|
 |
632623 |
From f10ba33f3d6f9cbd31831d0fb571e15b818e9990 Mon Sep 17 00:00:00 2001
|
|
|
632623 |
From: Christina Fu <cfu@redhat.com>
|
|
|
632623 |
Date: Mon, 26 Jun 2017 18:09:55 -0700
|
|
|
632623 |
Subject: [PATCH] Ticket #2757 CMC enrollment profiles for system certificates
|
|
|
632623 |
|
|
|
632623 |
This patch supports CMC-based system certificate requests.
|
|
|
632623 |
|
|
|
632623 |
This patch contains the following:
|
|
|
632623 |
* The code in CMCAuth (agent-based) to check ssl client auth cert against the CMC signing cert
|
|
|
632623 |
* The cmc-based system enrollment profiles:
|
|
|
632623 |
caCMCauditSigningCert.cfg
|
|
|
632623 |
caCMCcaCert.cfg
|
|
|
632623 |
caCMCkraStorageCert.cfg
|
|
|
632623 |
caCMCkraTransportCert.cfg
|
|
|
632623 |
caCMCocspCert.cfg
|
|
|
632623 |
caCMCserverCert.cfg
|
|
|
632623 |
caCMCsubsystemCert.cfg
|
|
|
632623 |
* new URI's in web.xml as new access points
|
|
|
632623 |
|
|
|
632623 |
Usage example can be found here:
|
|
|
632623 |
http://pki.fedoraproject.org/wiki/PKI_10.4_CMC_Feature_Update_(RFC5272)#Examples_.28System_Certificates.29
|
|
|
632623 |
|
|
|
632623 |
(cherry picked from commit 65b1242cd139e6306fb3e039193a3a6b223ea9b1)
|
|
|
632623 |
---
|
|
|
632623 |
base/ca/shared/conf/CS.cfg | 20 ++-
|
|
|
632623 |
.../shared/profiles/ca/caCMCauditSigningCert.cfg | 80 +++++++++
|
|
|
632623 |
base/ca/shared/profiles/ca/caCMCcaCert.cfg | 96 ++++++++++
|
|
|
632623 |
base/ca/shared/profiles/ca/caCMCkraStorageCert.cfg | 86 +++++++++
|
|
|
632623 |
.../shared/profiles/ca/caCMCkraTransportCert.cfg | 86 +++++++++
|
|
|
632623 |
base/ca/shared/profiles/ca/caCMCocspCert.cfg | 71 ++++++++
|
|
|
632623 |
base/ca/shared/profiles/ca/caCMCserverCert.cfg | 90 ++++++++++
|
|
|
632623 |
base/ca/shared/profiles/ca/caCMCsubsystemCert.cfg | 86 +++++++++
|
|
|
632623 |
base/ca/shared/profiles/ca/caFullCMCUserCert.cfg | 4 +-
|
|
|
632623 |
.../shared/profiles/ca/caFullCMCUserSignedCert.cfg | 2 +-
|
|
|
632623 |
base/ca/shared/webapps/ca/WEB-INF/web.xml | 196 +++++++++++++++++++++
|
|
|
632623 |
.../src/com/netscape/cmstools/CMCRequest.java | 2 +-
|
|
|
632623 |
.../com/netscape/cms/authentication/CMCAuth.java | 48 ++++-
|
|
|
632623 |
.../cms/authentication/CMCUserSignedAuth.java | 2 +
|
|
|
632623 |
.../netscape/cms/profile/common/EnrollProfile.java | 12 ++
|
|
|
632623 |
.../servlet/profile/ProfileSubmitCMCServlet.java | 2 +-
|
|
|
632623 |
16 files changed, 872 insertions(+), 11 deletions(-)
|
|
|
632623 |
create mode 100644 base/ca/shared/profiles/ca/caCMCauditSigningCert.cfg
|
|
|
632623 |
create mode 100644 base/ca/shared/profiles/ca/caCMCcaCert.cfg
|
|
|
632623 |
create mode 100644 base/ca/shared/profiles/ca/caCMCkraStorageCert.cfg
|
|
|
632623 |
create mode 100644 base/ca/shared/profiles/ca/caCMCkraTransportCert.cfg
|
|
|
632623 |
create mode 100644 base/ca/shared/profiles/ca/caCMCocspCert.cfg
|
|
|
632623 |
create mode 100644 base/ca/shared/profiles/ca/caCMCserverCert.cfg
|
|
|
632623 |
create mode 100644 base/ca/shared/profiles/ca/caCMCsubsystemCert.cfg
|
|
|
632623 |
|
|
|
632623 |
diff --git a/base/ca/shared/conf/CS.cfg b/base/ca/shared/conf/CS.cfg
|
|
|
632623 |
index 5a244d7..8976575 100644
|
|
|
632623 |
--- a/base/ca/shared/conf/CS.cfg
|
|
|
632623 |
+++ b/base/ca/shared/conf/CS.cfg
|
|
|
632623 |
@@ -969,7 +969,7 @@ oidmap.pse.oid=2.16.840.1.113730.1.18
|
|
|
632623 |
oidmap.subject_info_access.class=netscape.security.extensions.SubjectInfoAccessExtension
|
|
|
632623 |
oidmap.subject_info_access.oid=1.3.6.1.5.5.7.1.11
|
|
|
632623 |
os.userid=nobody
|
|
|
632623 |
-profile.list=caUserCert,caECUserCert,caUserSMIMEcapCert,caDualCert,caDirBasedDualCert,caECDualCert,AdminCert,caSignedLogCert,caTPSCert,caRARouterCert,caRouterCert,caServerCert,caSubsystemCert,caOtherCert,caCACert,caCrossSignedCACert,caInstallCACert,caRACert,caOCSPCert,caStorageCert,caTransportCert,caDirPinUserCert,caDirUserCert,caECDirUserCert,caAgentServerCert,caAgentFileSigning,caCMCUserCert,caFullCMCUserCert,caFullCMCUserSignedCert,caFullCMCSelfSignedCert,caSimpleCMCUserCert,caTokenDeviceKeyEnrollment,caTokenUserEncryptionKeyEnrollment,caTokenUserSigningKeyEnrollment,caTempTokenDeviceKeyEnrollment,caTempTokenUserEncryptionKeyEnrollment,caTempTokenUserSigningKeyEnrollment,caAdminCert,caInternalAuthServerCert,caInternalAuthTransportCert,caInternalAuthDRMstorageCert,caInternalAuthSubsystemCert,caInternalAuthOCSPCert,caInternalAuthAuditSigningCert,DomainController,caDualRAuserCert,caRAagentCert,caRAserverCert,caUUIDdeviceCert,caSSLClientSelfRenewal,caDirUserRenewal,caManualRenewal,caTokenMSLoginEnrollment,caTokenUserSigningKeyRenewal,caTokenUserEncryptionKeyRenewal,caTokenUserAuthKeyRenewal,caJarSigningCert,caIPAserviceCert,caEncUserCert,caSigningUserCert,caSigningECUserCert,caEncECUserCert,caTokenUserDelegateAuthKeyEnrollment,caTokenUserDelegateSigningKeyEnrollment
|
|
|
632623 |
+profile.list=caCMCserverCert,caCMCsubsystemCert,caCMCauditSigningCert,caCMCcaCert,caCMCocspCert,caCMCkraTransportCert,caCMCkraStorageCert,caUserCert,caECUserCert,caUserSMIMEcapCert,caDualCert,caDirBasedDualCert,caECDualCert,AdminCert,caSignedLogCert,caTPSCert,caRARouterCert,caRouterCert,caServerCert,caSubsystemCert,caOtherCert,caCACert,caCMCcaCert,caCrossSignedCACert,caInstallCACert,caRACert,caOCSPCert,caStorageCert,caTransportCert,caDirPinUserCert,caDirUserCert,caECDirUserCert,caAgentServerCert,caAgentFileSigning,caCMCUserCert,caFullCMCUserCert,caFullCMCUserSignedCert,caFullCMCSelfSignedCert,caSimpleCMCUserCert,caTokenDeviceKeyEnrollment,caTokenUserEncryptionKeyEnrollment,caTokenUserSigningKeyEnrollment,caTempTokenDeviceKeyEnrollment,caTempTokenUserEncryptionKeyEnrollment,caTempTokenUserSigningKeyEnrollment,caAdminCert,caInternalAuthServerCert,caInternalAuthTransportCert,caInternalAuthDRMstorageCert,caInternalAuthSubsystemCert,caInternalAuthOCSPCert,caInternalAuthAuditSigningCert,DomainController,caDualRAuserCert,caRAagentCert,caRAserverCert,caUUIDdeviceCert,caSSLClientSelfRenewal,caDirUserRenewal,caManualRenewal,caTokenMSLoginEnrollment,caTokenUserSigningKeyRenewal,caTokenUserEncryptionKeyRenewal,caTokenUserAuthKeyRenewal,caJarSigningCert,caIPAserviceCert,caEncUserCert,caSigningUserCert,caSigningECUserCert,caEncECUserCert,caTokenUserDelegateAuthKeyEnrollment,caTokenUserDelegateSigningKeyEnrollment
|
|
|
632623 |
profile.caUUIDdeviceCert.class_id=caEnrollImpl
|
|
|
632623 |
profile.caUUIDdeviceCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caUUIDdeviceCert.cfg
|
|
|
632623 |
profile.caManualRenewal.class_id=caEnrollImpl
|
|
|
632623 |
@@ -988,12 +988,26 @@ profile.caAgentServerCert.class_id=caEnrollImpl
|
|
|
632623 |
profile.caAgentServerCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caAgentServerCert.cfg
|
|
|
632623 |
profile.caRAserverCert.class_id=caEnrollImpl
|
|
|
632623 |
profile.caRAserverCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caRAserverCert.cfg
|
|
|
632623 |
+profile.caCMCUserCert.class_id=caEnrollImpl
|
|
|
632623 |
+profile.caCMCUserCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCMCUserCert.cfg
|
|
|
632623 |
+profile.caCMCauditSigningCert.class_id=caEnrollImpl
|
|
|
632623 |
+profile.caCMCauditSigningCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCMCauditSigningCert.cfg
|
|
|
632623 |
+profile.caCMCcaCert.class_id=caEnrollImpl
|
|
|
