summaryrefslogtreecommitdiffstats
path: root/base/ca
Commit message (Collapse)AuthorAgeFilesLines
...
* Renamed index.html to index.jsp in CA UI.Endi S. Dewata2017-02-2010-2/+2
| | | | | | | The index.html files in CA UI have been renamed to index.jsp such that they can be protected by access banner. https://fedorahosted.org/pki/ticket/2582
* Troubleshooting improvements for CertRequestService.Endi S. Dewata2017-02-171-27/+26
| | | | | To help troubleshooting the CertRequestService has been modified to chain the original exceptions.
* Refactored PKIService class.Endi S. Dewata2017-02-152-5/+5
| | | | | | | | | The subsystem-based methods and fields in PKIService class have been moved into a new SubsystemService class to allow creating more generic non-subsystem-based services. The classes that use these methods and fields have been updated accordingly.
* Cleaned up CMake scripts for Jackson libraries.Endi S. Dewata2017-02-151-14/+0
| | | | | To avoid redundancy the code that finds Jackson libraries has been moved to the top level CMake script.
* Converted library links creation into CMake scripts.Endi S. Dewata2017-02-151-0/+23
| | | | | | To improve consistency across platforms the code in RPM spec that creates the links to subsystem library files has been converted into CMake scripts.
* Add profile component that copies CN to SAN dNSNameFraser Tweedale2017-02-091-1/+4
| | | | | | | | | | | | | Add the 'CommonNameToSANDefault' profile default class. When used on a profile, this will examine the (most-specific) Common Name in the Subject DN, and if it looks like a DNS name, will add it to the Subject Alternative Name extension, creating the extension if it does not already exist. Also add upgrade scriptlet to add the component to registry.cfg in existing installations. Fixes: https://fedorahosted.org/pki/ticket/1710
* Replaced CryptoManager.getTokenByName().Endi S. Dewata2017-01-271-2/+1
| | | | | | | | | Direct invocations of CryptoManager.getTokenByName() have been replaced with CryptoUtil.getCryptoToken() and getKeyStorageToken() to ensure that internal token names are handled consistently both in normal mode and FIPS mode. https://fedorahosted.org/pki/ticket/2556
* Fixed inconsistent internal token detection.Endi S. Dewata2017-01-261-2/+1
| | | | | | | | The codes that detect internal token name have been modified to use CryptoUtil.isInternalToken() such that the comparison can be done consistently both in normal mode and FIPS mode. https://fedorahosted.org/pki/ticket/2556
* Add option to remove signing cert entryAde Lee2017-01-241-3/+47
| | | | | | | | | | | | | | | In the migration case, it is useful to delete the initially created signing certificate database record and have that be imported through the ldif data import instead. Therefore, we add an option to remove this entry. The user also needs to provide the serial number for the entry. This resolves the following tickets/BZs: BZ# 1409949/Trac 2573 - CA Certificate Issuance Date displayed on CA website incorrect BZ# 1409946/Trac 2571 - Request ID undefined for CA signing certificate
* Replaced internal token full name literals.Endi S. Dewata2017-01-241-1/+1
| | | | | | | The internal token full name literals have been replaced with CryptoUtil.INTERNAL_TOKEN_FULL_NAME. https://fedorahosted.org/pki/ticket/2556
* Use BigInteger for entryUSNFraser Tweedale2017-01-231-6/+6
| | | | | | | | | | | Currently we try to parse the entryUSN into an Integer, which wraps the 'int' primitive type. If entryUSN value is too large to fit in 'int', NumberFormatException is raised. Change LDAPProfileSubsystem and CertificateAuthority to use BigInteger for entryUSN values. Fixes: https://fedorahosted.org/pki/ticket/2579
* Refactored Constants.PR_INTERNAL_TOKEN.Endi S. Dewata2017-01-211-2/+2
| | | | | | | The Constants.PR_INTERNAL_TOKEN has been replaced with CryptoUtil.INTERNAL_TOKEN_NAME since they are identical. https://fedorahosted.org/pki/ticket/2556
* Removed redundant find_file() for Tomcat libraries.Endi S. Dewata2016-12-181-15/+0
| | | | | | | The CMake scripts have been modified to remove redundant invocations of find_file() to find Tomcat libraries. https://fedorahosted.org/pki/ticket/2560
* Remove principal type assumption from AuthorityServiceFraser Tweedale2016-12-121-6/+6
| | | | Part of: https://fedorahosted.org/pki/ticket/1359
* Define "profileId" IRequest extdata key in one placeFraser Tweedale2016-12-122-4/+4
| | | | Part of: https://fedorahosted.org/pki/ticket/1359
* Removed all references to 'xenroll.dll'Matthew Harmsen2016-12-0923-578/+164
| | | | - PKI TRAC Ticket #2524 - Remove xenroll.dll from pki-core
