From 53eec401f222178ff2ac34fd6223b121f485969d Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Fri, 12 Aug 2016 02:23:18 +0200

Subject: [PATCH 01/10] Removed PKCS #7 from add user cert dialog in TPS UI.

The dialog box for adding user certificate in TPS UI has been

modified to no longer mention PKCS #7. The REST service itself

still accepts PKCS #7, but it should be cleaned up in the future.

https://fedorahosted.org/pki/ticket/2437

(cherry picked from commit d27d4600784acb49c42764d02835dedf3ee87227)

(cherry picked from commit 2dae5f18fa5c68f7923b6b6691395790fb14791f)

---

 base/server/cms/src/org/dogtagpki/server/rest/UserService.java | 2 ++

 base/tps/shared/webapps/tps/ui/user-certs.html                 | 2 +-

 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/base/server/cms/src/org/dogtagpki/server/rest/UserService.java b/base/server/cms/src/org/dogtagpki/server/rest/UserService.java

index 0893c4b..1f8e9fa 100644

--- a/base/server/cms/src/org/dogtagpki/server/rest/UserService.java

+++ b/base/server/cms/src/org/dogtagpki/server/rest/UserService.java

@@ -863,6 +863,8 @@ public class UserService extends PKIService implements UserResource {

             }

             if (cert == null) {

+                // TODO: Remove this code. Importing PKCS #7 is not supported.

+

                 // cert chain direction

                 boolean assending = true;

diff --git a/base/tps/shared/webapps/tps/ui/user-certs.html b/base/tps/shared/webapps/tps/ui/user-certs.html

index 049583e..04593f3 100644

--- a/base/tps/shared/webapps/tps/ui/user-certs.html

+++ b/base/tps/shared/webapps/tps/ui/user-certs.html

@@ -93,7 +93,7 @@

                     <input name="userID" readonly="readonly">

                     <label>Certificate</label>

                     <textarea name="encoded" rows="20" cols="80"></textarea>

-                    Enter a PEM certificate or PKCS #7 data.

+                    Enter a PEM certificate.

                 </fieldset>

-- 

1.8.3.1

From 3bfd5acb075751e429eeb8b46f17c624a5178a41 Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Fri, 12 Aug 2016 04:42:25 +0200

Subject: [PATCH 02/10] Added cert validation error message in selftest log.

To help troubleshooting the selftest log has been modified to

include the cert validation error message returned by JSS.

https://fedorahosted.org/pki/ticket/2436

(cherry picked from commit 0fd31368d871c513c9833ca02bc08d15a48d6aa5)

(cherry picked from commit 488303542161103cbbac6814dffd8818fccf455d)

---

 .../src/com/netscape/cms/selftests/common/SystemCertsVerification.java  | 2 +-

 base/server/cmsbundle/src/LogMessages.properties                        | 2 +-

 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/base/server/cms/src/com/netscape/cms/selftests/common/SystemCertsVerification.java b/base/server/cms/src/com/netscape/cms/selftests/common/SystemCertsVerification.java

index e4fc1cb..cc52f83 100644

--- a/base/server/cms/src/com/netscape/cms/selftests/common/SystemCertsVerification.java

+++ b/base/server/cms/src/com/netscape/cms/selftests/common/SystemCertsVerification.java

@@ -200,7 +200,7 @@ public class SystemCertsVerification

         } catch (Exception e) {

             String logMessage = CMS.getLogMessage(

                     "SELFTESTS_COMMON_SYSTEM_CERTS_VERIFICATION_FAILURE",

-                    getSelfTestName());

+                    getSelfTestName(), e.getMessage());

             mSelfTestSubsystem.log(logger, logMessage);

             throw e;

         }

diff --git a/base/server/cmsbundle/src/LogMessages.properties b/base/server/cmsbundle/src/LogMessages.properties

index 12c580a..0bcbcc5 100644

--- a/base/server/cmsbundle/src/LogMessages.properties

+++ b/base/server/cmsbundle/src/LogMessages.properties

@@ -2766,7 +2766,7 @@ SELFTESTS_PARAMETER_WAS_NULL={0}:  a self test parameter was null

 SELFTESTS_MISSING_NAME={0}:  the self test property name {1} does not exist

 SELFTESTS_MISSING_VALUES={0}:  the self test property name {1} contained no value(s)

 SELFTESTS_INVALID_VALUES={0}:  the self test property name {1} contained invalid value(s)

-SELFTESTS_COMMON_SYSTEM_CERTS_VERIFICATION_FAILURE={0}: system certs verification failure

+SELFTESTS_COMMON_SYSTEM_CERTS_VERIFICATION_FAILURE={0}: system certs verification failure: {1}

 SELFTESTS_COMMON_SYSTEM_CERTS_VERIFICATION_SUCCESS={0}: system certs verification success

 SELFTESTS_CA_IS_NOT_PRESENT={0}:  CA is NOT present

 SELFTESTS_CA_IS_NOT_INITIALIZED={0}:  CA is NOT yet initialized

-- 

1.8.3.1

From 6431cac7c8f6a4874249bf1ea8b287e1a9a9f0c3 Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Fri, 12 Aug 2016 23:06:24 +0200

Subject: [PATCH 03/10] Added exception wrapper for invalid LDAP attribute

 syntax.