632623 |
+profile.caCMCcaCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCMCcaCert.cfg
|
|
|
632623 |
+profile.caCMCkraStorageCert.class_id=caEnrollImpl
|
|
|
632623 |
+profile.caCMCkraStorageCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCMCkraStorageCert.cfg
|
|
|
632623 |
+profile.caCMCkraTransportCert.class_id=caEnrollImpl
|
|
|
632623 |
+profile.caCMCkraTransportCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCMCkraTransportCert.cfg
|
|
|
632623 |
+profile.caCMCocspCert.class_id=caEnrollImpl
|
|
|
632623 |
+profile.caCMCocspCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCMCocspCert.cfg
|
|
|
632623 |
+profile.caCMCserverCert.class_id=caEnrollImpl
|
|
|
632623 |
+profile.caCMCserverCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCMCserverCert.cfg
|
|
|
632623 |
+profile.caCMCsubsystemCert.class_id=caEnrollImpl
|
|
|
632623 |
+profile.caCMCsubsystemCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCMCsubsystemCert.cfg
|
|
|
632623 |
profile.caCACert.class_id=caEnrollImpl
|
|
|
632623 |
profile.caCACert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCACert.cfg
|
|
|
632623 |
profile.caInstallCACert.class_id=caEnrollImpl
|
|
|
632623 |
profile.caInstallCACert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caInstallCACert.cfg
|
|
|
632623 |
-profile.caCMCUserCert.class_id=caEnrollImpl
|
|
|
632623 |
-profile.caCMCUserCert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCMCUserCert.cfg
|
|
|
632623 |
profile.caCrossSignedCACert.class_id=caEnrollImpl
|
|
|
632623 |
profile.caCrossSignedCACert.config=[PKI_INSTANCE_PATH]/[PKI_SUBSYSTEM_TYPE]/profiles/ca/caCrossSignedCACert.cfg
|
|
|
632623 |
profile.caDirBasedDualCert.class_id=caEnrollImpl
|
|
|
632623 |
diff --git a/base/ca/shared/profiles/ca/caCMCauditSigningCert.cfg b/base/ca/shared/profiles/ca/caCMCauditSigningCert.cfg
|
|
|
632623 |
new file mode 100644
|
|
|
632623 |
index 0000000..ed5a1b2
|
|
|
632623 |
--- /dev/null
|
|
|
632623 |
+++ b/base/ca/shared/profiles/ca/caCMCauditSigningCert.cfg
|
|
|
632623 |
@@ -0,0 +1,80 @@
|
|
|
632623 |
+desc=This certificate profile is for enrolling audit signing certificates using CMC.
|
|
|
632623 |
+visible=false
|
|
|
632623 |
+enable=true
|
|
|
632623 |
+enableBy=admin
|
|
|
632623 |
+auth.instance_id=CMCAuth
|
|
|
632623 |
+authz.acl=group="Certificate Manager Agents"
|
|
|
632623 |
+name=Audit Signing Certificate Enrollment using CMC
|
|
|
632623 |
+input.list=i1,i2
|
|
|
632623 |
+input.i1.class_id=certReqInputImpl
|
|
|
632623 |
+input.i2.class_id=submitterInfoInputImpl
|
|
|
632623 |
+output.list=o1
|
|
|
632623 |
+output.o1.class_id=certOutputImpl
|
|
|
632623 |
+policyset.list=auditSigningCertSet
|
|
|
632623 |
+policyset.auditSigningCertSet.list=1,2,3,4,5,6,9
|
|
|
632623 |
+policyset.auditSigningCertSet.1.constraint.class_id=subjectNameConstraintImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.1.constraint.name=Subject Name Constraint
|
|
|
632623 |
+policyset.auditSigningCertSet.1.constraint.params.pattern=CN=.*
|
|
|
632623 |
+policyset.auditSigningCertSet.1.constraint.params.accept=true
|
|
|
632623 |
+policyset.auditSigningCertSet.1.default.class_id=userSubjectNameDefaultImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.1.default.name=Subject Name Default
|
|
|
632623 |
+policyset.auditSigningCertSet.1.default.params.name=
|
|
|
632623 |
+policyset.auditSigningCertSet.2.constraint.class_id=validityConstraintImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.2.constraint.name=Validity Constraint
|
|
|
632623 |
+policyset.auditSigningCertSet.2.constraint.params.range=720
|
|
|
632623 |
+policyset.auditSigningCertSet.2.constraint.params.notBeforeCheck=false
|
|
|
632623 |
+policyset.auditSigningCertSet.2.constraint.params.notAfterCheck=false
|
|
|
632623 |
+policyset.auditSigningCertSet.2.default.class_id=validityDefaultImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.2.default.name=Validity Default
|
|
|
632623 |
+policyset.auditSigningCertSet.2.default.params.range=720
|
|
|
632623 |
+policyset.auditSigningCertSet.2.default.params.startTime=0
|
|
|
632623 |
+policyset.auditSigningCertSet.3.constraint.class_id=keyConstraintImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.3.constraint.name=Key Constraint
|
|
|
632623 |
+policyset.auditSigningCertSet.3.constraint.params.keyType=RSA
|
|
|
632623 |
+policyset.auditSigningCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
|
|
|
632623 |
+policyset.auditSigningCertSet.3.default.class_id=userKeyDefaultImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.3.default.name=Key Default
|
|
|
632623 |
+policyset.auditSigningCertSet.4.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.4.constraint.name=No Constraint
|
|
|
632623 |
+policyset.auditSigningCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.4.default.name=Authority Key Identifier Default
|
|
|
632623 |
+policyset.auditSigningCertSet.5.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.5.constraint.name=No Constraint
|
|
|
632623 |
+policyset.auditSigningCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.5.default.name=AIA Extension Default
|
|
|
632623 |
+policyset.auditSigningCertSet.5.default.params.authInfoAccessADEnable_0=true
|
|
|
632623 |
+policyset.auditSigningCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
|
|
|
632623 |
+policyset.auditSigningCertSet.5.default.params.authInfoAccessADLocation_0=
|
|
|
632623 |
+policyset.auditSigningCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
|
|
|
632623 |
+policyset.auditSigningCertSet.5.default.params.authInfoAccessCritical=false
|
|
|
632623 |
+policyset.auditSigningCertSet.5.default.params.authInfoAccessNumADs=1
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.name=Key Usage Extension Constraint
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageDataEncipherment=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageKeyEncipherment=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.constraint.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.class_id=keyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.name=Key Usage Default
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageDataEncipherment=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageKeyEncipherment=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.auditSigningCertSet.6.default.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.auditSigningCertSet.9.constraint.class_id=signingAlgConstraintImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.9.constraint.name=No Constraint
|
|
|
632623 |
+policyset.auditSigningCertSet.9.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC
|
|
|
632623 |
+policyset.auditSigningCertSet.9.default.class_id=signingAlgDefaultImpl
|
|
|
632623 |
+policyset.auditSigningCertSet.9.default.name=Signing Alg
|
|
|
632623 |
+policyset.auditSigningCertSet.9.default.params.signingAlg=-
|
|
|
632623 |
diff --git a/base/ca/shared/profiles/ca/caCMCcaCert.cfg b/base/ca/shared/profiles/ca/caCMCcaCert.cfg
|
|
|
632623 |
new file mode 100644
|
|
|
632623 |
index 0000000..f6df36f
|
|
|
632623 |
--- /dev/null
|
|
|
632623 |
+++ b/base/ca/shared/profiles/ca/caCMCcaCert.cfg
|
|
|
632623 |
@@ -0,0 +1,96 @@
|
|
|
632623 |
+desc=This certificate profile is for enrolling Certificate Authority certificates using CMC.
