From a4f203666bc157bc2bcc09c7f1abd19d987d77ec Mon Sep 17 00:00:00 2001

From: jmagne <jmagne@redhat.com>

Date: Thu, 16 Apr 2020 10:23:08 -0700

Subject: [PATCH 1/6] Fix Bug 1809273 - CRL generation performs an unindexed

 search. (#378)

This fix right now will take care of new installations only.

Co-authored-by: Jack Magne <jmagne@test.host.com>

(cherry picked from commit e587f9557620a737fea3f3e1b14ec58e2957edb5)

---

 base/ca/shared/conf/CS.cfg                                |  2 +-

 base/ca/shared/conf/crlcaissuer.ldif                      | 15 +++++++++++++++

 base/ca/shared/conf/crlcaissuertasks.ldif                 |  7 +++++++

 .../netscape/cms/servlet/csadmin/ConfigurationUtils.java  | 11 +++++++++++

 4 files changed, 34 insertions(+), 1 deletion(-)

 create mode 100644 base/ca/shared/conf/crlcaissuer.ldif

 create mode 100644 base/ca/shared/conf/crlcaissuertasks.ldif

diff --git a/base/ca/shared/conf/CS.cfg b/base/ca/shared/conf/CS.cfg

index ce76cff..741d4aa 100644

--- a/base/ca/shared/conf/CS.cfg

+++ b/base/ca/shared/conf/CS.cfg

@@ -830,7 +830,7 @@ preop.internaldb.ldif=/usr/share/pki/server/conf/database.ldif

 preop.internaldb.data_ldif=/usr/share/pki/ca/conf/db.ldif,/usr/share/pki/ca/conf/acl.ldif

 preop.internaldb.index_ldif=/usr/share/pki/ca/conf/index.ldif

 preop.internaldb.manager_ldif=/usr/share/pki/server/conf/manager.ldif

-preop.internaldb.post_ldif=/usr/share/pki/ca/conf/vlv.ldif,/usr/share/pki/ca/conf/vlvtasks.ldif

+preop.internaldb.post_ldif=/usr/share/pki/ca/conf/vlv.ldif,/usr/share/pki/ca/conf/vlvtasks.ldif,/usr/share/pki/ca/conf/crlcaissuer.ldif,/usr/share/pki/ca/conf/crlcaissuertasks.ldif

 preop.internaldb.wait_dn=cn=index1160589769, cn=index, cn=tasks, cn=config

 preop.internaldb.index_task_ldif=/usr/share/pki/ca/conf/indextasks.ldif

 preop.internaldb.index_wait_dn=cn=index1160589770,cn=index,cn=tasks,cn=config

diff --git a/base/ca/shared/conf/crlcaissuer.ldif b/base/ca/shared/conf/crlcaissuer.ldif

new file mode 100644

index 0000000..2fec1a0

--- /dev/null

+++ b/base/ca/shared/conf/crlcaissuer.ldif

@@ -0,0 +1,15 @@

+dn: cn=allRevokedCertsByIssuer-{instanceId}, cn={database}, cn=ldbm database, cn=plugins, cn=config

+objectClass: top

+objectClass: vlvSearch

+cn: allRevokedCertsByIssuer-{instanceId}

+vlvBase: ou=certificateRepository,ou=ca,{rootSuffix}

+vlvScope: 1

+vlvFilter: (&(certStatus=REVOKED)(|(!(issuerName=*))(issuerName={caIssuerDN}))) 

+

+dn: cn=allRevokedCertsByIssuer-{instanceId}Index, cn=allRevokedCerts-{instanceId}, cn={database}, cn=ldbm database, cn=plugins, cn=config

+objectClass: top

+objectClass: vlvIndex

+cn: allRevokedCertsByIssuer-{instanceId}Index

+vlvSort: serialno

+vlvEnabled: 0

+vlvUses: 0

diff --git a/base/ca/shared/conf/crlcaissuertasks.ldif b/base/ca/shared/conf/crlcaissuertasks.ldif

new file mode 100644

index 0000000..888e113

--- /dev/null

+++ b/base/ca/shared/conf/crlcaissuertasks.ldif

@@ -0,0 +1,7 @@

+dn: cn=index1160589779, cn=index, cn=tasks, cn=config

+objectclass: top

+objectclass: extensibleObject

+cn: index1160589779

+ttl: 10

+nsinstance: {database}

+nsindexVLVAttribute: allRevokedCertsByIssuer-{instanceId}

diff --git a/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java b/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java

index aca4827..2510191 100644

--- a/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java

+++ b/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java

@@ -1701,6 +1701,8 @@ public class ConfigurationUtils {

             EBaseException {

         IConfigStore cs = CMS.getConfigStore();

+        String caIssuerName = null;

+

         CMS.debug("importLDIFS: param=" + param);

         String v = cs.getString(param);

@@ -1712,6 +1714,11 @@ public class ConfigurationUtils {

         String dbuser = cs.getString("preop.internaldb.dbuser",

                 "uid=" + DBUSER + ",ou=people," + baseDN);

+        if("ca".equalsIgnoreCase(cstype)) {

+            caIssuerName = cs.getString("preop.cert.signing.dn", null);

+            CMS.debug("importLDIFS(): ca issuer name = " + caIssuerName);

+        }

+

         String configDir = instancePath + File.separator + cstype.toLowerCase() + File.separator + "conf";

         StringTokenizer tokenizer = new StringTokenizer(v, ",");

@@ -1755,6 +1762,10 @@ public class ConfigurationUtils {

                             ps.print(database);

                         } else if (tok.equals("dbuser")) {

                             ps.print(dbuser);

+                        } else if (tok.equals("caIssuerDN") ) {

+                            if(caIssuerName != null) {

+                                ps.print(caIssuerName); 

+                            }

                         }

                         if ((s.length() + 1) == n1) {

                             endOfline = true;

-- 

1.8.3.1

From 944862c63e3f8fb4647b4728d9006e795c6ddc8d Mon Sep 17 00:00:00 2001

From: Alexander Scheel <ascheel@redhat.com>

Date: Fri, 17 Apr 2020 10:46:43 -0400

Subject: [PATCH 2/6] Add TPS Auditor group

Resolves: bz#1549307

Signed-off-by: Alexander Scheel <ascheel@redhat.com>

(cherry picked from commit b27cdf487b4dcbc9d16275f1b911643f3b03de57)