The LDAPExceptionConverter has been modified to wrap LDAPException

for invalid attribute syntax with BadRequestException.

https://fedorahosted.org/pki/ticket/833

(cherry picked from commit 71acaed02642c618a729fbebbf7a7025684967a3)

(cherry picked from commit 26aa8bd616148b5318b87817aafae926d1c375d2)

---

 .../src/com/netscape/certsrv/ldap/LDAPExceptionConverter.java       | 6 ++++--

 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/base/common/src/com/netscape/certsrv/ldap/LDAPExceptionConverter.java b/base/common/src/com/netscape/certsrv/ldap/LDAPExceptionConverter.java

index 88b1263..51a1109 100644

--- a/base/common/src/com/netscape/certsrv/ldap/LDAPExceptionConverter.java

+++ b/base/common/src/com/netscape/certsrv/ldap/LDAPExceptionConverter.java

@@ -17,13 +17,13 @@

 // --- END COPYRIGHT BLOCK ---

 package com.netscape.certsrv.ldap;

-import netscape.ldap.LDAPException;

-

 import com.netscape.certsrv.base.BadRequestException;

 import com.netscape.certsrv.base.ConflictingOperationException;

 import com.netscape.certsrv.base.PKIException;

 import com.netscape.certsrv.base.ResourceNotFoundException;

+import netscape.ldap.LDAPException;

+

 /**

  * @author Endi S. Dewata

  */

@@ -39,6 +39,8 @@ public class LDAPExceptionConverter {

             return new ResourceNotFoundException("No such attribute.", e);

         case LDAPException.INVALID_DN_SYNTAX:

             return new BadRequestException("Invalid DN syntax.", e);

+        case LDAPException.INVALID_ATTRIBUTE_SYNTAX:

+            return new BadRequestException("Invalid attribute syntax.", e);

         case LDAPException.ENTRY_ALREADY_EXISTS:

             return new ConflictingOperationException("Entry already exists.", e);

         default:

-- 

1.8.3.1

From 90c6537038caa9a241d1c4123e1a642860a0aa5a Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Tue, 16 Aug 2016 00:15:15 +0200

Subject: [PATCH 04/10] Removed misleading log in SelfTestSubsystem.

To avoid confusion, the isSelfTestCriticalAtStartup() and

isSelfTestCriticalOnDemand() in SelfTestSubsystem have been

modified to no longer log an error message if the selftest

being checked does not exist in the corresponding property

in CS.cfg.

https://fedorahosted.org/pki/ticket/2432

(cherry picked from commit 6bfee0e46aee93e1255ecb5652d46348557664d5)

(cherry picked from commit 422fc92597d80aa115efa59a592fbaf8851b243e)

---

 .../com/netscape/cmscore/selftests/SelfTestSubsystem.java  | 14 ++------------

 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java b/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java

index ff938dd..8dc95cc 100644

--- a/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java

+++ b/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java

@@ -473,12 +473,7 @@ public class SelfTestSubsystem

             }

         }

-        // self test plugin instance property name is not present

-        log(mLogger,

-                CMS.getLogMessage(

-                        "CMSCORE_SELFTESTS_PROPERTY_MISSING_NAME",

-                        instanceFullName));

-

+        // self test undefined in selftests.container.order.onDemand

         throw new EMissingSelfTestException(instanceFullName);

     }

@@ -799,12 +794,7 @@ public class SelfTestSubsystem

             }

         }

-        // self test plugin instance property name is not present

-        log(mLogger,

-                CMS.getLogMessage(

-                        "CMSCORE_SELFTESTS_PROPERTY_MISSING_NAME",

-                        instanceFullName));

-

+        // self test undefined in selftests.container.order.startup

         throw new EMissingSelfTestException(instanceFullName);

     }

-- 

1.8.3.1

From 561191eacd168ed3b75de0c502ee82a6517f4348 Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Tue, 16 Aug 2016 01:43:36 +0200

Subject: [PATCH 05/10] Fixed SelfTestService.findSelfTests().