* Revert "Replaced deprecated ProxyParser."Endi S. Dewata2016-12-021-2/+2
| | | | | | | Commit f9ddb2e875355e882b14529979f6c9ae03cf720e has been reverted due to build issue on RHEL/CentOS. https://fedorahosted.org/pki/ticket/2535
* Removed unused CA and KRA logging.properties.Endi S. Dewata2016-11-181-70/+0
| | | | | | | The logging.properties files in CA and KRA folders are never deployed so they have been removed. https://fedorahosted.org/pki/ticket/1897
* Moved policy framework classes to org.dogtagpki.legacy.Endi S. Dewata2016-11-112-4/+6
| | | | | | | To discourage the use of policy framework, the framework classes have been moved into org.dogtagpki.legacy. https://fedorahosted.org/pki/ticket/6
* Generalized list of files in CMakeLists.txt.Endi S. Dewata2016-11-111-5/+1
| | | | | | | | The list of source and class files in some CMake files have been generalized to allow renaming Java packages without changing the CMake files again. https://fedorahosted.org/pki/ticket/6
* Reverted policy framework deprecation.Endi S. Dewata2016-11-112-4/+0
| | | | | | | | | To reduce Eclipse warnings, classes and methods related to policy framework have been undeprecated. In the future the policy framework may be removed since it has already been replaced with the profile framework. https://fedorahosted.org/pki/ticket/6
* Replaced deprecated ProxyParser.Endi S. Dewata2016-11-041-2/+2
| | | | | | The deprecated ProxyParser has been replaced with DefaultParser. https://fedorahosted.org/pki/ticket/2535
* Removed duplicate classes.Endi S. Dewata2016-10-101-2/+2
| | | | | | | The CMake scripts have been modified to store compiled Java classes in separate folders for each JAR files to avoid duplicates. https://fedorahosted.org/pki/ticket/2505
* Compare serialised DNs in host authority checkFraser Tweedale2016-09-231-1/+6
| | | | | | | | | | | | | | | | | CA startup creates an LWCA entry for the host authority if it determines that one has not already been created. It determines if an LWCA entry corresponds to the host CA by comparing the DN from LDAP with the DN from the host authority's certificate. If the DN from the host authority's certificate contains values encoded as PrintableString, it will compare unequal to the DN from LDAP, which parses to UTF8String AVA values. This causes the addition of a spurious host authority entry every time the server starts. Serialise DNs before comparing, to avoid these false negatives. Fixes: https://fedorahosted.org/pki/ticket/2475
* Do not attempt LWCA key retrieval for host authorityFraser Tweedale2016-09-231-1/+6
| | | | | | | | | | | | | During two-step installation of externally-signed CA, installation can fail because host authority's private key cannot be located (a temporary condition), causing LWCA key replication to fire, which throws NullPointerException because the host authority's AuthorityID has not been set yet. Do not start key retrieval if the CA's AuthorityID is null (a condition which implies that the CA is the host authority). Fixes: https://fedorahosted.org/pki/ticket/2466
* Additional improvements for SigningUnit.Endi S. Dewata2016-09-211-0/+2
| | | | | | | To help troubleshooting the SigningUnit for CA have been modified to show additional log messages. https://fedorahosted.org/pki/ticket/2463
* Troubleshooting improvements for SigningUnit.Endi S. Dewata2016-09-201-12/+12
| | | | | | | To help troubleshooting the SigningUnit for CA and OCSP have been modified to chain the original exceptions. https://fedorahosted.org/pki/ticket/2463
* Perform host authority check before entryUSN checkFraser Tweedale2016-09-061-20/+21
| | | | | | | | | | | | | | When processing lightweight CAs, currently we perform the entryUSN check before the host authority check. If the entry does not have an entryUSN attribute, and if the DS USN plugin is not enabled, the entry gets skipped and we do not reach the host authority check. This causes the CA to believe that it has not seen the host authority entry, and results in additional entries being added. Move the host authority check before the entryUSN check to avoid this scenario. Fixes: https://fedorahosted.org/pki/ticket/2444
* Accept LWCA entry with missing entryUSN if plugin enabledFraser Tweedale2016-09-061-8/+38
| | | | | | | | | | | | | Currently we abort adding a lightweight CA if its entry does not have an 'entryUSN' attribute, and log a failure, even if the USN plugin is enabled. But if the plugin is enabled, it's fine to proceed. Update the authority monitor to check if the USN plugin is enabled and only log the failure if it is not. Clarify the log message accordingly. Part of: https://fedorahosted.org/pki/ticket/2444