---

 base/tps/shared/conf/db.ldif | 6 ++++++

 1 file changed, 6 insertions(+)

diff --git a/base/tps/shared/conf/db.ldif b/base/tps/shared/conf/db.ldif

index a88e66b..6661d8b 100644

--- a/base/tps/shared/conf/db.ldif

+++ b/base/tps/shared/conf/db.ldif

@@ -41,6 +41,12 @@ objectClass: groupOfUniqueNames

 cn: Administrators

 description: Administrators for TPS

+dn: cn=Auditors,ou=Groups,{rootSuffix}

+objectClass: top

+objectClass: groupOfUniqueNames

+cn: Auditors

+description: People who can read the signed audit logs for TPS

+

 dn: cn=TPS Operators,ou=Groups,{rootSuffix}

 objectClass: top

 objectClass: groupOfUniqueNames

-- 

1.8.3.1

From b3d46362c83ff2aa8447aa579722d0be209ab590 Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Fri, 20 Mar 2020 18:58:26 -0400

Subject: [PATCH 3/6] Bug 1794213 Server-Side Kyegen Enrollment

This patch contains the code that provides the Server-Side Keygen Enrollment feature.

Some limitations for this release:

  - It currently only supports RSA keys.

  - You need to import the KRA's transport cert into CA's nssdb with the nickname

       "KRA Transport Certificate"

      then restart the CA.

  - Currently, the UI (Javascript) keyType and keySize pulldown menu needs some work

       (ProfileSelect.template)

  - Some more error checking and cleanup needed (will be done before actual push)

-----

This patch contains mainly the following pieces:

input:

  The new input plugin ServerKeygenInput.java, which is supposed

to work with the modification in ProfileSelect.template to

   - accept the p12 passwd that will be used to compose the p12 once the keys are generated on KRA and cert issued by the CA.

   - accept the keyType: RSA/ECC

   - accept the keySize: RSA key sizes or ECC curves

Profile:

  - The new default plugin: ServerKeygenUserKeyDefault.java, which inserts temporary fake keys so code won't blow up down the road; Such fake key will be replaced later when KRA generates the new keys

  - The new caServerKeygen_UserCert.cfg profile which utilizes the new input and output

output:

  The new output plugin PKCS12Output.java, which contains the p12 to be sent

back to the browser when the request has been approved.

What's expected:

  Once working, if you go to EE and click on (currently) the first profile:

"Manual User Dual-User Certificate Enrollment using server-side key generation",

one should expect to be able to specify the p12 password, p12 password

again (verified by the Javascript), the key type (RSA/ECC), key size/curve,

the subject name info, and the requestor info.

  Once filled out and submit, the request should go into the request queue

waiting to be approved.

During approval, the keys should be generated on KRA, archived, and pkcs#12 returned.

Finally:

Server-side key generation for enrollment is not intended to be a solution

for all.  It's mainly for encryption keys, unless the site administrator

 doesn't care about archiving signing keys.

https://bugzilla.redhat.com/show_bug.cgi?id=1794213

(cherry picked from commit 3e38d8cfae018a2a2ad69247c9d1b3e347b21ee0)

---

 base/ca/shared/conf/CS.cfg                         |   4 +-

 base/ca/shared/conf/registry.cfg                   |  15 +-

 .../shared/profiles/ca/caServerKeygen_UserCert.cfg | 103 ++++++

 .../shared/webapps/ca/ee/ca/ProfileSelect.template |  25 +-

 base/common/src/com/netscape/certsrv/apps/CMS.java |   1 +

 .../certsrv/cert/CertEnrollmentRequest.java        |  15 +

 .../netscape/certsrv/profile/IEnrollProfile.java   |   6 +

 .../com/netscape/certsrv/profile/ProfileData.java  |   3 +-

 .../com/netscape/certsrv/property/IDescriptor.java |   2 +

 .../src/com/netscape/certsrv/request/IRequest.java |   6 +

 .../src/com/netscape/kra/AsymKeyGenService.java    |  69 ++++

 base/kra/src/com/netscape/kra/KRAService.java      |   2 +-

 base/kra/src/com/netscape/kra/RecoveryService.java |  84 ++++-

 .../cms/profile/common/CAEnrollProfile.java        | 171 ++++++++-

 .../profile/def/ServerKeygenUserKeyDefault.java    | 385 +++++++++++++++++++++

 .../cms/profile/input/ServerKeygenInput.java       | 115 ++++++

 .../netscape/cms/profile/output/PKCS12Output.java  | 110 ++++++

 .../com/netscape/cms/servlet/base/CMSServlet.java  |   4 +

 .../cms/servlet/connector/ConnectorServlet.java    |  48 ++-

 .../cms/servlet/profile/ProfileProcessServlet.java |  31 +-

 base/server/cmsbundle/src/UserMessages.properties  |  13 +-

 .../netscape/cmscore/connector/HttpPKIMessage.java |   5 +

 .../cmscore/connector/RequestTransfer.java         |   4 +-

 23 files changed, 1198 insertions(+), 23 deletions(-)

 create mode 100644 base/ca/shared/profiles/ca/caServerKeygen_UserCert.cfg

 create mode 100644 base/server/cms/src/com/netscape/cms/profile/def/ServerKeygenUserKeyDefault.java

 create mode 100644 base/server/cms/src/com/netscape/cms/profile/input/ServerKeygenInput.java

 create mode 100644 base/server/cms/src/com/netscape/cms/profile/output/PKCS12Output.java

diff --git a/base/ca/shared/conf/CS.cfg b/base/ca/shared/conf/CS.cfg

index 741d4aa..004efdc 100644

--- a/base/ca/shared/conf/CS.cfg

+++ b/base/ca/shared/conf/CS.cfg

@@ -976,7 +976,7 @@ oidmap.pse.oid=2.16.840.1.113730.1.18

 oidmap.subject_info_access.class=netscape.security.extensions.SubjectInfoAccessExtension