|
|
|
632623 |
+visible=false
|
|
|
632623 |
+enable=true
|
|
|
632623 |
+enableBy=admin
|
|
|
632623 |
+auth.instance_id=CMCAuth
|
|
|
632623 |
+authz.acl=group="Certificate Manager Agents"
|
|
|
632623 |
+name=Certificate Manager Signing Certificate Enrollment using CMC
|
|
|
632623 |
+input.list=i1,i2
|
|
|
632623 |
+input.i1.class_id=certReqInputImpl
|
|
|
632623 |
+input.i2.class_id=submitterInfoInputImpl
|
|
|
632623 |
+output.list=o1
|
|
|
632623 |
+output.o1.class_id=certOutputImpl
|
|
|
632623 |
+policyset.list=caCertSet
|
|
|
632623 |
+policyset.caCertSet.list=1,2,3,4,5,6,8,9,10
|
|
|
632623 |
+policyset.caCertSet.1.constraint.class_id=subjectNameConstraintImpl
|
|
|
632623 |
+policyset.caCertSet.1.constraint.name=Subject Name Constraint
|
|
|
632623 |
+policyset.caCertSet.1.constraint.params.pattern=CN=.*
|
|
|
632623 |
+policyset.caCertSet.1.constraint.params.accept=true
|
|
|
632623 |
+policyset.caCertSet.1.default.class_id=userSubjectNameDefaultImpl
|
|
|
632623 |
+policyset.caCertSet.1.default.name=Subject Name Default
|
|
|
632623 |
+policyset.caCertSet.1.default.params.name=
|
|
|
632623 |
+policyset.caCertSet.2.constraint.class_id=validityConstraintImpl
|
|
|
632623 |
+policyset.caCertSet.2.constraint.name=Validity Constraint
|
|
|
632623 |
+policyset.caCertSet.2.constraint.params.range=7305
|
|
|
632623 |
+policyset.caCertSet.2.constraint.params.notBeforeCheck=false
|
|
|
632623 |
+policyset.caCertSet.2.constraint.params.notAfterCheck=false
|
|
|
632623 |
+policyset.caCertSet.2.default.class_id=caValidityDefaultImpl
|
|
|
632623 |
+policyset.caCertSet.2.default.name=CA Certificate Validity Default
|
|
|
632623 |
+policyset.caCertSet.2.default.params.range=7305
|
|
|
632623 |
+policyset.caCertSet.2.default.params.startTime=0
|
|
|
632623 |
+policyset.caCertSet.3.constraint.class_id=keyConstraintImpl
|
|
|
632623 |
+policyset.caCertSet.3.constraint.name=Key Constraint
|
|
|
632623 |
+policyset.caCertSet.3.constraint.params.keyType=-
|
|
|
632623 |
+policyset.caCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096,nistp256,nistp384,nistp521
|
|
|
632623 |
+policyset.caCertSet.3.default.class_id=userKeyDefaultImpl
|
|
|
632623 |
+policyset.caCertSet.3.default.name=Key Default
|
|
|
632623 |
+policyset.caCertSet.4.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.caCertSet.4.constraint.name=No Constraint
|
|
|
632623 |
+policyset.caCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
|
|
|
632623 |
+policyset.caCertSet.4.default.name=Authority Key Identifier Default
|
|
|
632623 |
+policyset.caCertSet.5.constraint.class_id=basicConstraintsExtConstraintImpl
|
|
|
632623 |
+policyset.caCertSet.5.constraint.name=Basic Constraint Extension Constraint
|
|
|
632623 |
+policyset.caCertSet.5.constraint.params.basicConstraintsCritical=true
|
|
|
632623 |
+policyset.caCertSet.5.constraint.params.basicConstraintsIsCA=true
|
|
|
632623 |
+policyset.caCertSet.5.constraint.params.basicConstraintsMinPathLen=-1
|
|
|
632623 |
+policyset.caCertSet.5.constraint.params.basicConstraintsMaxPathLen=-1
|
|
|
632623 |
+policyset.caCertSet.5.default.class_id=basicConstraintsExtDefaultImpl
|
|
|
632623 |
+policyset.caCertSet.5.default.name=Basic Constraints Extension Default
|
|
|
632623 |
+policyset.caCertSet.5.default.params.basicConstraintsCritical=true
|
|
|
632623 |
+policyset.caCertSet.5.default.params.basicConstraintsIsCA=true
|
|
|
632623 |
+policyset.caCertSet.5.default.params.basicConstraintsPathLen=-1
|
|
|
632623 |
+policyset.caCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
|
|
|
632623 |
+policyset.caCertSet.6.constraint.name=Key Usage Extension Constraint
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageDataEncipherment=false
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageKeyEncipherment=false
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageKeyCertSign=true
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageCrlSign=true
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.caCertSet.6.constraint.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.caCertSet.6.default.class_id=keyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.caCertSet.6.default.name=Key Usage Default
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageDataEncipherment=false
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageKeyEncipherment=false
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageKeyCertSign=true
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageCrlSign=true
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.caCertSet.6.default.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.caCertSet.8.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.caCertSet.8.constraint.name=No Constraint
|
|
|
632623 |
+policyset.caCertSet.8.default.class_id=subjectKeyIdentifierExtDefaultImpl
|
|
|
632623 |
+policyset.caCertSet.8.default.name=Subject Key Identifier Extension Default
|
|
|
632623 |
+policyset.caCertSet.8.default.params.critical=false
|
|
|
632623 |
+policyset.caCertSet.9.constraint.class_id=signingAlgConstraintImpl
|
|
|
632623 |
+policyset.caCertSet.9.constraint.name=No Constraint
|
|
|
632623 |
+policyset.caCertSet.9.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC
|
|
|
632623 |
+policyset.caCertSet.9.default.class_id=signingAlgDefaultImpl
|
|
|
632623 |
+policyset.caCertSet.9.default.name=Signing Alg
|
|
|
632623 |
+policyset.caCertSet.9.default.params.signingAlg=-
|
|
|
632623 |
+policyset.caCertSet.10.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.caCertSet.10.constraint.name=No Constraint
|
|
|
632623 |
+policyset.caCertSet.10.default.class_id=authInfoAccessExtDefaultImpl
|
|
|
632623 |
+policyset.caCertSet.10.default.name=AIA Extension Default
|
|
|
632623 |
+policyset.caCertSet.10.default.params.authInfoAccessADEnable_0=true
|
|
|
632623 |
+policyset.caCertSet.10.default.params.authInfoAccessADLocationType_0=URIName
|
|
|
632623 |
+policyset.caCertSet.10.default.params.authInfoAccessADLocation_0=
|
|
|
632623 |
+policyset.caCertSet.10.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
|
|
|
632623 |
+policyset.caCertSet.10.default.params.authInfoAccessCritical=false
|
|
|
632623 |
+policyset.caCertSet.10.default.params.authInfoAccessNumADs=1
|
|
|
632623 |
diff --git a/base/ca/shared/profiles/ca/caCMCkraStorageCert.cfg b/base/ca/shared/profiles/ca/caCMCkraStorageCert.cfg
|
|
|
632623 |
new file mode 100644
|
|
|
632623 |
index 0000000..259430b
|
|
|
632623 |
--- /dev/null
|
|
|
632623 |
+++ b/base/ca/shared/profiles/ca/caCMCkraStorageCert.cfg
|
|
|
632623 |
@@ -0,0 +1,86 @@
|
|
|
632623 |
+desc=This certificate profile is for enrolling KRA storage certificates using CMC
|
|
|
632623 |
+visible=false
|
|
|
632623 |
+enable=true
|
|
|
632623 |
+enableBy=admin
|
|
|
632623 |
+auth.instance_id=CMCAuth
|
|
|
632623 |
+authz.acl=group="Certificate Manager Agents"
|
|
|
632623 |
+name=KRA storage Certificate Enrollment using CMC
|
|
|
632623 |
+input.list=i1,i2
|
|
|
632623 |
+input.i1.class_id=certReqInputImpl
|
|
|
632623 |
+input.i2.class_id=submitterInfoInputImpl
|
|
|
632623 |
+output.list=o1
|
|
|
632623 |
+output.o1.class_id=certOutputImpl
|
|
|
632623 |
+policyset.list=drmStorageCertSet
|
|
|
632623 |
+policyset.drmStorageCertSet.list=1,2,3,4,5,6,7,9
|
|
|
632623 |
+policyset.drmStorageCertSet.1.constraint.class_id=subjectNameConstraintImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.1.constraint.name=Subject Name Constraint
|
|
|
632623 |
+policyset.drmStorageCertSet.1.constraint.params.pattern=CN=.*
|
|
|
632623 |
+policyset.drmStorageCertSet.1.constraint.params.accept=true
|
|
|
632623 |
+policyset.drmStorageCertSet.1.default.class_id=userSubjectNameDefaultImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.1.default.name=Subject Name Default
|
|
|
632623 |
+policyset.drmStorageCertSet.1.default.params.name=
|
|
|
632623 |
+policyset.drmStorageCertSet.2.constraint.class_id=validityConstraintImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.2.constraint.name=Validity Constraint
|
|
|
632623 |
+policyset.drmStorageCertSet.2.constraint.params.range=720
|
|
|
632623 |
+policyset.drmStorageCertSet.2.constraint.params.notBeforeCheck=false
|
|
|
632623 |
+policyset.drmStorageCertSet.2.constraint.params.notAfterCheck=false
|
|
|
632623 |
+policyset.drmStorageCertSet.2.default.class_id=validityDefaultImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.2.default.name=Validity Default
|
|
|
632623 |
+policyset.drmStorageCertSet.2.default.params.range=720
|
|
|
632623 |
+policyset.drmStorageCertSet.2.default.params.startTime=0
|
|
|
632623 |
+policyset.drmStorageCertSet.3.constraint.class_id=keyConstraintImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.3.constraint.name=Key Constraint
|
|
|
632623 |
+policyset.drmStorageCertSet.3.constraint.params.keyType=RSA
|
|
|
632623 |
+policyset.drmStorageCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
|
|
|
632623 |
+policyset.drmStorageCertSet.3.default.class_id=userKeyDefaultImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.3.default.name=Key Default
|
|
|
632623 |
+policyset.drmStorageCertSet.4.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.4.constraint.name=No Constraint
|
|
|
632623 |
+policyset.drmStorageCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.4.default.name=Authority Key Identifier Default
|
|
|
632623 |
+policyset.drmStorageCertSet.5.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.5.constraint.name=No Constraint
|
|
|
632623 |
+policyset.drmStorageCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.5.default.name=AIA Extension Default
|
|
|
632623 |
+policyset.drmStorageCertSet.5.default.params.authInfoAccessADEnable_0=true
|
|
|
632623 |
+policyset.drmStorageCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
|
|
|
632623 |
+policyset.drmStorageCertSet.5.default.params.authInfoAccessADLocation_0=
|
|
|
632623 |
+policyset.drmStorageCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
|
|
|
632623 |
+policyset.drmStorageCertSet.5.default.params.authInfoAccessCritical=false
|
|
|
632623 |
+policyset.drmStorageCertSet.5.default.params.authInfoAccessNumADs=1
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.name=Key Usage Extension Constraint
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageDataEncipherment=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageKeyEncipherment=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.drmStorageCertSet.6.constraint.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.class_id=keyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.name=Key Usage Default
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageDataEncipherment=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageKeyEncipherment=true
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.drmStorageCertSet.6.default.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.drmStorageCertSet.7.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.7.constraint.name=No Constraint
|
|
|
632623 |
+policyset.drmStorageCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.7.default.name=Extended Key Usage Extension Default
|
|
|
632623 |
+policyset.drmStorageCertSet.7.default.params.exKeyUsageCritical=false
|
|
|
632623 |
+policyset.drmStorageCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2
|
|
|
632623 |
+policyset.drmStorageCertSet.9.constraint.class_id=signingAlgConstraintImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.9.constraint.name=No Constraint
|
|
|
632623 |
+policyset.drmStorageCertSet.9.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC
|
|
|
632623 |
+policyset.drmStorageCertSet.9.default.class_id=signingAlgDefaultImpl
|
|
|
632623 |
+policyset.drmStorageCertSet.9.default.name=Signing Alg
|
|
|
632623 |
+policyset.drmStorageCertSet.9.default.params.signingAlg=-
|
|
|
632623 |
diff --git a/base/ca/shared/profiles/ca/caCMCkraTransportCert.cfg b/base/ca/shared/profiles/ca/caCMCkraTransportCert.cfg
|
|
|
632623 |
new file mode 100644
|
|
|
632623 |
index 0000000..ec54f9c
|
|
|
632623 |
--- /dev/null
|
|
|
632623 |
+++ b/base/ca/shared/profiles/ca/caCMCkraTransportCert.cfg
|
|
|
632623 |
@@ -0,0 +1,86 @@
|
|
|
632623 |
+desc=This certificate profile is for enrolling Key Archival Authority transport certificates using CMC.
