Comments (10)
Manfonly,
I just parsed your CSR with ("openssl asn1parse –text –in csr_file_name.csr"). I note you are using UTF-8 strings. I also note your openssl.conf doesn’t include a subjectAltName field.
Can I suggest you modify your openssl.conf file to see if these changes address your problem of issuing a certificate?
-
Within the [req] section add both “utf8 = no” and “string_mask = nombstr”. Then review your generated CSR, hopefully it won’t indicate “:unable to print attribute” against the challengePassword. Also I’m hoping your challengePassword is now printable string?
-
Additionally you also need to add a subjectAltName to the generated CSR. Add an entry to [req] section of your openssl.conf file, something like: “subjectAltName=critical,DNS:certnanny-sscep.poc.shanghai.cn”
Assuming this issues a SCEP certificate against NDES you can play with the string_mask values to determine if UTF-8 is supported?
Regards
Nigel
from sscep.
Not sure about NDES never tested it but the challenge password should be a BMP String.
from sscep.
This is my mscep_admin page:
Network Device Enrollment Service allows you to obtain certificates for routers or other network devices using the Simple Certificate Enrollment Protocol (SCEP).
To complete certificate enrollment for your network device you will need the following information:
The thumbprint (hash value) for the CA certificate is: E79F8AD3 73F7D8E0 F2688840 8563ACA1
The enrollment challenge password is: 00F7FC7937B5366F2231AC891472998C
This password can be used multiple times and will not expire.
For more information see Using Network Device Enrollment Service .
I just copied "00F7FC7937B5366F2231AC891472998C".
from sscep.
Yeah but that is not an BPM String and OpenSSL won't encode it for you.
https://tools.ietf.org/html/rfc3641
https://msdn.microsoft.com/en-us/library/windows/desktop/bb540793%28v=vs.85%29.aspx
from sscep.
Do you mean I need to encode challenge password?
I can set this challenge password in the openssl interactive way, and it looks like NDES does not support set a challenge password.
from sscep.
No Idea about NDES and its configuration. For a normal SCEP server you need to encode the password to a BMP string and then give it to openSSL to embed in the CSR.
from sscep.
Hi rad1us, you are right.
I looks like a bug in the linux openssl. It can not encode 00F7FC7937B5366F2231AC891472998C into challenge password attribute, but the windows version can do it.
from sscep.
@tedescn @manfonly
I wanted to provide an update to this. We have tested this with sscep & SCEP from an NDES server on Windows Server 2012 R2. The additions suggested by @tedescn have resulting it working behavior for us.
Works without modification: openssl 1.0.1f
Works with modification: openssl 1.0.1i, 1.0.2h
from sscep.
I m trying with 1.0.2i. @tedescn any patch or modification can resolve this.
from sscep.
Thank you. This helped me to fix my issue with NDES.
“string_mask = nombstr”
Can someone please confirm if this change in openssl config will work with all types of SCEP servers?
from sscep.
Related Issues (20)
- Questions about SCEP polling mode HOT 4
- Does SSCEP enroll works with RA? HOT 1
- sscep: illegal URL https HOT 6
- Issue generating certs HOT 19
- IPv6 address malformatted in getca requests
- CA Identifier switch -i not functional? HOT 1
- any way to pass a private key passphrase to an enroll request?
- Sscep version compatible with openssl 3.0.2 15 HOT 6
- enrollment challenge password HOT 1
- Error parsing IPv6 address without port
- Does the sscep support PKCS11 engine? HOT 8
- Also not able to Enroll with NDES, failure reason: Integrity check failed, illegal size of payload HOT 1
- sscep: error verifying signature with Red Hat 9 HOT 3
- Dogtag 10.12 Seemingly Returning Incorrect pkiStatus to sscep 0.9.1 When Certificate Request is Awaiting Approval HOT 1
- CAIdentifier will send with GETCA even it is not defined in the call HOT 1
- getca option -> "cannot parse response"
- I want to add 'I' option on making enrollment on sscep-0.9.0 version to use specific ip address on multi ethernet port.
- Building sscep client in Rockey Linux8 Failed HOT 1
- sscep for FreeRTOS
- sscep enroll server response status code: 500, MIME header: missing HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sscep.