 oidmap.subject_info_access.oid=1.3.6.1.5.5.7.1.11

 os.userid=nobody

-profile.list=caCMCserverCert,caCMCECserverCert,caCMCECsubsystemCert,caCMCsubsystemCert,caCMCauditSigningCert,caCMCcaCert,caCMCocspCert,caCMCkraTransportCert,caCMCkraStorageCert,caUserCert,caECUserCert,caUserSMIMEcapCert,caDualCert,caDirBasedDualCert,AdminCert,ECAdminCert,caSignedLogCert,caTPSCert,caRARouterCert,caRouterCert,caServerCert,caECServerCert,caSubsystemCert,caECSubsystemCert,caOtherCert,caCACert,caCMCcaCert,caCrossSignedCACert,caInstallCACert,caRACert,caOCSPCert,caStorageCert,caTransportCert,caDirPinUserCert,caECDirPinUserCert,caDirUserCert,caECDirUserCert,caAgentServerCert,caECAgentServerCert,caAgentFileSigning,caCMCUserCert,caCMCECUserCert,caFullCMCUserCert,caECFullCMCUserCert,caFullCMCUserSignedCert,caECFullCMCUserSignedCert,caFullCMCSharedTokenCert,caECFullCMCSharedTokenCert,caSimpleCMCUserCert,caECSimpleCMCUserCert,caTokenDeviceKeyEnrollment,caTokenUserEncryptionKeyEnrollment,caTokenUserSigningKeyEnrollment,caTempTokenDeviceKeyEnrollment,caTempTokenUserEncryptionKeyEnrollment,caTempTokenUserSigningKeyEnrollment,caAdminCert,caECAdminCert,caInternalAuthServerCert,caECInternalAuthServerCert,caInternalAuthTransportCert,caInternalAuthDRMstorageCert,caInternalAuthSubsystemCert,caECInternalAuthSubsystemCert,caInternalAuthOCSPCert,caInternalAuthAuditSigningCert,DomainController,caDualRAuserCert,caRAagentCert,caRAserverCert,caUUIDdeviceCert,caSSLClientSelfRenewal,caDirUserRenewal,caManualRenewal,caTokenMSLoginEnrollment,caTokenUserSigningKeyRenewal,caTokenUserEncryptionKeyRenewal,caTokenUserAuthKeyRenewal,caJarSigningCert,caIPAserviceCert,caEncUserCert,caSigningUserCert,caTokenUserDelegateAuthKeyEnrollment,caTokenUserDelegateSigningKeyEnrollment

+profile.list=caCMCserverCert,caCMCECserverCert,caCMCECsubsystemCert,caCMCsubsystemCert,caCMCauditSigningCert,caCMCcaCert,caCMCocspCert,caCMCkraTransportCert,caCMCkraStorageCert,caServerKeygen_UserCert,caUserCert,caECUserCert,caUserSMIMEcapCert,caDualCert,caDirBasedDualCert,AdminCert,ECAdminCert,caSignedLogCert,caTPSCert,caRARouterCert,caRouterCert,caServerCert,caECServerCert,caSubsystemCert,caECSubsystemCert,caOtherCert,caCACert,caCMCcaCert,caCrossSignedCACert,caInstallCACert,caRACert,caOCSPCert,caStorageCert,caTransportCert,caDirPinUserCert,caECDirPinUserCert,caDirUserCert,caECDirUserCert,caAgentServerCert,caECAgentServerCert,caAgentFileSigning,caCMCUserCert,caCMCECUserCert,caFullCMCUserCert,caECFullCMCUserCert,caFullCMCUserSignedCert,caECFullCMCUserSignedCert,caFullCMCSharedTokenCert,caECFullCMCSharedTokenCert,caSimpleCMCUserCert,caECSimpleCMCUserCert,caTokenDeviceKeyEnrollment,caTokenUserEncryptionKeyEnrollment,caTokenUserSigningKeyEnrollment,caTempTokenDeviceKeyEnrollment,caTempTokenUserEncryptionKeyEnrollment,caTempTokenUserSigningKeyEnrollment,caAdminCert,caECAdminCert,caInternalAuthServerCert,caECInternalAuthServerCert,caInternalAuthTransportCert,caInternalAuthDRMstorageCert,caInternalAuthSubsystemCert,caECInternalAuthSubsystemCert,caInternalAuthOCSPCert,caInternalAuthAuditSigningCert,DomainController,caDualRAuserCert,caRAagentCert,caRAserverCert,caUUIDdeviceCert,caSSLClientSelfRenewal,caDirUserRenewal,caManualRenewal,caTokenMSLoginEnrollment,caTokenUserSigningKeyRenewal,caTokenUserEncryptionKeyRenewal,caTokenUserAuthKeyRenewal,caJarSigningCert,caIPAserviceCert,caEncUserCert,caSigningUserCert,caTokenUserDelegateAuthKeyEnrollment,caTokenUserDelegateSigningKeyEnrollment

 profile.caUUIDdeviceCert.class_id=caEnrollImpl

 profile.caUUIDdeviceCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caUUIDdeviceCert.cfg

 profile.caManualRenewal.class_id=caEnrollImpl

@@ -1131,6 +1131,8 @@ profile.caStorageCert.class_id=caEnrollImpl

 profile.caStorageCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caStorageCert.cfg

 profile.caTransportCert.class_id=caEnrollImpl

 profile.caTransportCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caTransportCert.cfg

+profile.caServerKeygen_UserCert.class_id=caEnrollImpl

+profile.caServerKeygen_UserCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caServerKeygen_UserCert.cfg

 profile.caUserCert.class_id=caEnrollImpl

 profile.caUserCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caUserCert.cfg

 profile.caECUserCert.class_id=caEnrollImpl

diff --git a/base/ca/shared/conf/registry.cfg b/base/ca/shared/conf/registry.cfg

index a78af86..66348a6 100644

--- a/base/ca/shared/conf/registry.cfg

+++ b/base/ca/shared/conf/registry.cfg

@@ -57,7 +57,7 @@ constraintPolicy.uniqueKeyConstraintImpl.name=Unique Public Key Constraint

 constraintPolicy.externalProcessConstraintImpl.class=com.netscape.cms.profile.constraint.ExternalProcessConstraint