The SelfTestService.findSelfTests() has been modified to return

all selftests defined in the CS.cfg.

https://fedorahosted.org/pki/ticket/2432

(cherry picked from commit 4001335ed5105112c64c433a26272286ecf66196)

(cherry picked from commit e860276fc5889aae40beda33ea523358fbe76911)

---

 .../common/src/com/netscape/certsrv/selftests/ISelfTestSubsystem.java | 4 ++++

 base/server/cms/src/org/dogtagpki/server/rest/SelfTestService.java    | 2 +-

 .../cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java | 4 ++++

 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/base/common/src/com/netscape/certsrv/selftests/ISelfTestSubsystem.java b/base/common/src/com/netscape/certsrv/selftests/ISelfTestSubsystem.java

index c07b96a..a55c651 100644

--- a/base/common/src/com/netscape/certsrv/selftests/ISelfTestSubsystem.java

+++ b/base/common/src/com/netscape/certsrv/selftests/ISelfTestSubsystem.java

@@ -20,6 +20,8 @@

 package com.netscape.certsrv.selftests;

+import java.util.Collection;

+

 ///////////////////////

 // import statements //

 ///////////////////////

@@ -68,6 +70,8 @@ public interface ISelfTestSubsystem

     // ISelfTestSubsystem methods //

     ////////////////////////////////

+    public Collection<String> getSelfTestNames();

+

     //

     // methods associated with the list of on demand self tests

     //

diff --git a/base/server/cms/src/org/dogtagpki/server/rest/SelfTestService.java b/base/server/cms/src/org/dogtagpki/server/rest/SelfTestService.java

index e662ba9..9108a45 100644

--- a/base/server/cms/src/org/dogtagpki/server/rest/SelfTestService.java

+++ b/base/server/cms/src/org/dogtagpki/server/rest/SelfTestService.java

@@ -113,7 +113,7 @@ public class SelfTestService extends PKIService implements SelfTestResource {

             // filter self tests

             Collection<String> results = new ArrayList<String>();

-            for (String name : subsystem.listSelfTestsEnabledOnDemand()) {

+            for (String name : subsystem.getSelfTestNames()) {

                 if (filter != null && !name.contains(filter)) continue;

                 results.add(name);

             }

diff --git a/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java b/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java

index 8dc95cc..d7d7a3a 100644

--- a/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java

+++ b/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java

@@ -243,6 +243,10 @@ public class SelfTestSubsystem

     // SelfTestSubsystem methods //

     ///////////////////////////////

+    public Collection<String> getSelfTestNames() {

+        return mSelfTestInstances.keySet();

+    }

+

     //

     // methods associated with the list of on demand self tests

     //

-- 

1.8.3.1

From 15a6f83a651949af7ba7bfe8fc1b3626d064fa87 Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Thu, 18 Aug 2016 05:40:25 +0200

Subject: [PATCH 06/10] Added debug messages for

 ConfigurationUtils.handleCerts().

To help troubleshooting some debug messages have been added into

ConfigurationUtils.handleCerts().

https://fedorahosted.org/pki/ticket/2436

(cherry picked from commit 9aa6640e7e94a591343478ee806a6e6d4c9f81e8)

(cherry picked from commit 4e5c8e53345d500bfa620267a8ae35df0e2973b6)

---

 .../cms/servlet/csadmin/ConfigurationUtils.java     | 21 ++++++++++++++++++++-

 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java b/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java

index 7723665..3bd6d87 100644

--- a/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java

+++ b/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java

@@ -3153,6 +3153,9 @@ public class ConfigurationUtils {

         String tokenname = config.getString("preop.module.token", "");

         if (cert.getType().equals("local") && b64.equals("...certificate be generated internally...")) {

+

+            CMS.debug("handleCerts(): processing local cert");

+

             String pubKeyType = config.getString(PCERT_PREFIX + certTag + ".keytype");

             X509Key x509key = null;

             if (pubKeyType.equals("rsa")) {

@@ -3177,24 +3180,33 @@ public class ConfigurationUtils {

                 CMS.debug("handleCerts(): nickname=" + nickname);

                 try {

+                    CMS.debug("handleCerts(): deleting existing cert");

                     if (certTag.equals("sslserver") && findBootstrapServerCert())

                         deleteBootstrapServerCert();

                     if (findCertificate(tokenname, nickname))

                         deleteCert(tokenname, nickname);

+

+                    CMS.debug("handleCerts(): importing new cert");

                     if (certTag.equals("signing") && subsystem.equals("ca"))

                         CryptoUtil.importUserCertificate(impl, nickname);

                     else

                         CryptoUtil.importUserCertificate(impl, nickname, false);

                     CMS.debug("handleCerts(): cert imported for certTag '" + certTag + "'");

+

                 } catch (Exception ee) {

                     CMS.debug(ee);

                     CMS.debug("handleCerts(): import certificate for certTag=" + certTag + " Exception: "

                             + ee.toString());

                 }

             }

+

         } else if (cert.getType().equals("remote")) {

+

+            CMS.debug("handleCerts(): processing remote cert");

