base/kra/src/com/netscape/kra/TokenKeyRecoveryService.java
@@ -90,8 +90,8 @@ public class TokenKeyRecoveryService implements IService {
 	"LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_4";
 
     private final static String
-       LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED =
-	"LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED_4";
+       LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED =
+	"LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED_4";
     private ILogger mSignedAuditLogger = CMS.getSignedAuditLogger();
 
     /**
@@ -243,7 +243,7 @@ public class TokenKeyRecoveryService implements IService {
 
         wrapped_des_key = null;
 
-	PK11SymKey sk= null;
+        PK11SymKey sk= null;
 
         String rCUID = request.getExtDataInString(IRequest.NETKEY_ATTR_CUID);
         String rUserid = request.getExtDataInString(IRequest.NETKEY_ATTR_USERID);
@@ -260,40 +260,72 @@ public class TokenKeyRecoveryService implements IService {
             // unwrap the des key
             sk = (PK11SymKey) mTransportUnit.unwrap_encrypt_sym(wrapped_des_key);
 
-	    if (sk == null) {
-		CMS.debug("TokenKeyRecoveryService: no des key");
-		request.setExtData(IRequest.RESULT, Integer.valueOf(4));
-	    } else {
-		CMS.debug("TokenKeyRecoveryService: received des key");
-	    }
+            if (sk == null) {
+                CMS.debug("TokenKeyRecoveryService: no des key");
+                request.setExtData(IRequest.RESULT, Integer.valueOf(4));
+            } else {
+                CMS.debug("TokenKeyRecoveryService: received des key");
+            }
         } else {
-	    CMS.debug("TokenKeyRecoveryService: not receive des key");
+            CMS.debug("TokenKeyRecoveryService: not receive des key");
             request.setExtData(IRequest.RESULT, Integer.valueOf(4));
-	    return false;
-	}
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
+            return false;
+        }
 
         // retrieve based on Certificate
-	String cert_s = request.getExtDataInString(ATTR_USER_CERT);
-	if (cert_s == null) {
-	    CMS.debug("TokenKeyRecoveryService: not receive cert");
+        String cert_s = request.getExtDataInString(ATTR_USER_CERT);
+        if (cert_s == null) {
+            CMS.debug("TokenKeyRecoveryService: not receive cert");
             request.setExtData(IRequest.RESULT, Integer.valueOf(3));
-	    return false;
-	}
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
 
-	String cert = normalizeCertStr(cert_s);
-	java.security.cert.X509Certificate x509cert = null;
-	try {
-	    x509cert= (java.security.cert.X509Certificate)  Cert.mapCert(cert);
-	    if (x509cert == null) {
-		CMS.debug("cert mapping failed");
-		request.setExtData(IRequest.RESULT, Integer.valueOf(5));
-		return false;
-	    }
-	} catch (IOException e) {
-	    CMS.debug("TokenKeyRecoveryService: mapCert failed");
+            audit(auditMessage);
+            return false;
+        }
+
+        String cert = normalizeCertStr(cert_s);
+        java.security.cert.X509Certificate x509cert = null;
+        try {
+            x509cert= (java.security.cert.X509Certificate)  Cert.mapCert(cert);
+            if (x509cert == null) {
+                CMS.debug("cert mapping failed");
+                request.setExtData(IRequest.RESULT, Integer.valueOf(5));
+                auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+                audit(auditMessage);
+                return false;
+            }
+        } catch (IOException e) {
+            CMS.debug("TokenKeyRecoveryService: mapCert failed");
             request.setExtData(IRequest.RESULT, Integer.valueOf(6));
-	    return false;
-	}
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
+            return false;
+        }
 
 	try {
 	    /*
@@ -301,12 +333,11 @@ public class TokenKeyRecoveryService implements IService {
 		CryptoManager.getInstance().getInternalKeyStorageToken();
 	    */
 	    CryptoToken token = mStorageUnit.getToken();
-	    CMS.debug("NetkeyKeygenService: got token slot:"+token.getName());
+	    CMS.debug("TokenKeyRecoveryService: got token slot:"+token.getName());
 	    IVParameterSpec algParam = new IVParameterSpec(iv);
 