 constraintPolicy.externalProcessConstraintImpl.desc=External Process Constraint

 constraintPolicy.externalProcessConstraintImpl.name=External Process Constraint

-defaultPolicy.ids=noDefaultImpl,genericExtDefaultImpl,autoAssignDefaultImpl,subjectNameDefaultImpl,validityDefaultImpl,randomizedValidityDefaultImpl,caValidityDefaultImpl,subjectKeyIdentifierExtDefaultImpl,authorityKeyIdentifierExtDefaultImpl,basicConstraintsExtDefaultImpl,keyUsageExtDefaultImpl,nsCertTypeExtDefaultImpl,extendedKeyUsageExtDefaultImpl,ocspNoCheckExtDefaultImpl,issuerAltNameExtDefaultImpl,subjectAltNameExtDefaultImpl,userSubjectNameDefaultImpl,cmcUserSignedSubjectNameDefaultImpl,signingAlgDefaultImpl,userKeyDefaultImpl,userValidityDefaultImpl,userExtensionDefaultImpl,userSigningAlgDefaultImpl,authTokenSubjectNameDefaultImpl,subjectInfoAccessExtDefaultImpl,authInfoAccessExtDefaultImpl,nscCommentExtDefaultImpl,freshestCRLExtDefaultImpl,crlDistributionPointsExtDefaultImpl,policyConstraintsExtDefaultImpl,policyMappingsExtDefaultImpl,nameConstraintsExtDefaultImpl,certificateVersionDefaultImpl,certificatePoliciesExtDefaultImpl,subjectDirAttributesExtDefaultImpl,privateKeyPeriodExtDefaultImpl,inhibitAnyPolicyExtDefaultImpl,imageDefaultImpl,nsTokenDeviceKeySubjectNameDefaultImpl,nsTokenUserKeySubjectNameDefaultImpl,authzRealmDefaultImpl,commonNameToSANDefaultImpl

+defaultPolicy.ids=noDefaultImpl,genericExtDefaultImpl,autoAssignDefaultImpl,subjectNameDefaultImpl,validityDefaultImpl,randomizedValidityDefaultImpl,caValidityDefaultImpl,subjectKeyIdentifierExtDefaultImpl,authorityKeyIdentifierExtDefaultImpl,basicConstraintsExtDefaultImpl,keyUsageExtDefaultImpl,nsCertTypeExtDefaultImpl,extendedKeyUsageExtDefaultImpl,ocspNoCheckExtDefaultImpl,issuerAltNameExtDefaultImpl,subjectAltNameExtDefaultImpl,userSubjectNameDefaultImpl,cmcUserSignedSubjectNameDefaultImpl,signingAlgDefaultImpl,userKeyDefaultImpl,userValidityDefaultImpl,userExtensionDefaultImpl,userSigningAlgDefaultImpl,authTokenSubjectNameDefaultImpl,subjectInfoAccessExtDefaultImpl,authInfoAccessExtDefaultImpl,nscCommentExtDefaultImpl,freshestCRLExtDefaultImpl,crlDistributionPointsExtDefaultImpl,policyConstraintsExtDefaultImpl,policyMappingsExtDefaultImpl,nameConstraintsExtDefaultImpl,certificateVersionDefaultImpl,certificatePoliciesExtDefaultImpl,subjectDirAttributesExtDefaultImpl,privateKeyPeriodExtDefaultImpl,inhibitAnyPolicyExtDefaultImpl,imageDefaultImpl,nsTokenDeviceKeySubjectNameDefaultImpl,nsTokenUserKeySubjectNameDefaultImpl,authzRealmDefaultImpl,commonNameToSANDefaultImpl,serverKeygenUserKeyDefaultImpl

 defaultPolicy.autoAssignDefaultImpl.class=com.netscape.cms.profile.def.AutoAssignDefault

 defaultPolicy.autoAssignDefaultImpl.desc=Auto Request Assignment Default

 defaultPolicy.autoAssignDefaultImpl.name=Auto Request Assignment Default

@@ -82,6 +82,9 @@ defaultPolicy.cmcUserSignedSubjectNameDefaultImpl.name=CMC User Signed Subject N

 defaultPolicy.userKeyDefaultImpl.class=com.netscape.cms.profile.def.UserKeyDefault

 defaultPolicy.userKeyDefaultImpl.desc=User Supplied Key Default

 defaultPolicy.userKeyDefaultImpl.name=User Supplied Key Default

+defaultPolicy.serverKeygenUserKeyDefaultImpl.class=com.netscape.cms.profile.def.ServerKeygenUserKeyDefault

+defaultPolicy.serverKeygenUserKeyDefaultImpl.desc=Server-Side Keygen Default

+defaultPolicy.serverKeygenUserKeyDefaultImpl.name=Server-Side Keygen Default

 defaultPolicy.userValidityDefaultImpl.class=com.netscape.cms.profile.def.UserValidityDefault

 defaultPolicy.userValidityDefaultImpl.desc=User Supplied Validity Default

 defaultPolicy.userValidityDefaultImpl.name=User Supplied Validity Default

@@ -197,7 +200,10 @@ profile.caServerCertEnrollImpl.name=Server Certificate Enrollment Profile

 profile.caUserCertEnrollImpl.class=com.netscape.cms.profile.common.UserCertCAEnrollProfile

 profile.caUserCertEnrollImpl.desc=Certificate Authority User Certificate Enrollment Profile

 profile.caUserCertEnrollImpl.name=User Certificate Enrollment Profile

-profileInput.ids=cmcCertReqInputImpl,certReqInputImpl,keyGenInputImpl,encKeyGenInputImpl,signKeyGenInputImpl,dualKeyGenInputImpl,subjectNameInputImpl,submitterInfoInputImpl,genericInputImpl,fileSigningInputImpl,imageInputImpl,subjectDNInputImpl,nsNKeyCertReqInputImpl,nsHKeyCertReqInputImpl,serialNumRenewInputImpl,subjectAltNameExtInputImpl

+profileInput.ids=cmcCertReqInputImpl,certReqInputImpl,keyGenInputImpl,encKeyGenInputImpl,signKeyGenInputImpl,dualKeyGenInputImpl,subjectNameInputImpl,submitterInfoInputImpl,genericInputImpl,fileSigningInputImpl,imageInputImpl,subjectDNInputImpl,nsNKeyCertReqInputImpl,nsHKeyCertReqInputImpl,serialNumRenewInputImpl,subjectAltNameExtInputImpl,serverKeygenInputImpl

+profileInput.serverKeygenInputImpl.class=com.netscape.cms.profile.input.ServerKeygenInput

+profileInput.serverKeygenInputImpl.desc=Server-Side Keygen Input

+profileInput.serverKeygenInputImpl.name=Server-Side Keygen Input

 profileInput.subjectAltNameExtInputImpl.class=com.netscape.cms.profile.input.SubjectAltNameExtInput

 profileInput.subjectAltNameExtInputImpl.desc=SAN Input

 profileInput.subjectAltNameExtInputImpl.name=SAN Input

@@ -246,7 +252,7 @@ profileInput.subjectDNInputImpl.name=Subject DN Input

 profileInput.subjectNameInputImpl.class=com.netscape.cms.profile.input.SubjectNameInput

 profileInput.subjectNameInputImpl.desc=Subject Name Input

 profileInput.subjectNameInputImpl.name=Subject Name Input

-profileOutput.ids=certOutputImpl,cmmfOutputImpl,pkcs7OutputImpl,nsNKeyOutputImpl