* Prevent deletion of host CA cert and key from NSSDBFraser Tweedale2016-09-061-0/+7
| | | | | | | | | | | | | | | If authorityMonitor observes the deletion of the host CA's authority entry, it will treat it the same as any other lightweight CA and delete the signing cert AND KEY from the NSSDB. Because the database is replicated, the change would be observed and deletion immediately effected on all running clones. Unless the main CA private key is backed up somewhere there is no way to recover from this. Although this scenario does not arise in normal operation, the impact is severe so add a check that prevents cert and key deletion for host authority. Fixes: https://fedorahosted.org/pki/ticket/2443
* Revoke lightweight CA certificate on deletionFraser Tweedale2016-09-062-2/+39
| | | | Fixes: https://fedorahosted.org/pki/ticket/1638
* Fix CertRequestInfo URLsAde Lee2016-09-021-6/+1
| | | | | | | | | | The URLs were generated by a UriBuilder that referred to the resource's annotated path. This top-level path changed though, even if the underlying paths did not. Replace this with a reference to the getX methods instead. Also fixed a few eclipse flagged warnings (unused imports etc). Ticket 2447
* Fix lightweight CA PEM-encoded PKCS #7 cert chain retrievalFraser Tweedale2016-08-081-1/+1
| | | | | | | | The method to retrieve a lightweight CA's PEM-encoded PKCS #7 cert chain incorrectly returns X.509 data wrapped in PKCS7 PEM header. Return proper PKCS #7 data. Fixes: https://fedorahosted.org/pki/ticket/2433
* Fix CA OCSP responder when LWCAs are not in useFraser Tweedale2016-08-081-1/+5
| | | | | | | | | | | | | | | The CA subsystem OCSP responder was updated to handle dispatching OCSP requests to the relevant CertificateAuthority instance, according to the issuer of the certificates identified in the request. Unfortunately, the updated routine assumes that the database updates that enable lightweight CAs have occurred. If they have not, the OCSP responder always fails. Fix the issue by inferring that if 'caMap' is empty, lightweight CAs are not in use, the current instance is the one and only CA, and proceed straight to validation. Fixes: https://fedorahosted.org/pki/ticket/2420
* Add pkispawn option to disable Master CRLAde Lee2016-08-041-1/+1
|
* Make starting CRL Number configurable.Jack Magne2016-07-272-20/+52
| | | | | | | | | | | | | | | | | | | | | | | | | Ticket #2406 Make starting CRL Number configurable This simple patch provides a pkispawn config param that passes some starting crl number value to the config process. Here is a sample: [CA] pki_ca_starting_crl_number=4000 After the CA comes up the value of "crlNumber" in the db will reflect that value of 4000. Currently no other values are changed. We can talk about if we need more values reset in the given case. Also, this creates a setting in the CS.cfg ca.crl.MasterCrl.startingCrlNumber=4000 This setting is only consulted when the crl Issuing Point record is created for the first time.
* [MAN] Apply 'generateCRMFRequest() removed from Firefox' workarounds to ↵Jack Magne2016-07-144-2/+178
| | | | | | | | | | | | appropriate 'pki' man page This fix will involve the following changes to the source tree. 1. Fixes to the CS.cfg to add two new cert profiles. 2. Make the caDualCert.cfg profile invisible since it has little chance of working any more in Firefox. 3. Create caSigningUserCert.cfg and caSigningECUserCert.cfg to allow the CLI to have convenient profiles from which to enroll signing ONLY certificates.
* Fixed exception chain in SigningUnit.init().Endi S. Dewata2016-07-061-19/+26
| | | | | | | The SigningUnit.init() has been modified to chain the exceptions to help troubleshooting. https://fedorahosted.org/pki/ticket/2399
* Respond 400 if lightweight CA cert issuance failsFraser Tweedale2016-07-012-4/+17
| | | | | | | | | | | | | | If certificate issuance fails during lightweight CA creation (e.g. due to a profile constraint violation such as Subject DN not matching pattern) the API responds with status 500. Raise BadRequestDataException if cert issuance fails in a way that indicates bad or invalid CSR data, and catch it to respond with status 400. Also do some drive-by exception chaining. Fixes: https://fedorahosted.org/pki/ticket/2388
* Fix build on Fedora 25Fraser Tweedale2016-07-011-7/+0
| | | | | | | | Look for the right JAX-RS API JAR (it has moved in Fedora 25). Also remove a lot of redundant 'find_file' operations for this JAR. Fixes: https://fedorahosted.org/pki/ticket/2373
* Ticket #2346 support SHA384withRSAChristina Fu2016-06-1744-48/+48
| | | | This patch adds support for SHA384withRSA signing algorithm.