 	    Cipher cipher = token.getCipherContext(EncryptionAlgorithm.DES3_CBC_PAD);
 
-
 		KeyRecord keyRecord = null;
 		CMS.debug( "KRA reading key record");
 		try {
@@ -316,11 +347,27 @@ public class TokenKeyRecoveryService implements IService {
 		    else {
 			CMS.debug("key record not found");
 			request.setExtData(IRequest.RESULT, Integer.valueOf(8));
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
 			return false;
 		    }
 		}catch (Exception e) {
 		    com.netscape.cmscore.util.Debug.printStackTrace(e);
 		    request.setExtData(IRequest.RESULT, Integer.valueOf(9));
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
 		    return false;
 		}
 
@@ -342,6 +389,14 @@ public class TokenKeyRecoveryService implements IService {
 
 		if (inputPubData.length != pubData.length) {
 		    mKRA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_KRA_PUBLIC_KEY_LEN"));
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
 		    throw new EKRAException(
 					    CMS.getUserMessage("CMS_KRA_PUBLIC_KEY_NOT_MATCHED"));
 		}
@@ -349,6 +404,14 @@ public class TokenKeyRecoveryService implements IService {
 		for (int i = 0; i < pubData.length; i++) {
 		    if (pubData[i] != inputPubData[i]) {
 			mKRA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_KRA_PUBLIC_KEY_LEN"));
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
 			throw new EKRAException(
 						CMS.getUserMessage("CMS_KRA_PUBLIC_KEY_NOT_MATCHED"));
 		    }
@@ -359,10 +422,18 @@ public class TokenKeyRecoveryService implements IService {
 		privateKeyData = recoverKey(params, keyRecord);
 		if (privateKeyData == null) {
 		    request.setExtData(IRequest.RESULT, Integer.valueOf(4));
-		    CMS.debug("NetkeyKeygenService: failed getting private key");
+		    CMS.debug("TokenKeyRecoveryService: failed getting private key");
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
 		    return false;
 		}
-		CMS.debug("NetkeyKeygenService: got private key...about to verify");
+		CMS.debug("TokenKeyRecoveryService: got private key...about to verify");
 
         /* LunaSA returns data with padding which we need to remove */
         ByteArrayInputStream dis = new ByteArrayInputStream(privateKeyData);
@@ -378,10 +449,18 @@ public class TokenKeyRecoveryService implements IService {
 		if (verifyKeyPair(pubData, privateKeyData) == false) {
 		    mKRA.log(ILogger.LL_FAILURE,
 			     CMS.getLogMessage("CMSCORE_KRA_PUBLIC_NOT_FOUND"));
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
 		    throw new EKRAException(
 					    CMS.getUserMessage("CMS_KRA_INVALID_PUBLIC_KEY"));
 		} else {
-		    CMS.debug("NetkeyKeygenService: private key verified with public key");
+		    CMS.debug("TokenKeyRecoveryService: private key verified with public key");
 		}
 
 		//encrypt and put in private key
@@ -392,14 +471,22 @@ public class TokenKeyRecoveryService implements IService {
                     com.netscape.cmsutil.util.Utils.SpecialEncode(wrapped);
 		if (wrappedPrivKeyString == null) {
 		    request.setExtData(IRequest.RESULT, Integer.valueOf(4));
-		    CMS.debug("NetkeyKeygenService: failed generating wrapped private key");
+		    CMS.debug("TokenKeyRecoveryService: failed generating wrapped private key");
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
 		    return false;
 		} else {
-		    CMS.debug("NetkeyKeygenService: got private key data wrapped");
+		    CMS.debug("TokenKeyRecoveryService: got private key data wrapped");
 		    request.setExtData("wrappedUserPrivate",
 				wrappedPrivKeyString);
 		    request.setExtData(IRequest.RESULT, Integer.valueOf(1));
-		    CMS.debug( "NetkeyKeygenService: key for " +rCUID+":"+rUserid +" recovered");
+		    CMS.debug( "TokenKeyRecoveryService: key for " +rCUID+":"+rUserid +" recovered");
 		}
 