|
|
|
632623 |
+visible=false
|
|
|
632623 |
+enable=true
|
|
|
632623 |
+enableBy=admin
|
|
|
632623 |
+auth.instance_id=CMCAuth
|
|
|
632623 |
+authz.acl=group="Certificate Manager Agents"
|
|
|
632623 |
+name=Key Archival Authority Transport Certificate Enrollment using CMC
|
|
|
632623 |
+input.list=i1,i2
|
|
|
632623 |
+input.i1.class_id=certReqInputImpl
|
|
|
632623 |
+input.i2.class_id=submitterInfoInputImpl
|
|
|
632623 |
+output.list=o1
|
|
|
632623 |
+output.o1.class_id=certOutputImpl
|
|
|
632623 |
+policyset.list=transportCertSet
|
|
|
632623 |
+policyset.transportCertSet.list=1,2,3,4,5,6,7,8
|
|
|
632623 |
+policyset.transportCertSet.1.constraint.class_id=subjectNameConstraintImpl
|
|
|
632623 |
+policyset.transportCertSet.1.constraint.name=Subject Name Constraint
|
|
|
632623 |
+policyset.transportCertSet.1.constraint.params.pattern=CN=.*
|
|
|
632623 |
+policyset.transportCertSet.1.constraint.params.accept=true
|
|
|
632623 |
+policyset.transportCertSet.1.default.class_id=userSubjectNameDefaultImpl
|
|
|
632623 |
+policyset.transportCertSet.1.default.name=Subject Name Default
|
|
|
632623 |
+policyset.transportCertSet.1.default.params.name=
|
|
|
632623 |
+policyset.transportCertSet.2.constraint.class_id=validityConstraintImpl
|
|
|
632623 |
+policyset.transportCertSet.2.constraint.name=Validity Constraint
|
|
|
632623 |
+policyset.transportCertSet.2.constraint.params.range=720
|
|
|
632623 |
+policyset.transportCertSet.2.constraint.params.notBeforeCheck=false
|
|
|
632623 |
+policyset.transportCertSet.2.constraint.params.notAfterCheck=false
|
|
|
632623 |
+policyset.transportCertSet.2.default.class_id=validityDefaultImpl
|
|
|
632623 |
+policyset.transportCertSet.2.default.name=Validity Default
|
|
|
632623 |
+policyset.transportCertSet.2.default.params.range=720
|
|
|
632623 |
+policyset.transportCertSet.2.default.params.startTime=0
|
|
|
632623 |
+policyset.transportCertSet.3.constraint.class_id=keyConstraintImpl
|
|
|
632623 |
+policyset.transportCertSet.3.constraint.name=Key Constraint
|
|
|
632623 |
+policyset.transportCertSet.3.constraint.params.keyType=RSA
|
|
|
632623 |
+policyset.transportCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096
|
|
|
632623 |
+policyset.transportCertSet.3.default.class_id=userKeyDefaultImpl
|
|
|
632623 |
+policyset.transportCertSet.3.default.name=Key Default
|
|
|
632623 |
+policyset.transportCertSet.4.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.transportCertSet.4.constraint.name=No Constraint
|
|
|
632623 |
+policyset.transportCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
|
|
|
632623 |
+policyset.transportCertSet.4.default.name=Authority Key Identifier Default
|
|
|
632623 |
+policyset.transportCertSet.5.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.transportCertSet.5.constraint.name=No Constraint
|
|
|
632623 |
+policyset.transportCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
|
|
|
632623 |
+policyset.transportCertSet.5.default.name=AIA Extension Default
|
|
|
632623 |
+policyset.transportCertSet.5.default.params.authInfoAccessADEnable_0=true
|
|
|
632623 |
+policyset.transportCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
|
|
|
632623 |
+policyset.transportCertSet.5.default.params.authInfoAccessADLocation_0=
|
|
|
632623 |
+policyset.transportCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
|
|
|
632623 |
+policyset.transportCertSet.5.default.params.authInfoAccessCritical=false
|
|
|
632623 |
+policyset.transportCertSet.5.default.params.authInfoAccessNumADs=1
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.name=Key Usage Extension Constraint
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageDataEncipherment=true
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageKeyEncipherment=true
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.transportCertSet.6.constraint.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.transportCertSet.6.default.class_id=keyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.transportCertSet.6.default.name=Key Usage Default
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageDataEncipherment=true
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageKeyEncipherment=true
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.transportCertSet.6.default.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.transportCertSet.7.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.transportCertSet.7.constraint.name=No Constraint
|
|
|
632623 |
+policyset.transportCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.transportCertSet.7.default.name=Extended Key Usage Extension Default
|
|
|
632623 |
+policyset.transportCertSet.7.default.params.exKeyUsageCritical=false
|
|
|
632623 |
+policyset.transportCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2
|
|
|
632623 |
+policyset.transportCertSet.8.constraint.class_id=signingAlgConstraintImpl
|
|
|
632623 |
+policyset.transportCertSet.8.constraint.name=No Constraint
|
|
|
632623 |
+policyset.transportCertSet.8.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC
|
|
|
632623 |
+policyset.transportCertSet.8.default.class_id=signingAlgDefaultImpl
|
|
|
632623 |
+policyset.transportCertSet.8.default.name=Signing Alg
|
|
|
632623 |
+policyset.transportCertSet.8.default.params.signingAlg=-
|
|
|
632623 |
diff --git a/base/ca/shared/profiles/ca/caCMCocspCert.cfg b/base/ca/shared/profiles/ca/caCMCocspCert.cfg
|
|
|
632623 |
new file mode 100644
|
|
|
632623 |
index 0000000..8afbd46
|
|
|
632623 |
--- /dev/null
|
|
|
632623 |
+++ b/base/ca/shared/profiles/ca/caCMCocspCert.cfg
|
|
|
632623 |
@@ -0,0 +1,71 @@
|
|
|
632623 |
+desc=This certificate profile is for enrolling OCSP Responder signing certificates using CMC.