+profileOutput.ids=certOutputImpl,cmmfOutputImpl,pkcs7OutputImpl,nsNKeyOutputImpl,pkcs12OutputImpl

 profileOutput.certOutputImpl.class=com.netscape.cms.profile.output.CertOutput

 profileOutput.certOutputImpl.desc=Certificate Output

 profileOutput.certOutputImpl.name=Certificate Output

@@ -259,6 +265,9 @@ profileOutput.nsNKeyOutputImpl.name=nsNKeyOutputImpl

 profileOutput.pkcs7OutputImpl.class=com.netscape.cms.profile.output.PKCS7Output

 profileOutput.pkcs7OutputImpl.desc=PKCS7 Output

 profileOutput.pkcs7OutputImpl.name=PKCS7 Output

+profileOutput.pkcs12OutputImpl.class=com.netscape.cms.profile.output.PKCS12Output

+profileOutput.pkcs12OutputImpl.desc=PKCS12 Output

+profileOutput.pkcs12OutputImpl.name=PKCS12 Output

 profileUpdater.ids=subsystemGroupUpdaterImpl

 profileUpdater.subsystemGroupUpdaterImpl.class=com.netscape.cms.profile.updater.SubsystemGroupUpdater

 profileUpdater.subsystemGroupUpdaterImpl.desc=Updater for Subsystem Group

diff --git a/base/ca/shared/profiles/ca/caServerKeygen_UserCert.cfg b/base/ca/shared/profiles/ca/caServerKeygen_UserCert.cfg

new file mode 100644

index 0000000..0f2b3dc

--- /dev/null

+++ b/base/ca/shared/profiles/ca/caServerKeygen_UserCert.cfg

@@ -0,0 +1,103 @@

+desc=This certificate profile is for enrolling user certificates using server-side Key generation.

+visible=true

+enable=true

+enableBy=admin

+name=Manual User Dual-Use Certificate Enrollment using server-side Key generation