* Ticket #2298 Part3- trim down debug log in non-TMS crmf enrollmentsChristina Fu2016-06-171-1/+1
|
* UdnPwdDirAuth authentication plugin instance is not working.Jack Magne2016-06-172-473/+0
| | | | | | | | Ticket #1579 : UdnPwdDirAuth authentication plugin instance is not working. Since this class no longer works, we felt it best to just remove it from the server. This patch removes the references and files associated with this auth method.
* Revocation failure causes AUDIT_PRIVATE_KEY_ARCHIVE_REQUESTJack Magne2016-06-171-91/+81
| | | | | | | | | | The fix here is to make sure no archive related audits get issued for doing things other than key archivals. Other operations such as revoking and unrevoking cert in the code path laready have audit logs issued separately for success or failure. Ticket #2340.
* Removed unused Tomcat 6 files.Endi S. Dewata2016-06-171-58/+0
| | | | https://fedorahosted.org/pki/ticket/2363
* Ticket #2298 exclude some ldap record attributes with key archival This is ↵Christina Fu2016-06-162-1/+171
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | part 2 of: https://fedorahosted.org/pki/ticket/2298 [non-TMS] for key archival/recovery, not to record certain data in ldap and logs This patch allows one to exclude certain ldap attributes from the enrollment records for crmf requests (both CRMF, and CMC CRMF). The following are the highlights: * CRMF Manual approval profile is disabled: caDualCert.cfg - If excludedLdapAttrs.enabled is true, then this profile will not work, as the crmf requests (by default it is false) are not written to ldap record for agents to act on * excludedLdapAttrs.attrs can be used to configure the attribute list to be excluded * a new CRMF "auto approval" (directory based, needs to be setup) is provided * if excludedLdapAttrs.enabled is true (in both ca and kra), the following fields are not written to the ldap record in case of CRMF: (note: the code deliberately use literal strings on purpose for the reason that the exact literal strings need to be spelled out in excludedLdapAttrs.attrs if the admin chooses to override the default) "req_x509info", "publickey", "req_extensions", "cert_request", "req_archive_options", "req_key" * Because of the above (possible exclusion of cert requests in record, profiles that require agent manual approval will no longer function in the case that excludedLdapAttrs.enabled is true * a sleepOneMinute() method is added for debugging purpose. It is not called in the final code, but is left there for future debugging purpose * code was fixed so that in KRA request will display subject name even though the x509info is missing from request * cmc requests did not have request type in records, so they had to be added for differentiation The following have been tested: * CRMF auto enroll * CRMF manual enroll/approval * CMC-CRMF enroll * both CA and KRA internal ldap are examined for correct data exclusion Note: CRMF could potentially not include key archival option, however, I am not going to differentiate them at the moment. An earlier prototype I had built attempted to do that and the signing cert's record isn't excluded for attrs write while it's CRMF request is the same as that of its encryption cert counterpart within the same request. Due to this factor (multiple cert reqs with the same request blob), I am treating them the same for exclusion.
* Do not attempt cert update unless signing key is presentFraser Tweedale2016-06-151-2/+6
| | | | | | | | | | | | | | | | | | | If an authority entry is read with the authoritySerial attribute, and the serial differs from the known serial or the serial was previously unknown, Dogtag attempts to update the certificate in the NSSDB. The procedure is carried out during initialisation, and if it fails an exception is thrown, causing the CA to remain unknown. If the signing key is not yet in the NSSDB, the update is certain to fail. This can happen e.g. if CA is created on one clone while another clone is down. When the other clone comes up, it will immediately see the authoritySerial and trigger this scenario. To avoid this scenario, only attempt to update the certificate if the signing unit initialisation completed successfully, implying the presence of the signing key. Fixes: https://fedorahosted.org/pki/ticket/2359
* Fixed REST response format.Endi S. Dewata2016-06-141-2/+2
| | | | | | | Some REST services have been fixed to return the response in XML format by default. https://fedorahosted.org/pki/ticket/1276
* Add man page and clarify CLI for kra-connectorAde Lee2016-06-131-11/+19
|
* Modify ExternalProcessKeyRetriever to read JSONFraser Tweedale2016-06-052-15/+37
| | | | | | | | | | | | The ExternalProcessKeyRetriever currently uses a hackish format where the certificate and PKIArchiveOptions data are separated by a null byte. Update the code to expect JSON instead. No backwards compatibility is provided because at time of writing the ExternalProcessKeyRetriever is only used in a FreeIPA feature still under development. Fixes: https://fedorahosted.org/pki/ticket/2351
generated by cgit (git 2.34.1) at 2025-09-26 13:43:31 +0000