|
|
|
632623 |
+visible=false
|
|
|
632623 |
+enable=true
|
|
|
632623 |
+enableBy=admin
|
|
|
632623 |
+auth.instance_id=CMCAuth
|
|
|
632623 |
+authz.acl=group="Certificate Manager Agents"
|
|
|
632623 |
+name=OCSP Responder Signing Certificate Enrollment using CMC
|
|
|
632623 |
+input.list=i1,i2
|
|
|
632623 |
+input.i1.class_id=certReqInputImpl
|
|
|
632623 |
+input.i2.class_id=submitterInfoInputImpl
|
|
|
632623 |
+output.list=o1
|
|
|
632623 |
+output.o1.class_id=certOutputImpl
|
|
|
632623 |
+policyset.list=ocspCertSet
|
|
|
632623 |
+policyset.ocspCertSet.list=1,2,3,4,5,6,8,9
|
|
|
632623 |
+policyset.ocspCertSet.1.constraint.class_id=subjectNameConstraintImpl
|
|
|
632623 |
+policyset.ocspCertSet.1.constraint.name=Subject Name Constraint
|
|
|
632623 |
+policyset.ocspCertSet.1.constraint.params.pattern=CN=.*
|
|
|
632623 |
+policyset.ocspCertSet.1.constraint.params.accept=true
|
|
|
632623 |
+policyset.ocspCertSet.1.default.class_id=userSubjectNameDefaultImpl
|
|
|
632623 |
+policyset.ocspCertSet.1.default.name=Subject Name Default
|
|
|
632623 |
+policyset.ocspCertSet.1.default.params.name=
|
|
|
632623 |
+policyset.ocspCertSet.2.constraint.class_id=validityConstraintImpl
|
|
|
632623 |
+policyset.ocspCertSet.2.constraint.name=Validity Constraint
|
|
|
632623 |
+policyset.ocspCertSet.2.constraint.params.range=720
|
|
|
632623 |
+policyset.ocspCertSet.2.constraint.params.notBeforeCheck=false
|
|
|
632623 |
+policyset.ocspCertSet.2.constraint.params.notAfterCheck=false
|
|
|
632623 |
+policyset.ocspCertSet.2.default.class_id=validityDefaultImpl
|
|
|
632623 |
+policyset.ocspCertSet.2.default.name=Validity Default
|
|
|
632623 |
+policyset.ocspCertSet.2.default.params.range=720
|
|
|
632623 |
+policyset.ocspCertSet.2.default.params.startTime=0
|
|
|
632623 |
+policyset.ocspCertSet.3.constraint.class_id=keyConstraintImpl
|
|
|
632623 |
+policyset.ocspCertSet.3.constraint.name=Key Constraint
|
|
|
632623 |
+policyset.ocspCertSet.3.constraint.params.keyType=-
|
|
|
632623 |
+policyset.ocspCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096,nistp256,nistp384,nistp521
|
|
|
632623 |
+policyset.ocspCertSet.3.default.class_id=userKeyDefaultImpl
|
|
|
632623 |
+policyset.ocspCertSet.3.default.name=Key Default
|
|
|
632623 |
+policyset.ocspCertSet.4.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.ocspCertSet.4.constraint.name=No Constraint
|
|
|
632623 |
+policyset.ocspCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
|
|
|
632623 |
+policyset.ocspCertSet.4.default.name=Authority Key Identifier Default
|
|
|
632623 |
+policyset.ocspCertSet.5.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.ocspCertSet.5.constraint.name=No Constraint
|
|
|
632623 |
+policyset.ocspCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
|
|
|
632623 |
+policyset.ocspCertSet.5.default.name=AIA Extension Default
|
|
|
632623 |
+policyset.ocspCertSet.5.default.params.authInfoAccessADEnable_0=true
|
|
|
632623 |
+policyset.ocspCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
|
|
|
632623 |
+policyset.ocspCertSet.5.default.params.authInfoAccessADLocation_0=
|
|
|
632623 |
+policyset.ocspCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
|
|
|
632623 |
+policyset.ocspCertSet.5.default.params.authInfoAccessCritical=false
|
|
|
632623 |
+policyset.ocspCertSet.5.default.params.authInfoAccessNumADs=1
|
|
|
632623 |
+policyset.ocspCertSet.6.constraint.class_id=extendedKeyUsageExtConstraintImpl
|
|
|
632623 |
+policyset.ocspCertSet.6.constraint.name=Extended Key Usage Extension
|
|
|
632623 |
+policyset.ocspCertSet.6.constraint.params.exKeyUsageCritical=false
|
|
|
632623 |
+policyset.ocspCertSet.6.constraint.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.9
|
|
|
632623 |
+policyset.ocspCertSet.6.default.class_id=extendedKeyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.ocspCertSet.6.default.name=Extended Key Usage Default
|
|
|
632623 |
+policyset.ocspCertSet.6.default.params.exKeyUsageCritical=false
|
|
|
632623 |
+policyset.ocspCertSet.6.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.9
|
|
|
632623 |
+policyset.ocspCertSet.8.constraint.class_id=extensionConstraintImpl
|
|
|
632623 |
+policyset.ocspCertSet.8.constraint.name=No Constraint
|
|
|
632623 |
+policyset.ocspCertSet.8.constraint.params.extCritical=false
|
|
|
632623 |
+policyset.ocspCertSet.8.constraint.params.extOID=1.3.6.1.5.5.7.48.1.5
|
|
|
632623 |
+policyset.ocspCertSet.8.default.class_id=ocspNoCheckExtDefaultImpl
|
|
|
632623 |
+policyset.ocspCertSet.8.default.name=OCSP No Check Extension
|
|
|
632623 |
+policyset.ocspCertSet.8.default.params.ocspNoCheckCritical=false
|
|
|
632623 |
+policyset.ocspCertSet.9.constraint.class_id=signingAlgConstraintImpl
|
|
|
632623 |
+policyset.ocspCertSet.9.constraint.name=No Constraint
|
|
|
632623 |
+policyset.ocspCertSet.9.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC
|
|
|
632623 |
+policyset.ocspCertSet.9.default.class_id=signingAlgDefaultImpl
|
|
|
632623 |
+policyset.ocspCertSet.9.default.name=Signing Alg
|
|
|
632623 |
+policyset.ocspCertSet.9.default.params.signingAlg=-
|
|
|
632623 |
diff --git a/base/ca/shared/profiles/ca/caCMCserverCert.cfg b/base/ca/shared/profiles/ca/caCMCserverCert.cfg
|
|
|
632623 |
new file mode 100644
|
|
|
632623 |
index 0000000..8215d65
|
|
|
632623 |
--- /dev/null
|
|
|
632623 |
+++ b/base/ca/shared/profiles/ca/caCMCserverCert.cfg
|
|
|
632623 |
@@ -0,0 +1,90 @@
|
|
|
632623 |
+desc=This certificate profile is for enrolling server certificates using CMC.
|
|
|
632623 |
+visible=false
|
|
|
632623 |
+enable=true
|
|
|
632623 |
+enableBy=admin
|
|
|
632623 |
+auth.instance_id=CMCAuth
|
|
|
632623 |
+authz.acl=group="Certificate Manager Agents"
|
|
|
632623 |
+name=Server Certificate Enrollment using CMC
|
|
|
632623 |
+input.list=i1,i2
|
|
|
632623 |
+input.i1.class_id=certReqInputImpl
|
|
|
632623 |
+input.i2.class_id=submitterInfoInputImpl
|
|
|
632623 |
+output.list=o1
|
|
|
632623 |
+output.o1.class_id=certOutputImpl
|
|
|
632623 |
+policyset.list=serverCertSet
|
|
|
632623 |
+policyset.serverCertSet.list=1,2,3,4,5,6,7,8,9
|
|
|
632623 |
+policyset.serverCertSet.1.constraint.class_id=subjectNameConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.1.constraint.name=Subject Name Constraint
|
|
|
632623 |
+policyset.serverCertSet.1.constraint.params.pattern=.*CN=.*
|
|
|
632623 |
+policyset.serverCertSet.1.constraint.params.accept=true
|
|
|
632623 |
+policyset.serverCertSet.1.default.class_id=userSubjectNameDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.1.default.name=Subject Name Default
|
|
|
632623 |
+policyset.serverCertSet.1.default.params.name=
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.class_id=validityConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.name=Validity Constraint
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.params.range=720
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.params.notBeforeCheck=false
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.params.notAfterCheck=false
|
|
|
632623 |
+policyset.serverCertSet.2.default.class_id=validityDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.2.default.name=Validity Default
|
|
|
632623 |
+policyset.serverCertSet.2.default.params.range=720
|
|
|
632623 |
+policyset.serverCertSet.2.default.params.startTime=0
|
|
|
632623 |
+policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.3.constraint.name=Key Constraint
|
|
|
632623 |
+policyset.serverCertSet.3.constraint.params.keyType=-
|
|
|
632623 |
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096,nistp256,nistp384,nistp521
|
|
|
632623 |
+policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.3.default.name=Key Default
|
|
|
632623 |
+policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.4.constraint.name=No Constraint
|
|
|
632623 |
+policyset.serverCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.4.default.name=Authority Key Identifier Default
|
|
|
632623 |
+policyset.serverCertSet.5.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.5.constraint.name=No Constraint
|
|
|
632623 |
+policyset.serverCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.5.default.name=AIA Extension Default
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessADEnable_0=true
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0=
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessCritical=false
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessNumADs=1
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.name=Key Usage Extension Constraint
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageDataEncipherment=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageKeyEncipherment=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.class_id=keyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.6.default.name=Key Usage Default
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageDataEncipherment=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageKeyEncipherment=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.serverCertSet.7.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.7.constraint.name=No Constraint
|
|
|
632623 |
+policyset.serverCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.7.default.name=Extended Key Usage Extension Default
|
|
|
632623 |
+policyset.serverCertSet.7.default.params.exKeyUsageCritical=false
|
|
|
632623 |
+policyset.serverCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2
|
|
|
632623 |
+policyset.serverCertSet.8.constraint.class_id=signingAlgConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.8.constraint.name=No Constraint
|
|
|
632623 |
+policyset.serverCertSet.8.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC
|
|
|
632623 |
+policyset.serverCertSet.8.default.class_id=signingAlgDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.8.default.name=Signing Alg
|
|
|
632623 |
+policyset.serverCertSet.8.default.params.signingAlg=-
|
|
|
632623 |
+policyset.serverCertSet.9.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.9.constraint.name=No Constraint
|
|
|
632623 |
+policyset.serverCertSet.9.default.class_id=commonNameToSANDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.9.default.name=copy CN to SAN Default
|
|
|
632623 |
diff --git a/base/ca/shared/profiles/ca/caCMCsubsystemCert.cfg b/base/ca/shared/profiles/ca/caCMCsubsystemCert.cfg
|
|
|
632623 |
new file mode 100644
|
|
|
632623 |
index 0000000..f473f98
|
|
|
632623 |
--- /dev/null
|
|
|
632623 |
+++ b/base/ca/shared/profiles/ca/caCMCsubsystemCert.cfg
|
|
|
632623 |
@@ -0,0 +1,86 @@
|
|
|
632623 |
+desc=This certificate profile is for enrolling subsystem certificates using CMC.