+

             if (b64 != null && b64.length() > 0 && !b64.startsWith("...")) {

-                CMS.debug("handleCerts(): process remote...import cert");

+

+                CMS.debug("handleCerts(): deleting existing cert");

                 String b64chain = cert.getCertChain();

                 try {

@@ -3207,6 +3219,7 @@ public class ConfigurationUtils {

                     CMS.debug("ConfigurationUtils: update (remote): deleteCert Exception=" + e.toString());

                 }

+                CMS.debug("handleCerts(): importing new cert");

                 b64 = CryptoUtil.stripCertBrackets(b64.trim());

                 String certs = CryptoUtil.normalizeCertStr(b64);

                 byte[] certb = CryptoUtil.base64Decode(certs);

@@ -3256,11 +3269,16 @@ public class ConfigurationUtils {

                 CMS.debug("handleCerts(): b64 not set");

                 return 1;

             }

+

         } else {

+            CMS.debug("handleCerts(): processing " + cert.getType() + " cert");

+

             b64 = CryptoUtil.stripCertBrackets(b64.trim());

             String certs = CryptoUtil.normalizeCertStr(b64);

             byte[] certb = CryptoUtil.base64Decode(certs);

             X509CertImpl impl = new X509CertImpl(certb);

+

+            CMS.debug("handleCerts(): deleting existing cert");

             try {

                 if (certTag.equals("sslserver") && findBootstrapServerCert())

                     deleteBootstrapServerCert();

@@ -3271,6 +3289,7 @@ public class ConfigurationUtils {

                 CMS.debug("handleCerts(): deleteCert Exception=" + ee.toString());

             }

+            CMS.debug("handleCerts(): importing new cert");

             try {

                 if (certTag.equals("signing") && subsystem.equals("ca"))

                     CryptoUtil.importUserCertificate(impl, nickname);

-- 

1.8.3.1

From 361eb16c8558f5be6cdb65ab412ab4f703a10bdc Mon Sep 17 00:00:00 2001

From: Matthew Harmsen <mharmsen@redhat.com>

Date: Fri, 19 Aug 2016 15:58:12 -0600

Subject: [PATCH 07/10] pki-tools HEADER/FOOTER changes

* PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements

(cherry picked from commit 534633885ae28db230786c25374fba66120ed933)

(cherry picked from commit 94e009a03036194f4ee09a9a159acd906179ec9d)

---

 base/java-tools/src/com/netscape/cmstools/CMCEnroll.java    | 13 ++++++++-----

 base/java-tools/src/com/netscape/cmstools/CMCRequest.java   |  4 ++--

 base/java-tools/src/com/netscape/cmstools/CMCRevoke.java    | 11 ++++++-----

 .../java-tools/src/com/netscape/cmstools/CRMFPopClient.java |  8 ++++++--

 base/java-tools/src/com/netscape/cmstools/PKCS10Client.java | 11 +++++++----

 5 files changed, 29 insertions(+), 18 deletions(-)

diff --git a/base/java-tools/src/com/netscape/cmstools/CMCEnroll.java b/base/java-tools/src/com/netscape/cmstools/CMCEnroll.java

index d13ed13..dc4b191 100644

--- a/base/java-tools/src/com/netscape/cmstools/CMCEnroll.java

+++ b/base/java-tools/src/com/netscape/cmstools/CMCEnroll.java

@@ -79,8 +79,11 @@ public class CMCEnroll {

     public static final String PR_REQUEST_PKCS10 = "PKCS10";

     public static final int ARGC = 4;

-    public static final String HEADER = "-----BEGIN NEW CERTIFICATE REQUEST-----";

-    public static final String TRAILER = "-----END NEW CERTIFICATE REQUEST-----";

+    public static final String HEADER = "-----BEGIN";

+    public static final String TRAILER = "-----END";

+    // From https://www.rfc-editor.org/rfc/rfc7468.txt

+    public static final String RFC7468_HEADER = "-----BEGIN CERTIFICATE REQUEST-----";

+    public static final String RFC7468_TRAILER = "-----END CERTIFICATE REQUEST-----";

     void cleanArgs(String[] s) {

@@ -434,10 +437,10 @@ public class CMCEnroll {

                     return;

                 }

-                System.out.println(HEADER);

-                System.out.println(asciiBASE64Blob.toString() + TRAILER);

+                System.out.println(RFC7468_HEADER);

+                System.out.println(asciiBASE64Blob.toString() + RFC7468_TRAILER);

                 try {

-                    asciiBASE64Blob_str = HEADER + "\n" + asciiBASE64Blob_str.toString() + TRAILER;

+                    asciiBASE64Blob_str = RFC7468_HEADER + "\n" + asciiBASE64Blob_str.toString() + RFC7468_TRAILER;

                     outputBlob.write(asciiBASE64Blob_str.getBytes());