+auth.class_id=

+input.list=i1,i2,i3

+input.i1.class_id=serverKeygenInputImpl

+input.i2.class_id=subjectNameInputImpl

+input.i3.class_id=submitterInfoInputImpl

+output.list=o1

+output.o1.class_id=pkcs12OutputImpl

+policyset.list=userCertSet

+policyset.userCertSet.list=1,10,2,3,4,5,6,7,8,9

+policyset.userCertSet.1.constraint.class_id=subjectNameConstraintImpl

+policyset.userCertSet.1.constraint.name=Subject Name Constraint

+policyset.userCertSet.1.constraint.params.pattern=UID=.*

+policyset.userCertSet.1.constraint.params.accept=true

+policyset.userCertSet.1.default.class_id=userSubjectNameDefaultImpl

+policyset.userCertSet.1.default.name=Subject Name Default

+policyset.userCertSet.1.default.params.name=

+policyset.userCertSet.10.constraint.class_id=renewGracePeriodConstraintImpl

+policyset.userCertSet.10.constraint.name=Renewal Grace Period Constraint

+policyset.userCertSet.10.constraint.params.renewal.graceBefore=30

+policyset.userCertSet.10.constraint.params.renewal.graceAfter=30

+policyset.userCertSet.10.default.class_id=noDefaultImpl

+policyset.userCertSet.10.default.name=No Default

+policyset.userCertSet.2.constraint.class_id=validityConstraintImpl

+policyset.userCertSet.2.constraint.name=Validity Constraint

+policyset.userCertSet.2.constraint.params.range=365

+policyset.userCertSet.2.constraint.params.notBeforeCheck=false

+policyset.userCertSet.2.constraint.params.notAfterCheck=false

+policyset.userCertSet.2.default.class_id=validityDefaultImpl

+policyset.userCertSet.2.default.name=Validity Default

+policyset.userCertSet.2.default.params.range=180

+policyset.userCertSet.2.default.params.startTime=0

+policyset.userCertSet.3.constraint.class_id=keyConstraintImpl

+policyset.userCertSet.3.constraint.name=Key Constraint

+policyset.userCertSet.3.constraint.params.keyType=RSA

+policyset.userCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096

+policyset.userCertSet.3.default.class_id=serverKeygenUserKeyDefaultImpl

+policyset.userCertSet.3.default.name=Server-Side Keygen Default

+policyset.userCertSet.3.default.params.keyType=RSA

+policyset.userCertSet.3.default.params.keySize=2048

+policyset.userCertSet.4.constraint.class_id=noConstraintImpl

+policyset.userCertSet.4.constraint.name=No Constraint

+policyset.userCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl

+policyset.userCertSet.4.default.name=Authority Key Identifier Default

+policyset.userCertSet.5.constraint.class_id=noConstraintImpl

+policyset.userCertSet.5.constraint.name=No Constraint

+policyset.userCertSet.5.default.class_id=authInfoAccessExtDefaultImpl

+policyset.userCertSet.5.default.name=AIA Extension Default

+policyset.userCertSet.5.default.params.authInfoAccessADEnable_0=true

+policyset.userCertSet.5.default.params.authInfoAccessADLocationType_0=URIName

+policyset.userCertSet.5.default.params.authInfoAccessADLocation_0=

+policyset.userCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1

+policyset.userCertSet.5.default.params.authInfoAccessCritical=false

+policyset.userCertSet.5.default.params.authInfoAccessNumADs=1

+policyset.userCertSet.6.constraint.class_id=keyUsageExtConstraintImpl

+policyset.userCertSet.6.constraint.name=Key Usage Extension Constraint

+policyset.userCertSet.6.constraint.params.keyUsageCritical=true

+policyset.userCertSet.6.constraint.params.keyUsageDigitalSignature=true

+policyset.userCertSet.6.constraint.params.keyUsageNonRepudiation=true

+policyset.userCertSet.6.constraint.params.keyUsageDataEncipherment=false

+policyset.userCertSet.6.constraint.params.keyUsageKeyEncipherment=true

+policyset.userCertSet.6.constraint.params.keyUsageKeyAgreement=false

+policyset.userCertSet.6.constraint.params.keyUsageKeyCertSign=false

+policyset.userCertSet.6.constraint.params.keyUsageCrlSign=false

+policyset.userCertSet.6.constraint.params.keyUsageEncipherOnly=false

+policyset.userCertSet.6.constraint.params.keyUsageDecipherOnly=false

+policyset.userCertSet.6.default.class_id=keyUsageExtDefaultImpl

+policyset.userCertSet.6.default.name=Key Usage Default

+policyset.userCertSet.6.default.params.keyUsageCritical=true

+policyset.userCertSet.6.default.params.keyUsageDigitalSignature=true

+policyset.userCertSet.6.default.params.keyUsageNonRepudiation=true

+policyset.userCertSet.6.default.params.keyUsageDataEncipherment=false

+policyset.userCertSet.6.default.params.keyUsageKeyEncipherment=true

+policyset.userCertSet.6.default.params.keyUsageKeyAgreement=false

+policyset.userCertSet.6.default.params.keyUsageKeyCertSign=false

+policyset.userCertSet.6.default.params.keyUsageCrlSign=false

+policyset.userCertSet.6.default.params.keyUsageEncipherOnly=false

+policyset.userCertSet.6.default.params.keyUsageDecipherOnly=false

+policyset.userCertSet.7.constraint.class_id=noConstraintImpl

+policyset.userCertSet.7.constraint.name=No Constraint

+policyset.userCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl

+policyset.userCertSet.7.default.name=Extended Key Usage Extension Default

+policyset.userCertSet.7.default.params.exKeyUsageCritical=false

+policyset.userCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.4

+policyset.userCertSet.8.constraint.class_id=noConstraintImpl

+policyset.userCertSet.8.constraint.name=No Constraint

+policyset.userCertSet.8.default.class_id=subjectAltNameExtDefaultImpl

+policyset.userCertSet.8.default.name=Subject Alt Name Constraint

+policyset.userCertSet.8.default.params.subjAltNameExtCritical=false

+policyset.userCertSet.8.default.params.subjAltExtType_0=RFC822Name

+policyset.userCertSet.8.default.params.subjAltExtPattern_0=$request.requestor_email$

+policyset.userCertSet.8.default.params.subjAltExtGNEnable_0=true

+policyset.userCertSet.8.default.params.subjAltNameNumGNs=1

+policyset.userCertSet.9.constraint.class_id=signingAlgConstraintImpl

+policyset.userCertSet.9.constraint.name=No Constraint

+policyset.userCertSet.9.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,SHA1withEC,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC

+policyset.userCertSet.9.default.class_id=signingAlgDefaultImpl

+policyset.userCertSet.9.default.name=Signing Alg

+policyset.userCertSet.9.default.params.signingAlg=-

diff --git a/base/ca/shared/webapps/ca/ee/ca/ProfileSelect.template b/base/ca/shared/webapps/ca/ee/ca/ProfileSelect.template

index 666d20f..350cb9b 100644

--- a/base/ca/shared/webapps/ca/ee/ca/ProfileSelect.template

+++ b/base/ca/shared/webapps/ca/ee/ca/ProfileSelect.template

@@ -109,6 +109,15 @@ if (isNaN(majorVersion)) {

    majorVersion = parseInt(navigator.appVersion, 10);

 }

+function passwdValidate()

+{

+

+    if (document.forms[0].serverSideKeygenP12Passwd.value != document.forms[0].p12PasswordAgain.value) {

+        alert("Passwords do not match");

+        return false;

+    }

+    return true;

+}

 function isIE() {

    if ( "ActiveXObject" in window ) {

@@ -535,7 +544,7 @@ function setCRMFRequest()

   } else if (typeof(crypto) != "undefined" && typeof(crypto.version) != "undefined") {

     document.writeln('<form name="ReqForm" onSubmit="return validate();" method="post" action="' + uri + '">');

   } else {

-    document.writeln('<form name="ReqForm" method="post" action="' + uri + '">');

+    document.writeln('<form name="ReqForm" method="post" onSubmit="return passwdValidate()" action="' + uri + '">');

    }

 </script>

@@ -741,6 +750,20 @@ for (var m = 0; m < inputPluginListSet.length; m++) {

     document.writeln('');

     if (inputListSet[n].inputSyntax == 'string') {

       document.writeln('<input type=text name=' + inputListSet[n].inputId + '>');

+    } else if (inputListSet[n].inputSyntax == 'server_side_keygen_request_type') {

+        // get PKCS#12 password

+        document.writeln('');

+        document.write('<font size="-1" face="PrimaSans BT, Verdana, sans-serif">PKCS #12 Password:</font>');

+        document.write('<font size="-1" face="PrimaSans BT, Verdana, sans-serif"><input type=password name="serverSideKeygenP12Passwd" value="" AutoComplete=off ></font>');

+        document.writeln('');

+

+        document.writeln('');

+        document.write('<font size="-1" face="PrimaSans BT, Verdana, sans-serif">PKCS #12 Password again:</font>');

+        document.write('<font size="-1" face="PrimaSans BT, Verdana, sans-serif"><input type=password name="p12PasswordAgain" value="" AutoComplete=off ></font>');

+        document.writeln('<SELECT NAME="keyType">'+getKeyTypesOptionsForKeyGen()+'</SELECT>  <SELECT NAME=\"cryptprovider\"></SELECT>');

+        document.writeln('<SELECT NAME="keySize">'+keyLengthsCurvesOptions("")+'</SELECT>  <SELECT NAME=\"cryptprovider\"></SELECT>');

+        document.writeln('');

+

     } else if (inputListSet[n].inputSyntax == 'cert_request') {

       document.writeln('<textarea cols=60 rows=10 name=' + inputListSet[n].inputId + '></textarea>');

     } else if (inputListSet[n].inputSyntax == 'cert_request_type') {

diff --git a/base/common/src/com/netscape/certsrv/apps/CMS.java b/base/common/src/com/netscape/certsrv/apps/CMS.java

index 8efa3b7..1dace42 100644

--- a/base/common/src/com/netscape/certsrv/apps/CMS.java

+++ b/base/common/src/com/netscape/certsrv/apps/CMS.java

@@ -1550,6 +1550,7 @@ public final class CMS {

                 name.equalsIgnoreCase("uPasswd") ||

                 name.equalsIgnoreCase("PASSWORD_CACHE_ADD") ||

                 name.startsWith("p12Password") ||

+                name.startsWith("serverSideKeygenP12Passwd") ||

                 name.equalsIgnoreCase("host_challenge") ||

                 name.equalsIgnoreCase("card_challenge") ||

                 name.equalsIgnoreCase("card_cryptogram") ||

diff --git a/base/common/src/com/netscape/certsrv/cert/CertEnrollmentRequest.java b/base/common/src/com/netscape/certsrv/cert/CertEnrollmentRequest.java

index e3ea69c..00d1040 100644

--- a/base/common/src/com/netscape/certsrv/cert/CertEnrollmentRequest.java

+++ b/base/common/src/com/netscape/certsrv/cert/CertEnrollmentRequest.java

@@ -57,10 +57,14 @@ public class CertEnrollmentRequest extends ResourceMessage {

     private static final String PROFILE_ID = "profileId";

     private static final String RENEWAL = "renewal";

     private static final String SERIAL_NUM = "serial_num";