|
|
|
632623 |
+visible=false
|
|
|
632623 |
+enable=true
|
|
|
632623 |
+enableBy=admin
|
|
|
632623 |
+auth.instance_id=CMCAuth
|
|
|
632623 |
+authz.acl=group="Certificate Manager Agents"
|
|
|
632623 |
+name=Subsystem Certificate Enrollment using CMC
|
|
|
632623 |
+input.list=i1,i2
|
|
|
632623 |
+input.i1.class_id=certReqInputImpl
|
|
|
632623 |
+input.i2.class_id=submitterInfoInputImpl
|
|
|
632623 |
+output.list=o1
|
|
|
632623 |
+output.o1.class_id=certOutputImpl
|
|
|
632623 |
+policyset.list=serverCertSet
|
|
|
632623 |
+policyset.serverCertSet.list=1,2,3,4,5,6,7,8
|
|
|
632623 |
+policyset.serverCertSet.1.constraint.class_id=subjectNameConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.1.constraint.name=Subject Name Constraint
|
|
|
632623 |
+policyset.serverCertSet.1.constraint.params.pattern=CN=.*
|
|
|
632623 |
+policyset.serverCertSet.1.constraint.params.accept=true
|
|
|
632623 |
+policyset.serverCertSet.1.default.class_id=userSubjectNameDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.1.default.name=Subject Name Default
|
|
|
632623 |
+policyset.serverCertSet.1.default.params.name=
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.class_id=validityConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.name=Validity Constraint
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.params.range=720
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.params.notBeforeCheck=false
|
|
|
632623 |
+policyset.serverCertSet.2.constraint.params.notAfterCheck=false
|
|
|
632623 |
+policyset.serverCertSet.2.default.class_id=validityDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.2.default.name=Validity Default
|
|
|
632623 |
+policyset.serverCertSet.2.default.params.range=720
|
|
|
632623 |
+policyset.serverCertSet.2.default.params.startTime=0
|
|
|
632623 |
+policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.3.constraint.name=Key Constraint
|
|
|
632623 |
+policyset.serverCertSet.3.constraint.params.keyType=-
|
|
|
632623 |
+policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096,nistp256,nistp384,nistp521
|
|
|
632623 |
+policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.3.default.name=Key Default
|
|
|
632623 |
+policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.4.constraint.name=No Constraint
|
|
|
632623 |
+policyset.serverCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.4.default.name=Authority Key Identifier Default
|
|
|
632623 |
+policyset.serverCertSet.5.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.5.constraint.name=No Constraint
|
|
|
632623 |
+policyset.serverCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.5.default.name=AIA Extension Default
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessADEnable_0=true
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0=
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessCritical=false
|
|
|
632623 |
+policyset.serverCertSet.5.default.params.authInfoAccessNumADs=1
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.name=Key Usage Extension Constraint
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageDataEncipherment=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageKeyEncipherment=true
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.serverCertSet.6.constraint.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.class_id=keyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.6.default.name=Key Usage Default
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageCritical=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageDigitalSignature=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageNonRepudiation=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageDataEncipherment=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageKeyEncipherment=true
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageKeyAgreement=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageKeyCertSign=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageCrlSign=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageEncipherOnly=false
|
|
|
632623 |
+policyset.serverCertSet.6.default.params.keyUsageDecipherOnly=false
|
|
|
632623 |
+policyset.serverCertSet.7.constraint.class_id=noConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.7.constraint.name=No Constraint
|
|
|
632623 |
+policyset.serverCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.7.default.name=Extended Key Usage Extension Default
|
|
|
632623 |
+policyset.serverCertSet.7.default.params.exKeyUsageCritical=false
|
|
|
632623 |
+policyset.serverCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2
|
|
|
632623 |
+policyset.serverCertSet.8.constraint.class_id=signingAlgConstraintImpl
|
|
|
632623 |
+policyset.serverCertSet.8.constraint.name=No Constraint
|
|
|
632623 |
+policyset.serverCertSet.8.constraint.params.signingAlgsAllowed=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC
|
|
|
632623 |
+policyset.serverCertSet.8.default.class_id=signingAlgDefaultImpl
|
|
|
632623 |
+policyset.serverCertSet.8.default.name=Signing Alg
|
|
|
632623 |
+policyset.serverCertSet.8.default.params.signingAlg=-
|
|
|
632623 |
diff --git a/base/ca/shared/profiles/ca/caFullCMCUserCert.cfg b/base/ca/shared/profiles/ca/caFullCMCUserCert.cfg
|
|
|
632623 |
index 29baeed..90cb424 100644
|
|
|
632623 |
--- a/base/ca/shared/profiles/ca/caFullCMCUserCert.cfg
|
|
|
632623 |
+++ b/base/ca/shared/profiles/ca/caFullCMCUserCert.cfg
|
|
|
632623 |
@@ -1,7 +1,7 @@
|
|
|
632623 |
-desc=This certificate profile is for enrolling user certificates by using the CMC certificate request with CMC Signature authentication.
|
|
|
632623 |
+desc=This certificate profile is for enrolling user certificates by using the agent-signed CMC certificate request with CMC Signature authentication.
|
|
|
632623 |
enable=true
|
|
|
632623 |
enableBy=admin
|
|
|
632623 |
-name=Signed CMC-Authenticated User Certificate Enrollment
|
|
|
632623 |
+name=Agent-Signed CMC-Authenticated User Certificate Enrollment
|
|
|
632623 |
visible=false
|
|
|
632623 |
auth.instance_id=CMCAuth
|
|
|
632623 |
input.list=i1,i2
|
|
|
632623 |
diff --git a/base/ca/shared/profiles/ca/caFullCMCUserSignedCert.cfg b/base/ca/shared/profiles/ca/caFullCMCUserSignedCert.cfg
|
|
|
632623 |
index 63a4bca..7bfad9c 100644
|
|
|
632623 |
--- a/base/ca/shared/profiles/ca/caFullCMCUserSignedCert.cfg
|
|
|
632623 |
+++ b/base/ca/shared/profiles/ca/caFullCMCUserSignedCert.cfg
|
|
|
632623 |
@@ -1,4 +1,4 @@
|
|
|
632623 |
-desc=This certificate profile is for enrolling user certificates by using the CMC certificate request with user CMC Signature authentication.
|
|
|
632623 |
+desc=This certificate profile is for enrolling user certificates by using the CMC certificate request with non-agent user CMC authentication.
|
|
|
632623 |
enable=true
|
|
|
632623 |
enableBy=admin
|
|
|
632623 |
name=User-Signed CMC-Authenticated User Certificate Enrollment
|
|
|
632623 |
diff --git a/base/ca/shared/webapps/ca/WEB-INF/web.xml b/base/ca/shared/webapps/ca/WEB-INF/web.xml
|
|
|
632623 |
index a550142..2666049 100644
|
|
|
632623 |
--- a/base/ca/shared/webapps/ca/WEB-INF/web.xml
|
|
|
632623 |
+++ b/base/ca/shared/webapps/ca/WEB-INF/web.xml
|
|
|
632623 |
@@ -1553,6 +1553,167 @@
|
|
|
632623 |
</servlet>
|
|
|
632623 |
|
|
|
632623 |
<servlet>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullCACert </servlet-name>
|
|
|
632623 |
+ <servlet-class> com.netscape.cms.servlet.profile.ProfileSubmitCMCServlet </servlet-class>
|
|
|
632623 |
+ <init-param><param-name> GetClientCert </param-name>
|
|
|
632623 |
+ <param-value> false </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> cert_request_type </param-name>
|
|
|
632623 |
+ <param-value> cmc </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> profileId </param-name>
|
|
|
632623 |
+ <param-value> caCMCcaCert </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> AuthzMgr </param-name>
|
|
|
632623 |
+ <param-value> BasicAclAuthz </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> authorityId </param-name>
|
|
|
632623 |
+ <param-value> ca </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> ID </param-name>
|
|
|
632623 |
+ <param-value> caProfileSubmitCMCFull </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> templatePath </param-name>
|
|
|
632623 |
+ <param-value> /ee/ca/ProfileSubmit.template </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> resourceID </param-name>
|
|
|
632623 |
+ <param-value> certServer.ee.profile </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> interface </param-name>
|
|
|
632623 |
+ <param-value> ee </param-value> </init-param>
|
|
|
632623 |
+ </servlet>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullServerCert </servlet-name>
|
|
|
632623 |
+ <servlet-class> com.netscape.cms.servlet.profile.ProfileSubmitCMCServlet </servlet-class>
|
|
|
632623 |
+ <init-param><param-name> GetClientCert </param-name>
|
|
|
632623 |
+ <param-value> false </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> cert_request_type </param-name>
|
|
|
632623 |
+ <param-value> cmc </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> profileId </param-name>
|
|
|
632623 |
+ <param-value> caCMCserverCert </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> AuthzMgr </param-name>
|
|
|
632623 |
+ <param-value> BasicAclAuthz </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> authorityId </param-name>
|
|
|
632623 |
+ <param-value> ca </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> ID </param-name>
|
|
|
632623 |