                 } catch (IOException e) {

                     System.out.println("CMCEnroll:  I/O error " +

diff --git a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java

index 167c461..1f508c3 100644

--- a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java

+++ b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java

@@ -97,8 +97,8 @@ public class CMCRequest {

     public static final String PR_INTERNAL_TOKEN_NAME = "internal";

     public static final int ARGC = 1;

-    public static final String HEADER = "-----BEGIN NEW CERTIFICATE REQUEST-----";

-    public static final String TRAILER = "-----END NEW CERTIFICATE REQUEST-----";

+    public static final String HEADER = "-----BEGIN";

+    public static final String TRAILER = "-----END";

     void cleanArgs(String[] s) {

diff --git a/base/java-tools/src/com/netscape/cmstools/CMCRevoke.java b/base/java-tools/src/com/netscape/cmstools/CMCRevoke.java

index 3f9d811..45c3f07 100644

--- a/base/java-tools/src/com/netscape/cmstools/CMCRevoke.java

+++ b/base/java-tools/src/com/netscape/cmstools/CMCRevoke.java

@@ -69,8 +69,9 @@ import com.netscape.cmsutil.util.Utils;

  */

 public class CMCRevoke {

     public static final int ARGC = 8;

-    public static final String HEADER = "-----BEGIN NEW CERTIFICATE REQUEST-----";

-    public static final String TRAILER = "-----END NEW CERTIFICATE REQUEST-----";

+    // From https://www.rfc-editor.org/rfc/rfc7468.txt

+    public static final String RFC7468_HEADER = "-----BEGIN CERTIFICATE REQUEST-----";

+    public static final String RFC7468_TRAILER = "-----END CERTIFICATE REQUEST-----";

     static String dValue = null, nValue = null, iValue = null, sValue = null, mValue = null, hValue = null,

             pValue = null, cValue = null;

@@ -224,10 +225,10 @@ public class CMCRevoke {

             return;

         }

-        System.out.println(HEADER);

-        System.out.println(asciiBASE64Blob + TRAILER);

+        System.out.println(RFC7468_HEADER);

+        System.out.println(asciiBASE64Blob + RFC7468_TRAILER);

         try {

-            asciiBASE64Blob = HEADER + "\n" + asciiBASE64Blob + TRAILER;

+            asciiBASE64Blob = RFC7468_HEADER + "\n" + asciiBASE64Blob + RFC7468_TRAILER;

             outputBlob.write(asciiBASE64Blob.getBytes());

         } catch (IOException e) {

             System.out.println("CMCSigning:  I/O error " +

diff --git a/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java b/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java

index 76d8f51..450f950 100644

--- a/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java

+++ b/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java

@@ -101,6 +101,10 @@ public class CRMFPopClient {

     public boolean verbose;

+    // From https://www.rfc-editor.org/rfc/rfc7468.txt

+    public static final String RFC7468_HEADER = "-----BEGIN CERTIFICATE REQUEST-----";

+    public static final String RFC7468_TRAILER = "-----END CERTIFICATE REQUEST-----";

+

     public static Options createOptions() {

         Options options = new Options();

@@ -472,9 +476,9 @@ public class CRMFPopClient {

             StringWriter sw = new StringWriter();

             try (PrintWriter out = new PrintWriter(sw)) {

-                out.println("-----BEGIN NEW CERTIFICATE REQUEST-----");

+                out.println(RFC7468_HEADER);

                 out.println(request);

-                out.println("-----END NEW CERTIFICATE REQUEST-----");

+                out.println(RFC7468_TRAILER);

             }

             String csr = sw.toString();

diff --git a/base/java-tools/src/com/netscape/cmstools/PKCS10Client.java b/base/java-tools/src/com/netscape/cmstools/PKCS10Client.java

index d1c787e..0a35827 100644

--- a/base/java-tools/src/com/netscape/cmstools/PKCS10Client.java

+++ b/base/java-tools/src/com/netscape/cmstools/PKCS10Client.java

@@ -71,6 +71,9 @@ import com.netscape.cmsutil.util.Utils;

  * @version $Revision$, $Date$

  */

 public class PKCS10Client {

+    // From https://www.rfc-editor.org/rfc/rfc7468.txt

+    public static final String RFC7468_HEADER = "-----BEGIN CERTIFICATE REQUEST-----";

+    public static final String RFC7468_TRAILER = "-----END CERTIFICATE REQUEST-----";

     private static void printUsage() {

         System.out.println(

@@ -323,15 +326,15 @@ public class PKCS10Client {

                 b64E = CryptoUtil.base64Encode(certReqb);

             }

-            System.out.println("-----BEGIN NEW CERTIFICATE REQUEST-----");