+    private static final String SERVERSIDE_KEYGEN_P12_PASSWD = "serverSideKeygenP12Passwd";

     @XmlElement(name="ProfileID")

     protected String profileId;

+    @XmlElement(name="ServerSideKeygenP12Passwd")

+    protected String serverSideKeygenP12Passwd;

+

     @XmlElement(name="Renewal")

     protected boolean renewal;

@@ -89,6 +93,8 @@ public class CertEnrollmentRequest extends ResourceMessage {

         String renewalStr = form.getFirst(RENEWAL);

         serialNum = new CertId(form.getFirst(SERIAL_NUM));

         renewal = new Boolean(renewalStr);

+

+        serverSideKeygenP12Passwd = form.getFirst(SERVERSIDE_KEYGEN_P12_PASSWD);

     }

     /**

@@ -213,6 +219,7 @@ public class CertEnrollmentRequest extends ResourceMessage {

         if (serialNum != null) ret.put(SERIAL_NUM, serialNum.toHexString());

         if (remoteHost != null) ret.put("remoteHost", remoteHost);

         if (remoteAddr != null) ret.put("remoteAddr", remoteAddr);

+        if (serverSideKeygenP12Passwd != null) ret.put(SERVERSIDE_KEYGEN_P12_PASSWD, serverSideKeygenP12Passwd);

         for (ProfileInput input: inputs) {

             for (ProfileAttribute attr : input.getAttributes()) {

@@ -299,6 +306,9 @@ public class CertEnrollmentRequest extends ResourceMessage {

         result = prime * result + ((remoteHost == null) ? 0 : remoteHost.hashCode());

         result = prime * result + (renewal ? 1231 : 1237);

         result = prime * result + ((serialNum == null) ? 0 : serialNum.hashCode());

+

+//cfu?

+        result = prime * result + ((serverSideKeygenP12Passwd == null) ? 0 : serverSideKeygenP12Passwd.hashCode());

         return result;

     }

@@ -343,6 +353,11 @@ public class CertEnrollmentRequest extends ResourceMessage {

                 return false;

         } else if (!serialNum.equals(other.serialNum))

             return false;

+        if (serverSideKeygenP12Passwd == null) {

+            if (other.serverSideKeygenP12Passwd != null)

+                return false;

+        } else if (!serverSideKeygenP12Passwd.equals(other.serverSideKeygenP12Passwd))

+            return false;

         return true;

     }

diff --git a/base/common/src/com/netscape/certsrv/profile/IEnrollProfile.java b/base/common/src/com/netscape/certsrv/profile/IEnrollProfile.java

index 34543cb..8002540 100644

--- a/base/common/src/com/netscape/certsrv/profile/IEnrollProfile.java

+++ b/base/common/src/com/netscape/certsrv/profile/IEnrollProfile.java

@@ -148,6 +148,12 @@ public interface IEnrollProfile extends IProfile {

     public static final String REQUEST_ISSUED_CERT = "req_issued_cert";

     /**

+     * Name of request attribute that stores the issued P12 from server-side keygen.

+     * 

+     */

+    public static final String REQUEST_ISSUED_P12 = "req_issued_p12";

+

+    /**

      * Name of request attribute that stores the transport certificate.

      * 

      * The value is of type String including base64 encoded certificate.

diff --git a/base/common/src/com/netscape/certsrv/profile/ProfileData.java b/base/common/src/com/netscape/certsrv/profile/ProfileData.java

index 4b35fee..7d3623a 100644

--- a/base/common/src/com/netscape/certsrv/profile/ProfileData.java

+++ b/base/common/src/com/netscape/certsrv/profile/ProfileData.java

@@ -313,4 +313,5 @@ public class ProfileData {

         data.setXMLOutput(false);

     }

-}

\ No newline at end of file

+}

+

diff --git a/base/common/src/com/netscape/certsrv/property/IDescriptor.java b/base/common/src/com/netscape/certsrv/property/IDescriptor.java

index 830ecdb..4de6bb3 100644

--- a/base/common/src/com/netscape/certsrv/property/IDescriptor.java

+++ b/base/common/src/com/netscape/certsrv/property/IDescriptor.java

@@ -45,6 +45,8 @@ public interface IDescriptor {

     public static String DUAL_KEYGEN_REQUEST_TYPE = "dual_keygen_request_type";

     public static String CERT_REQUEST = "cert_request";

     public static String CERT_REQUEST_TYPE = "cert_request_type";

+    public static String SERVER_SIDE_KEYGEN_REQUEST_TYPE = "server_side_keygen_request_type";

+    public static String SERVER_SIDE_KEYGEN_PKCS12 = "server_side_keygen_p12";

     public static String CHOICE = "choice"; // choice of strings

     public static String DN = "dn";

     public static String IP = "ip";

diff --git a/base/common/src/com/netscape/certsrv/request/IRequest.java b/base/common/src/com/netscape/certsrv/request/IRequest.java

index cfc4ca0..47dde82 100644

--- a/base/common/src/com/netscape/certsrv/request/IRequest.java

+++ b/base/common/src/com/netscape/certsrv/request/IRequest.java

@@ -197,6 +197,12 @@ public interface IRequest extends Serializable {

     public static final String KEY_GEN_USAGES = "keyGenUsages";

     public static final String KEY_GEN_TRANS_WRAPPED_SESSION_KEY = "transWrappedSessionKey";

+    // Server-side Keygen enrollment

+    //public static final String SERVER_SIDE_KEYGEN_ENROLL = "serverSideKeygenEnroll";

+    public static final String SSK_STAGE = "serverSideKeygenStage";

+    public static final String SSK_STAGE_KEYGEN = "serverSideKeygenStage_keygen";

+    public static final String SSK_STAGE_KEY_RETRIEVE = "serverSideKeygenStage_key_retrieve";

+

     // requestor type values.