 		//convert and put in the public key
@@ -416,23 +503,31 @@ public class TokenKeyRecoveryService implements IService {
 	    
 		if (b64PKey == null) {
 		    request.setExtData(IRequest.RESULT, Integer.valueOf(4));
-		    CMS.debug("NetkeyKeygenService: failed getting publickey encoded");
+		    CMS.debug("TokenKeyRecoveryService: failed getting publickey encoded");
+            auditMessage = CMS.getLogMessage(
+                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+                        auditSubjectID,
+                        ILogger.FAILURE,
+                        auditRecoveryID,
+                        agentId);
+
+            audit(auditMessage);
 		    return false;
 		} else {
-		    CMS.debug("NetkeyKeygenService: got publicKeyData b64 = "+
+		    CMS.debug("TokenKeyRecoveryService: got publicKeyData b64 = "+
 			      b64PKey);
 		}
 		request.setExtData("public_key", b64PKey);
-		auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_KEY_RECOVERY_PROCESSED,
-                        auditSubjectID,
-                        ILogger.SUCCESS,
-                        auditRecoveryID,
-			agentId);
+        auditMessage = CMS.getLogMessage(
+               LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_PROCESSED,
+               auditSubjectID,
+               ILogger.SUCCESS,
+               auditRecoveryID,
+               agentId);
 
-		audit(auditMessage);
+        audit(auditMessage);
 
-		return true;
+        return true;
 
 	} catch (Exception e) {
 	    CMS.debug("TokenKeyRecoveryService: " + e.toString());
diff --git a/pki/base/ocsp/shared/conf/CS.cfg b/pki/base/ocsp/shared/conf/CS.cfg
index e613719a2..485abb1e9 100644
--- a/pki/base/ocsp/shared/conf/CS.cfg
+++ b/pki/base/ocsp/shared/conf/CS.cfg
@@ -192,7 +192,8 @@ log.instance.SignedAudit._001=## Signed Audit Logging
 log.instance.SignedAudit._002=##
 log.instance.SignedAudit.bufferSize=512
 log.instance.SignedAudit.enable=true
-log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE,PRIVATE_KEY_ARCHIVE_PROCESSED,KEY_RECOVERY_REQUEST,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_PROCESSED,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_PROCESSED,SERVER_SIDE_KEYGEN_REQUEST
+# Available Audit events: AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
+log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
 log.instance.SignedAudit.expirationTime=0
 log.instance.SignedAudit.fileName=[PKI_INSTANCE_PATH]/logs/signedAudit/ocsp_cert-ocsp_audit
 log.instance.SignedAudit.flushInterval=5
diff --git a/pki/base/tks/shared/conf/CS.cfg b/pki/base/tks/shared/conf/CS.cfg
index 6b5656bd7..3f4ec7d2d 100644
--- a/pki/base/tks/shared/conf/CS.cfg
+++ b/pki/base/tks/shared/conf/CS.cfg
@@ -190,7 +190,8 @@ log.instance.SignedAudit._001=## Signed Audit Logging
 log.instance.SignedAudit._002=##
 log.instance.SignedAudit.bufferSize=512
 log.instance.SignedAudit.enable=true
-log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE,PRIVATE_KEY_ARCHIVE_PROCESSED,KEY_RECOVERY_REQUEST,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_PROCESSED,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_PROCESSED,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED
+# Available Audit events: AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
+log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
 log.instance.SignedAudit.expirationTime=0
 log.instance.SignedAudit.fileName=[PKI_INSTANCE_PATH]/logs/signedAudit/tks_cert-tks_audit
 log.instance.SignedAudit.flushInterval=5