+            System.out.println(RFC7468_HEADER);

             System.out.println(b64E);

-            System.out.println("-----END NEW CERTIFICATE REQUEST-----");

+            System.out.println(RFC7468_TRAILER);

             PrintStream ps = null;

             ps = new PrintStream(new FileOutputStream(ofilename));

-            ps.println("-----BEGIN NEW CERTIFICATE REQUEST-----");

+            ps.println(RFC7468_HEADER);

             ps.println(b64E);

-            ps.println("-----END NEW CERTIFICATE REQUEST-----");

+            ps.println(RFC7468_TRAILER);

             ps.flush();

             ps.close();

             System.out.println("PKCS10Client: done. Request written to file: "+ ofilename);

-- 

1.8.3.1

From f11b2d72f710e4a8a25e3779b2e57eb6b66742b7 Mon Sep 17 00:00:00 2001

From: Matthew Harmsen <mharmsen@redhat.com>

Date: Fri, 19 Aug 2016 16:08:56 -0600

Subject: [PATCH 08/10] pki-tools CMCEnroll man page

* PKI TRAC Ticket #690 - [MAN] pki-tools man pages

      - CMCEnroll

(cherry picked from commit fb8cff8cef10580ff5c14c5d5df535613779f9c5)

(cherry picked from commit 44046589bc9ed15d591d863056698232c25514bd)

---

 base/java-tools/man/man1/CMCEnroll.1 | 570 +++++++++++++++++++++++++++++++++++

 1 file changed, 570 insertions(+)

 create mode 100644 base/java-tools/man/man1/CMCEnroll.1

diff --git a/base/java-tools/man/man1/CMCEnroll.1 b/base/java-tools/man/man1/CMCEnroll.1

new file mode 100644

index 0000000..4cc861f

--- /dev/null

+++ b/base/java-tools/man/man1/CMCEnroll.1

@@ -0,0 +1,570 @@

+.\" First parameter, NAME, should be all caps

+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection

+.\" other parameters are allowed: see man(7), man(1)

+.TH CMCEnroll 1 "July 20, 2016" "version 10.3" "PKI CMC Enrollment Tool" Dogtag Team

+.\" Please adjust this date whenever revising the man page.

+.\"

+.\" Some roff macros, for reference:

+.\" .nh        disable hyphenation

+.\" .hy        enable hyphenation

+.\" .ad l      left justify

+.\" .ad b      justify to both left and right margins

+.\" .nf        disable filling

+.\" .fi        enable filling

+.\" .br        insert line break

+.\" .sp <n>    insert n+1 empty lines

+.\" for man page specific macros, see man(7)

+.SH NAME

+CMCEnroll \- Used to sign a certificate request with an agent's certificate.

+

+.SH SYNOPSIS

+.PP

+\fBCMCEnroll -d <directory_of_NSS_security_database_containing_agent_cert> -n <certificate_nickname> -r <certificate_request_file> -p <certificate_DB_passwd>\fP

+

+.SH DESCRIPTION

+.PP

+The Certificate Management over Cryptographic Message Syntax (CMC) Enrollment utility, \fBCMCEnroll\fP, provides a command-line utility used to sign a certificate request with an agent's certificate. This can be used in conjunction with the CA end-entity CMC Enrollment form to sign and enroll certificates for users.

+.PP

+\fBCMCEnroll\fP takes a standard PKCS #10 certificate request and signs it with an agent certificate. The output is also a certificate request which can be submitted through the appropriate profile.

+

+.SH OPTIONS

+.PP

+The following parameters are mandatory:

+.PP

+\fBNote:\fP

+Surround values that include spaces with quotation marks.

+.TP

+.B -d <directory_of_NSS_security_database_containing_agent_cert>

+The directory containing the \fBcert8.db\fP, \fBkey3.db\fP, and \fBsecmod.db\fP files associated with the agent certificate. This is usually the agent's personal directory, such as their browser certificate database in the home directory.

+

+.TP

+.B -n <certificate_nickname>

+The nickname of the agent certificate that is used to sign the request.

+

+.TP

+.B -r <certificate_request_file>

+The filename of the certificate request.

+

+.TP

+.B -p <certificate_DB_passwd>

+The password to the NSS certificate database which contains the agent certificate, given in \fB-d <directory_of_NSS_security_database_containing_agent_cert>\fP.

+

+.SH EXAMPLES

+.PP

+Signed requests must be submitted to the CA to be processed.

+.PP

+\fBNote:\fP For this example to work automatically, the \fBCMCAuth\fP plug-in must be enabled on the CA server (which it is by default).