     public static final String REQUESTOR_EE = "EE";

     public static final String REQUESTOR_RA = "RA";

diff --git a/base/kra/src/com/netscape/kra/AsymKeyGenService.java b/base/kra/src/com/netscape/kra/AsymKeyGenService.java

index 6571044..dca6ebc 100644

--- a/base/kra/src/com/netscape/kra/AsymKeyGenService.java

+++ b/base/kra/src/com/netscape/kra/AsymKeyGenService.java

@@ -19,6 +19,7 @@ package com.netscape.kra;

 import java.math.BigInteger;

 import java.security.KeyPair;

+import java.util.Enumeration;

 import org.mozilla.jss.crypto.KeyPairGeneratorSpi;

 import org.mozilla.jss.crypto.PrivateKey;

@@ -42,6 +43,7 @@ import com.netscape.certsrv.security.IStorageKeyUnit;

 import com.netscape.cms.logging.Logger;

 import com.netscape.cms.logging.SignedAuditLogger;

 import com.netscape.cmscore.dbs.KeyRecord;

+import com.netscape.cmsutil.crypto.CryptoUtil;

 import netscape.security.util.WrappingParams;

@@ -72,8 +74,24 @@ public class AsymKeyGenService implements IService {

     @Override

     public boolean serviceRequest(IRequest request) throws EBaseException {

+        String method = "AsymKeyGenService:serviceRequest: ";

         IConfigStore configStore = CMS.getConfigStore();

+

+        boolean isSSKeygen = false;

+        String isSSKeygenStr = request.getExtDataInString("isServerSideKeygen");

+        if ((isSSKeygenStr != null) && isSSKeygenStr.equalsIgnoreCase("true")) {

+            CMS.debug(method + "isServerSideKeygen = true");

+            isSSKeygen = true;

+        } else {

+            CMS.debug(method + "isServerSideKeygen = false");

+        }

+

         String clientKeyId = request.getExtDataInString(IRequest.SECURITY_DATA_CLIENT_KEY_ID);

+        if (clientKeyId != null)

+            CMS.debug(method + "clientKeyId = " + clientKeyId);

+        else

+            CMS.debug(method + "clientKeyId not found");

+

         String algorithm = request.getExtDataInString(IRequest.KEY_GEN_ALGORITHM);

         String keySizeStr = request.getExtDataInString(IRequest.KEY_GEN_SIZE);

@@ -159,6 +177,35 @@ public class AsymKeyGenService implements IService {

             throw new EBaseException("Failed to generate asymmetric key!");

         }

+        if (isSSKeygen) {

+            byte[] publicKeyData = null;

+            String pubKeyStr = "";

+            try {

+                publicKeyData = kp.getPublic().getEncoded();

+                if (publicKeyData == null) {

+                    request.setExtData(IRequest.RESULT, Integer.valueOf(4));

+                    CMS.debug(method + " failed getting publickey encoded");

+                    return false;

+                } else {

+                    //CMS.debug(method + "public key binary length ="+ publicKeyData.length);

+                    if (algorithm.equals("EC")) {

+                        /* url encode */

+                        pubKeyStr = com.netscape.cmsutil.util.Utils.SpecialEncode(publicKeyData);

+                        CMS.debug(method + " EC pubKeyStr special encoded");

+                    } else {

+                        pubKeyStr = CryptoUtil.base64Encode(publicKeyData);

+                    }

+

+                    //CMS.debug(method + "public key length =" + pubKeyStr.length());

+                    request.setExtData("public_key", pubKeyStr);

+                }

+            } catch (Exception e) {

+                CMS.debug(method + e);

+                request.setExtData(IRequest.RESULT, Integer.valueOf(4));

+                return false;

+            }

+        }

+

         byte[] privateSecurityData = null;

         WrappingParams params = null;

@@ -194,6 +241,7 @@ public class AsymKeyGenService implements IService {

         record.set(KeyRecord.ATTR_STATUS, STATUS_ACTIVE);

         record.set(KeyRecord.ATTR_KEY_SIZE, keySize);

         request.setExtData(ATTR_KEY_RECORD, serialNo);

+        request.setExtData("serialNumber", serialNo);

         if (realm != null) {

             record.set(KeyRecord.ATTR_REALM, realm);

@@ -212,7 +260,28 @@ public class AsymKeyGenService implements IService {

         auditAsymKeyGenRequestProcessed(auditSubjectID, ILogger.SUCCESS, request.getRequestId(),

                 clientKeyId, new KeyId(serialNo), "None");

         request.setExtData(IRequest.RESULT, IRequest.RES_SUCCESS);

+

+        if (isSSKeygen) {

+

+            Enumeration<String> ereq = request.getExtDataKeys();

+

+            /* cfu

+            CMS.debug(method + "let's find out what's in the request");

+            while (ereq.hasMoreElements()) {

+                String reqKey = ereq.nextElement();

+                String reqVal = request.getExtDataInString(reqKey);

+                if (reqVal != null) {

+                    CMS.debug(method + reqKey + ": " + reqVal);

+                } else {

+                    CMS.debug(method + reqKey + ": no value");

+                }

+            }

+            */

+

+            request.setExtData("delayLDAPCommit", "false");

+        }

         kra.getRequestQueue().updateRequest(request);

+

         return true;

     }

diff --git a/base/kra/src/com/netscape/kra/KRAService.java b/base/kra/src/com/netscape/kra/KRAService.java

index f57b293..91ee5f9 100644

--- a/base/kra/src/com/netscape/kra/KRAService.java

+++ b/base/kra/src/com/netscape/kra/KRAService.java

@@ -50,7 +50,7 @@ public class KRAService implements IService {

     public final static String SECURITY_DATA_RECOVERY = IRequest.SECURITY_DATA_RECOVERY_REQUEST;

     public final static String SYMKEY_GENERATION = IRequest.SYMKEY_GENERATION_REQUEST;

     public final static String ASYMKEY_GENERATION = IRequest.ASYMKEY_GENERATION_REQUEST;

-

+    //public final static String SERVER_SIDE_KEYGEN_ENROLL = IRequest.SERVER_SIDE_KEYGEN_ENROLL;

     // private variables

     private IKeyRecoveryAuthority mKRA = null;

diff --git a/base/kra/src/com/netscape/kra/RecoveryService.java b/base/kra/src/com/netscape/kra/RecoveryService.java

index 96ee73b..4f2add9 100644

--- a/base/kra/src/com/netscape/kra/RecoveryService.java