+ <param-value> caProfileSubmitCMCFull </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> templatePath </param-name>
|
|
|
632623 |
+ <param-value> /ee/ca/ProfileSubmit.template </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> resourceID </param-name>
|
|
|
632623 |
+ <param-value> certServer.ee.profile </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> interface </param-name>
|
|
|
632623 |
+ <param-value> ee </param-value> </init-param>
|
|
|
632623 |
+ </servlet>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullOCSPCert </servlet-name>
|
|
|
632623 |
+ <servlet-class> com.netscape.cms.servlet.profile.ProfileSubmitCMCServlet </servlet-class>
|
|
|
632623 |
+ <init-param><param-name> GetClientCert </param-name>
|
|
|
632623 |
+ <param-value> false </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> cert_request_type </param-name>
|
|
|
632623 |
+ <param-value> cmc </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> profileId </param-name>
|
|
|
632623 |
+ <param-value> caCMCocspCert </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> AuthzMgr </param-name>
|
|
|
632623 |
+ <param-value> BasicAclAuthz </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> authorityId </param-name>
|
|
|
632623 |
+ <param-value> ca </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> ID </param-name>
|
|
|
632623 |
+ <param-value> caProfileSubmitCMCFull </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> templatePath </param-name>
|
|
|
632623 |
+ <param-value> /ee/ca/ProfileSubmit.template </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> resourceID </param-name>
|
|
|
632623 |
+ <param-value> certServer.ee.profile </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> interface </param-name>
|
|
|
632623 |
+ <param-value> ee </param-value> </init-param>
|
|
|
632623 |
+ </servlet>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullSubsystemCert </servlet-name>
|
|
|
632623 |
+ <servlet-class> com.netscape.cms.servlet.profile.ProfileSubmitCMCServlet </servlet-class>
|
|
|
632623 |
+ <init-param><param-name> GetClientCert </param-name>
|
|
|
632623 |
+ <param-value> false </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> cert_request_type </param-name>
|
|
|
632623 |
+ <param-value> cmc </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> profileId </param-name>
|
|
|
632623 |
+ <param-value> caCMCsubsystemCert </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> AuthzMgr </param-name>
|
|
|
632623 |
+ <param-value> BasicAclAuthz </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> authorityId </param-name>
|
|
|
632623 |
+ <param-value> ca </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> ID </param-name>
|
|
|
632623 |
+ <param-value> caProfileSubmitCMCFull </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> templatePath </param-name>
|
|
|
632623 |
+ <param-value> /ee/ca/ProfileSubmit.template </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> resourceID </param-name>
|
|
|
632623 |
+ <param-value> certServer.ee.profile </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> interface </param-name>
|
|
|
632623 |
+ <param-value> ee </param-value> </init-param>
|
|
|
632623 |
+ </servlet>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullAuditSigningCert </servlet-name>
|
|
|
632623 |
+ <servlet-class> com.netscape.cms.servlet.profile.ProfileSubmitCMCServlet </servlet-class>
|
|
|
632623 |
+ <init-param><param-name> GetClientCert </param-name>
|
|
|
632623 |
+ <param-value> false </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> cert_request_type </param-name>
|
|
|
632623 |
+ <param-value> cmc </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> profileId </param-name>
|
|
|
632623 |
+ <param-value> caCMCauditSigningCert </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> AuthzMgr </param-name>
|
|
|
632623 |
+ <param-value> BasicAclAuthz </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> authorityId </param-name>
|
|
|
632623 |
+ <param-value> ca </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> ID </param-name>
|
|
|
632623 |
+ <param-value> caProfileSubmitCMCFull </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> templatePath </param-name>
|
|
|
632623 |
+ <param-value> /ee/ca/ProfileSubmit.template </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> resourceID </param-name>
|
|
|
632623 |
+ <param-value> certServer.ee.profile </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> interface </param-name>
|
|
|
632623 |
+ <param-value> ee </param-value> </init-param>
|
|
|
632623 |
+ </servlet>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullKRATransportCert </servlet-name>
|
|
|
632623 |
+ <servlet-class> com.netscape.cms.servlet.profile.ProfileSubmitCMCServlet </servlet-class>
|
|
|
632623 |
+ <init-param><param-name> GetClientCert </param-name>
|
|
|
632623 |
+ <param-value> false </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> cert_request_type </param-name>
|
|
|
632623 |
+ <param-value> cmc </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> profileId </param-name>
|
|
|
632623 |
+ <param-value> caCMCkraTransportCert </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> AuthzMgr </param-name>
|
|
|
632623 |
+ <param-value> BasicAclAuthz </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> authorityId </param-name>
|
|
|
632623 |
+ <param-value> ca </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> ID </param-name>
|
|
|
632623 |
+ <param-value> caProfileSubmitCMCFull </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> templatePath </param-name>
|
|
|
632623 |
+ <param-value> /ee/ca/ProfileSubmit.template </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> resourceID </param-name>
|
|
|
632623 |
+ <param-value> certServer.ee.profile </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> interface </param-name>
|
|
|
632623 |
+ <param-value> ee </param-value> </init-param>
|
|
|
632623 |
+ </servlet>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullKRAstorageCert </servlet-name>
|
|
|
632623 |
+ <servlet-class> com.netscape.cms.servlet.profile.ProfileSubmitCMCServlet </servlet-class>
|
|
|
632623 |
+ <init-param><param-name> GetClientCert </param-name>
|
|
|
632623 |
+ <param-value> false </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> cert_request_type </param-name>
|
|
|
632623 |
+ <param-value> cmc </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> profileId </param-name>
|
|
|
632623 |
+ <param-value> caCMCkraStorageCert </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> AuthzMgr </param-name>
|
|
|
632623 |
+ <param-value> BasicAclAuthz </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> authorityId </param-name>
|
|
|
632623 |
+ <param-value> ca </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> ID </param-name>
|
|
|
632623 |
+ <param-value> caProfileSubmitCMCFull </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> templatePath </param-name>
|
|
|
632623 |
+ <param-value> /ee/ca/ProfileSubmit.template </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> resourceID </param-name>
|
|
|
632623 |
+ <param-value> certServer.ee.profile </param-value> </init-param>
|
|
|
632623 |
+ <init-param><param-name> interface </param-name>
|
|
|
632623 |
+ <param-value> ee </param-value> </init-param>
|
|
|
632623 |
+ </servlet>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet>
|
|
|
632623 |
<servlet-name> caProfileSubmitUserSignedCMCFull </servlet-name>
|
|
|
632623 |
<servlet-class> com.netscape.cms.servlet.profile.ProfileSubmitCMCServlet </servlet-class>
|
|
|
632623 |
<init-param><param-name> GetClientCert </param-name>
|
|
|
632623 |
@@ -2303,6 +2464,41 @@
|
|
|
632623 |
</servlet-mapping>
|
|
|
632623 |
|
|
|
632623 |
<servlet-mapping>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullCACert </servlet-name>
|
|
|
632623 |
+ <url-pattern> /ee/ca/profileSubmitCMCFullCACert </url-pattern>
|
|
|
632623 |
+ </servlet-mapping>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet-mapping>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullServerCert </servlet-name>
|
|
|
632623 |
+ <url-pattern> /ee/ca/profileSubmitCMCFullServerCert </url-pattern>
|
|
|
632623 |
+ </servlet-mapping>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet-mapping>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullOCSPCert </servlet-name>
|
|
|
632623 |
+ <url-pattern> /ee/ca/profileSubmitCMCFullOCSPCert </url-pattern>
|
|
|
632623 |
+ </servlet-mapping>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet-mapping>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullSubsystemCert </servlet-name>
|
|
|
632623 |
+ <url-pattern> /ee/ca/profileSubmitCMCFullSubsystemCert </url-pattern>
|
|
|
632623 |
+ </servlet-mapping>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet-mapping>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullAuditSigningCert </servlet-name>
|
|
|
632623 |
+ <url-pattern> /ee/ca/profileSubmitCMCFullAuditSigningCert </url-pattern>
|
|
|
632623 |
+ </servlet-mapping>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet-mapping>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullKRATransportCert </servlet-name>
|
|
|
632623 |
+ <url-pattern> /ee/ca/profileSubmitCMCFullKRAtransportCert </url-pattern>
|
|
|
632623 |
+ </servlet-mapping>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet-mapping>
|
|
|
632623 |
+ <servlet-name> caProfileSubmitCMCFullKRAstorageCert </servlet-name>
|
|
|
632623 |
+ <url-pattern> /ee/ca/profileSubmitCMCFullKRAstorageCert </url-pattern>