+.TP

+(1) Create a PKCS #10 certificate request using a tool like \fBcertutil\fP:

+.IP

+.nf

+# cd ~/.mozilla/firefox/<browser profile>

+

+# certutil -d . -L

+Certificate Nickname                                         Trust Attributes

+                                                             SSL,S/MIME,JAR/XPI

+

+Google Internet Authority G2                                 ,,

+COMODO RSA Domain Validation Secure Server CA                ,,

+pki.example.com                                              ,,

+DigiCert SHA2 Secure Server CA                               ,,

+DigiCert SHA2 Extended Validation Server CA                  ,,

+COMODO RSA Extended Validation Secure Server CA 2            ,,

+Symantec Class 3 Secure Server CA - G4                       ,,

+Go Daddy Secure Certificate Authority - G2                   ,,

+Oracle SSL CA - G2                                           ,,

+GeoTrust EV SSL CA - G4                                      ,,

+Symantec Class 3 Secure Server SHA256 SSL CA                 ,,

+GeoTrust SSL CA - G3                                         ,,

+PKI Administrator for example.com                            u,u,u

+DigiCert SHA2 High Assurance Server CA                       ,,

+COMODO RSA Organization Validation Secure Server CA          ,,

+CA Signing Certificate - example.com Security Domain         CT,C,C

+

+# certutil -d . -R -s "CN=CMCEnroll Test Certificate" -a

+

+A random seed must be generated that will be used in the

+creation of your key.  One of the easiest ways to create a

+random seed is to use the timing of keystrokes on a keyboard.

+

+To begin, type keys on the keyboard until this progress meter

+is full.  DO NOT USE THE AUTOREPEAT FUNCTION ON YOUR KEYBOARD!

+

+

+Continue typing until the progress meter is full:

+

+|************************************************************|

+

+Finished.  Press enter to continue:

+

+

+Generating key.  This may take a few moments...

+

+

+Certificate request generated by Netscape certutil

+Phone: (not specified)

+

+Common Name: CMCEnroll Test Certificate

+Email: (not specified)

+Organization: (not specified)

+State: (not specified)

+Country: (not specified)

+

+-----BEGIN CERTIFICATE REQUEST-----

+MIICajCCAVICAQAwJTEjMCEGA1UEAxMaQ01DRW5yb2xsIFRlc3QgQ2VydGlmaWNh

+dGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDamQA6psK7Tnic3DAt

+IyAMCk7FK3PuSseJSrR/C7W05tPvrlp5vUKxpmcA+Pg3AANp5gVMQOps6riAvoK7

+6NKTkw4Me09Cowad7ay9IBBY4QqqBmRnfT3Mm6U5tJWeqvq1cIkwoxzHllgsGBGM

+QduI7URjhQYx3p+srGSe0fM7bqK+AU6aJh4r0jc1A6pCv/2XMOY1IUzmjIEnNq2R

+WOpnsWQ4UDma1r8sUzKgNhkuhjPU5U5YGt9+0jiuqv14dbKi7UJN3DPtkEXZNOrF

+rGgqKhdUqLhrdm+x/Hgw/aZoSDFYXON9jFTFyMUyUkWXZq5sfwghWUC2q4DsbfvH

+68h1AgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAQ9aHQvPDcDuOJOL62pQeoDJp

+YtFmsDaksdhedG27usjPuX06XmzSIV3/D2zfPib2fpfdrHB5901TdehlghQVOkN6

+sSoih60GSD9zCkFD1eESywJJeZssRfDG4gk2Ls9wXz5ZY/QwSx6C97SodF0cuDHL

+FsymesuxhePL7sYkkmazjgQTkA/JXLe6FYX213xQ+FGfQvmAqc9xHu5jvnBXX+Ub

+ucixaLKUiRIVHfTmuUb/qenEBQM2vzWDZawHL5SBSa/Zxjy2iVMrQBeOiLcu8bTL

+TAmSCbonRTilFrKFVG0H+Y9+5bulOdJc64XOvj9DRJd1FJoocw0eGhw31I5rJA==

+-----END CERTIFICATE REQUEST-----

+.if

+

+.TP

+(2) Copy the PKCS #10 ASCII output to a text file.

+.IP

+.nf

+# vi cert.req

+-----BEGIN CERTIFICATE REQUEST-----

+MIICajCCAVICAQAwJTEjMCEGA1UEAxMaQ01DRW5yb2xsIFRlc3QgQ2VydGlmaWNh

+dGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDamQA6psK7Tnic3DAt

+IyAMCk7FK3PuSseJSrR/C7W05tPvrlp5vUKxpmcA+Pg3AANp5gVMQOps6riAvoK7

+6NKTkw4Me09Cowad7ay9IBBY4QqqBmRnfT3Mm6U5tJWeqvq1cIkwoxzHllgsGBGM

+QduI7URjhQYx3p+srGSe0fM7bqK+AU6aJh4r0jc1A6pCv/2XMOY1IUzmjIEnNq2R

+WOpnsWQ4UDma1r8sUzKgNhkuhjPU5U5YGt9+0jiuqv14dbKi7UJN3DPtkEXZNOrF

+rGgqKhdUqLhrdm+x/Hgw/aZoSDFYXON9jFTFyMUyUkWXZq5sfwghWUC2q4DsbfvH

+68h1AgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAQ9aHQvPDcDuOJOL62pQeoDJp

