Comments (4)
At least OpenXPKI expects that the same transaction ID be used, otherwise it is impossible to properly handle latency or delayed certificate issuance on the backend (e. g. if a certificate request has to be approved manually). If you retry with a different transaction ID the PKI will see a new initial enrollment which will also end up as a new pending request in addition to the previous one.
My take on this is to reuse the same transaction ID for a pending request while polling until the client receives the issued certificate or the client determines that the request has failed (e. g. after a few hours or days).
from sscep.
At least OpenXPKI expects that the same transaction ID be used, otherwise it is impossible to properly handle latency or delayed certificate issuance on the backend (e. g. if a certificate request has to be approved manually). If you retry with a different transaction ID the PKI will see a new initial enrollment which will also end up as a new pending request in addition to the previous one.
My take on this is to reuse the same transaction ID for a pending request while polling until the client receives the issued certificate or the client determines that the request has failed (e. g. after a few hours or days).
@mbartosch, Thank you for response. I will proceed with this approach then.
Also, regarding transaction Id value used by sscep for enroll. As I got from source ccode, it will remain the same as long as public key in csr file will be the same. Is that correct?
from sscep.
IIRC the code computes the TID from the public key via a hash. This is also suggested by the standard and good practice, IMO.
from sscep.
Ok, thank you.
from sscep.
Related Issues (20)
- Sscep version compatible with openssl 3.0.2 15 HOT 6
- enrollment challenge password HOT 1
- Error parsing IPv6 address without port
- Does the sscep support PKCS11 engine? HOT 8
- Also not able to Enroll with NDES, failure reason: Integrity check failed, illegal size of payload HOT 1
- sscep: error verifying signature with Red Hat 9 HOT 3
- Dogtag 10.12 Seemingly Returning Incorrect pkiStatus to sscep 0.9.1 When Certificate Request is Awaiting Approval HOT 1
- CAIdentifier will send with GETCA even it is not defined in the call HOT 1
- getca option -> "cannot parse response"
- I want to add 'I' option on making enrollment on sscep-0.9.0 version to use specific ip address on multi ethernet port.
- Building sscep client in Rockey Linux8 Failed HOT 1
- sscep for FreeRTOS
- sscep enroll server response status code: 500, MIME header: missing HOT 1
- sscep.exe not writing certificate to disk
- Request PQ Dilithium5 Cert with SSCEP HOT 1
- Private key requirement for certificate enrollent? HOT 1
- OpenSSL Engines are no longer available, is there support for OpenSSL Provider tpm2? HOT 7
- How to contribute with the project HOT 2
- Pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp
- HTTP username and password support HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sscep.