|
|
|
632623 |
+ </servlet-mapping>
|
|
|
632623 |
+
|
|
|
632623 |
+ <servlet-mapping>
|
|
|
632623 |
<servlet-name> caProfileSubmitUserSignedCMCFull </servlet-name>
|
|
|
632623 |
<url-pattern> /ee/ca/profileSubmitUserSignedCMCFull </url-pattern>
|
|
|
632623 |
</servlet-mapping>
|
|
|
632623 |
diff --git a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java
|
|
|
632623 |
index fd59aa1..9fcb8db 100644
|
|
|
632623 |
--- a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java
|
|
|
632623 |
+++ b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java
|
|
|
632623 |
@@ -2393,7 +2393,7 @@ public class CMCRequest {
|
|
|
632623 |
System.out.println("");
|
|
|
632623 |
System.out.println("");
|
|
|
632623 |
System.out.println("The CMC enrollment request in binary format is stored in " +
|
|
|
632623 |
- ofilename + ".");
|
|
|
632623 |
+ ofilename);
|
|
|
632623 |
} catch (IOException e) {
|
|
|
632623 |
System.out.println("CMCRequest: unable to open file " + ofilename +
|
|
|
632623 |
" for writing:\n" + e);
|
|
|
632623 |
diff --git a/base/server/cms/src/com/netscape/cms/authentication/CMCAuth.java b/base/server/cms/src/com/netscape/cms/authentication/CMCAuth.java
|
|
|
632623 |
index 9441167..459c7c6 100644
|
|
|
632623 |
--- a/base/server/cms/src/com/netscape/cms/authentication/CMCAuth.java
|
|
|
632623 |
+++ b/base/server/cms/src/com/netscape/cms/authentication/CMCAuth.java
|
|
|
632623 |
@@ -29,6 +29,7 @@ import java.io.ByteArrayInputStream;
|
|
|
632623 |
import java.io.ByteArrayOutputStream;
|
|
|
632623 |
import java.io.IOException;
|
|
|
632623 |
import java.math.BigInteger;
|
|
|
632623 |
+import java.security.cert.X509Certificate;
|
|
|
632623 |
import java.security.MessageDigest;
|
|
|
632623 |
import java.security.PublicKey;
|
|
|
632623 |
import java.util.Enumeration;
|
|
|
632623 |
@@ -246,6 +247,10 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
|
|
|
632623 |
String auditCertSubject = ILogger.UNIDENTIFIED;
|
|
|
632623 |
String auditSignerInfo = ILogger.UNIDENTIFIED;
|
|
|
632623 |
|
|
|
632623 |
+ SessionContext auditContext = SessionContext.getExistingContext();
|
|
|
632623 |
+ X509Certificate clientCert =
|
|
|
632623 |
+ (X509Certificate) auditContext.get(SessionContext.SSL_CLIENT_CERT);
|
|
|
632623 |
+
|
|
|
632623 |
// ensure that any low-level exceptions are reported
|
|
|
632623 |
// to the signed audit log and stored as failures
|
|
|
632623 |
try {
|
|
|
632623 |
@@ -361,7 +366,7 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
|
|
|
632623 |
String userid = "defUser";
|
|
|
632623 |
String uid = "defUser";
|
|
|
632623 |
if (checkSignerInfo) {
|
|
|
632623 |
- IAuthToken agentToken = verifySignerInfo(authToken, cmcFullReq);
|
|
|
632623 |
+ IAuthToken agentToken = verifySignerInfo(auditContext, authToken, cmcFullReq);
|
|
|
632623 |
if (agentToken == null) {
|
|
|
632623 |
CMS.debug(method + "agentToken null");
|
|
|
632623 |
throw new EBaseException("CMCAuth: agent verifySignerInfo failure");
|
|
|
632623 |
@@ -812,8 +817,12 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
|
|
|
632623 |
level, "CMC Authentication: " + msg);
|
|
|
632623 |
}
|
|
|
632623 |
|
|
|
632623 |
- protected IAuthToken verifySignerInfo(AuthToken authToken, SignedData cmcFullReq) throws EBaseException {
|
|
|
632623 |
-
|
|
|
632623 |
+ protected IAuthToken verifySignerInfo(
|
|
|
632623 |
+ SessionContext auditContext,
|
|
|
632623 |
+ AuthToken authToken,
|
|
|
632623 |
+ SignedData cmcFullReq) throws EBaseException {
|
|
|
632623 |
+ String method = "CMCAuth: verifySignerInfo: ";
|
|
|
632623 |
+ String msg = "";
|
|
|
632623 |
EncapsulatedContentInfo ci = cmcFullReq.getContentInfo();
|
|
|
632623 |
OBJECT_IDENTIFIER id = ci.getContentType();
|
|
|
632623 |
OCTET_STRING content = ci.getContent();
|
|
|
632623 |
@@ -822,6 +831,11 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
|
|
|
632623 |
CryptoToken signToken = null;
|
|
|
632623 |
CryptoToken savedToken = null;
|
|
|
632623 |
CryptoManager cm = null;
|
|
|
632623 |
+
|
|
|
632623 |
+ if (auditContext == null) {
|
|
|
632623 |
+ CMS.debug(method + " auditConext can't be null");
|
|
|
632623 |
+ return null;
|
|
|
632623 |
+ }
|
|
|
632623 |
try {
|
|
|
632623 |
cm = CryptoManager.getInstance();
|
|
|
632623 |
ByteArrayInputStream s = new ByteArrayInputStream(content.toByteArray());
|
|
|
632623 |
@@ -909,6 +923,34 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
|
|
|
632623 |
si.verify(digest, id);
|
|
|
632623 |
} else {
|
|
|
632623 |
CMS.debug("CMCAuth: found signing cert... verifying");
|
|
|
632623 |
+
|
|
|
632623 |
+ X509Certificate clientCert =
|
|
|
632623 |
+ (X509Certificate) auditContext.get(SessionContext.SSL_CLIENT_CERT);
|
|
|
632623 |
+ if (clientCert == null) {
|
|
|
632623 |
+ // createAuditSubjectFromCert(auditContext, x509Certs[0]);
|
|
|
632623 |
+ msg = "missing SSL client authentication certificate;";
|
|
|
632623 |
+ CMS.debug(method + msg);
|
|
|
632623 |
+ s.close();
|
|
|
632623 |
+ throw new EMissingCredential(
|
|
|
632623 |
+ CMS.getUserMessage("CMS_AUTHENTICATION_NO_CERT"));
|
|
|
632623 |
+ }
|
|
|
632623 |
+ netscape.security.x509.X500Name clientPrincipal =
|
|
|
632623 |
+ (X500Name) clientCert.getSubjectDN();
|
|
|
632623 |
+
|
|
|
632623 |
+ netscape.security.x509.X500Name cmcPrincipal =
|
|
|
632623 |
+ (X500Name) x509Certs[0].getSubjectDN();
|
|
|
632623 |
+
|
|
|
632623 |
+ // check ssl client cert against cmc signer
|
|
|
632623 |
+ if (!clientPrincipal.equals(cmcPrincipal)) {
|
|
|
632623 |
+ msg = "SSL client authentication certificate and CMC signer do not match";
|
|
|
632623 |
+ CMS.debug(method + msg);
|
|
|
632623 |
+ s.close();
|
|
|
632623 |
+ throw new EInvalidCredentials(
|
|
|
632623 |
+ CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL") + ":" + msg);
|
|
|
632623 |
+ } else {
|
|
|
632623 |
+ CMS.debug(method + "ssl client cert principal and cmc signer principal match");
|
|
|
632623 |
+ }
|
|
|
632623 |
+
|
|
|
632623 |
PublicKey signKey = cert.getPublicKey();
|
|
|
632623 |
PrivateKey.Type keyType = null;
|
|
|
632623 |
String alg = signKey.getAlgorithm();
|
|
|
632623 |
diff --git a/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java b/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java
|
|
|
632623 |
index 6c3ee8f..e11a344 100644
|
|
|
632623 |
--- a/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java
|
|
|
632623 |
+++ b/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java
|
|
|
632623 |
@@ -1078,6 +1078,8 @@ public class CMCUserSignedAuth implements IAuthManager, IExtendedPluginInfo,
|
|
|
632623 |
s.close();
|
|
|
632623 |
throw new EInvalidCredentials(
|
|
|
632623 |
CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL") + ":" + msg);
|
|
|
632623 |
+ } else {
|
|
|
632623 |
+ CMS.debug(method + "ssl client cert principal and cmc signer principal match");
|
|
|
632623 |
}
|
|
|
632623 |
|
|
|
632623 |
PublicKey signKey = cert.getPublicKey();
|
|
|
632623 |
diff --git a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java
|
|
|
632623 |
index 8f3e986..1356035 100644
|
|
|
632623 |
--- a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java
|
|
|
632623 |
+++ b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java
|
|
|
632623 |
@@ -198,6 +198,7 @@ public abstract class EnrollProfile extends BasicProfile
|
|
|
632623 |
if (signingUserSerial != null) {
|
|
|
632623 |
donePOI = true;
|
|
|
632623 |
}
|
|
|
632623 |
+
|
|
|
632623 |
// catch for invalid request
|
|
|
632623 |
cmc_msgs = parseCMC(locale, cert_request, donePOI);
|
|
|
632623 |
if (cmc_msgs == null) {
|
|
|
632623 |
@@ -723,6 +724,17 @@ public abstract class EnrollProfile extends BasicProfile
|
|
|
632623 |
byte randomSeed[] = null;
|
|
|
632623 |
UTF8String ident_s = null;
|
|
|
632623 |
SessionContext context = SessionContext.getContext();
|
|
|
632623 |
+ String authManagerId = (String) context.get(SessionContext.AUTH_MANAGER_ID);
|
|
|
632623 |
+ if (authManagerId == null) {
|
|
|
632623 |
+ CMS.debug(method + "authManagerId null.????");
|
|
|
632623 |
+ //unlikely, but...
|
|
|
632623 |
+ authManagerId = "none";
|
|
|
632623 |
+ } else {
|
|
|
632623 |
+ CMS.debug(method + "authManagerId =" + authManagerId);
|
|
|
632623 |
+ }
|
|
|
632623 |
+ if(authManagerId.equals("CMCAuth")) {
|
|
|
632623 |
+ donePOI = true;
|
|
|
632623 |
+ }
|
|
|
632623 |
|
|
|
632623 |
boolean id_cmc_revokeRequest = false;
|
|
|
632623 |
if (!context.containsKey("numOfControls")) {
|
|
|
632623 |
diff --git a/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java b/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java
|
|
|
632623 |
index d087162..f7a6470 100644
|
|
|
632623 |
--- a/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java
|
|
|
632623 |
+++ b/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java
|
|
|
632623 |
@@ -496,7 +496,7 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {
|
|
|
632623 |
///////////////////////////////////////////////
|
|
|
632623 |
String tmpCertSerialS = ctx.get(IAuthManager.CRED_CMC_SIGNING_CERT);
|
|
|
632623 |
if (tmpCertSerialS != null) {
|
|
|
632623 |
- // unlikely to happenm, but do this just in case
|
|
|
632623 |
+ // unlikely to happen, but do this just in case
|
|
|
632623 |
CMS.debug("ProfileSubmitCMCServlet: found existing CRED_CMC_SIGNING_CERT in ctx for CMCUserSignedAuth:" + tmpCertSerialS);
|
|
|
632623 |
CMS.debug("ProfileSubmitCMCServlet: null it out");
|
|
|
632623 |
ctx.set(IAuthManager.CRED_CMC_SIGNING_CERT, "");
|
|
|
632623 |
--
|
|
|
632623 |
1.8.3.1
|
|
|
632623 |
|