+YtFmsDaksdhedG27usjPuX06XmzSIV3/D2zfPib2fpfdrHB5901TdehlghQVOkN6

+sSoih60GSD9zCkFD1eESywJJeZssRfDG4gk2Ls9wXz5ZY/QwSx6C97SodF0cuDHL

+FsymesuxhePL7sYkkmazjgQTkA/JXLe6FYX213xQ+FGfQvmAqc9xHu5jvnBXX+Ub

+ucixaLKUiRIVHfTmuUb/qenEBQM2vzWDZawHL5SBSa/Zxjy2iVMrQBeOiLcu8bTL

+TAmSCbonRTilFrKFVG0H+Y9+5bulOdJc64XOvj9DRJd1FJoocw0eGhw31I5rJA==

+-----END CERTIFICATE REQUEST-----

+.if

+

+.TP

+(3) Run the \fBCMCEnroll\fP command to sign the certificate request. If the input file is "\fB~/.mozilla/firefox/<profile>/cert.req\fP", the agent's certificate is stored in the "\fB~/.mozilla/firefox\<profile>fP" directory, the certificate common name for this CA is "\fBPKI Administrator for example.com\fP", and the password for the certificate database is "\fBSecret123\fP", the command is as follows:

+.IP

+.nf

+# CMCEnroll -d "~/.mozilla/firefox/<profile>/" -n "PKI Administrator for example.com" -r "~/.mozilla/firefox/<profile>/cert.req" -p "Secret123"

+cert/key prefix =

+path = ~/.mozilla/firefox/<profile>/

+-----BEGIN CERTIFICATE REQUEST-----

+MIICajCCAVICAQAwJTEjMCEGA1UEAxMaQ01DRW5yb2xsIFRlc3QgQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDamQA6psK7Tnic3DAtIyAMCk7FK3PuSseJSrR/C7W05tPvrlp5vUKxpmcA+Pg3AANp5gVMQOps6riAvoK76NKTkw4Me09Cowad7ay9IBBY4QqqBmRnfT3Mm6U5tJWeqvq1cIkwoxzHllgsGBGMQduI7URjhQYx3p+srGSe0fM7bqK+AU6aJh4r0jc1A6pCv/2XMOY1IUzmjIEnNq2RWOpnsWQ4UDma1r8sUzKgNhkuhjPU5U5YGt9+0jiuqv14dbKi7UJN3DPtkEXZNOrFrGgqKhdUqLhrdm+x/Hgw/aZoSDFYXON9jFTFyMUyUkWXZq5sfwghWUC2q4DsbfvH68h1AgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAQ9aHQvPDcDuOJOL62pQeoDJpYtFmsDaksdhedG27usjPuX06XmzSIV3/D2zfPib2fpfdrHB5901TdehlghQVOkN6sSoih60GSD9zCkFD1eESywJJeZssRfDG4gk2Ls9wXz5ZY/QwSx6C97SodF0cuDHLFsymesuxhePL7sYkkmazjgQTkA/JXLe6FYX213xQ+FGfQvmAqc9xHu5jvnBXX+UbucixaLKUiRIVHfTmuUb/qenEBQM2vzWDZawHL5SBSa/Zxjy2iVMrQBeOiLcu8bTLTAmSCbonRTilFrKFVG0H+Y9+5bulOdJc64XOvj9DRJd1FJoocw0eGhw31I5rJA==-----END CERTIFICATE REQUEST-----

+.if

+The output of this command is stored in a file with the same filename as the request with a \fB.out\fP appended to the filename (e. g. - cert.req.out):

+.IP

+.nf

+# cat cert.req.out

+-----BEGIN CERTIFICATE REQUEST-----

+MIIMhwYJKoZIhvcNAQcCoIIMeDCCDHQCAQMxCzAJBgUrDgMCGgUAMIIC6QYIKwYB

+BQUHDAKgggLbBIIC1zCCAtMwVDAvAgECBggrBgEFBQcHBjEgBB5Da2UvQ1V6VEZF

+Rzgwa1Ryb1dsNjVuTUZhMEU9DQowIQIBAwYIKwYBBQUHBwUxEgIQU05oqk+q+FdR

+go/eIzsjGTCCAnWgggJxAgEBMIICajCCAVICAQAwJTEjMCEGA1UEAxMaQ01DRW5y