Comments (2)
i am trying to use ecc keys for scep call to my server. Each time i am facing below error:
[root@localhost sscep]# ./sscep_static enroll -u http://10.97.57.229:8030/csrscep/CSRESEPA -k /root/ecc_certificates/key.pem -c ca.crt-0 ca.crt-1 ca.crt-2 -r /root/ecc_certificates/csr.csr -l local.crt -S sha1 -v
./sscep_static: starting sscep, version 0.6.1
./sscep_static: new transaction
./sscep_static: transaction id: D41D8CD98F00B204E9800998ECF8427E
./sscep_static: hostname: 10.97.57.229
./sscep_static: directory: csrscep/CSRESEPA
./sscep_static: port: 8030
./sscep_static: Read request with transaction id: A6358A3B391CC53F8C2E91CA8CF45F5C
./sscep_static: generating selfsigned certificate
./sscep_static: SCEP_OPERATION_ENROLL
./sscep_static: sending certificate request
./sscep_static: creating inner PKCS#7
./sscep_static: inner PKCS#7 in mem BIO
./sscep_static: request data dump
-----BEGIN CERTIFICATE REQUEST-----
MIIBSTCB8AIBADCBjTELMAkGA1UEBhMCQ0ExEDAOBgNVBAgMB09udGFyaW8xETAP
BgNVBAcMCEJheXNob3JlMRAwDgYDVQQKDAdFbnRydXN0MRAwDgYDVQQLDAdJT1RS
VVNUMQswCQYDVQQDDAJDTjEoMCYGCSqGSIb3DQEJARYZZ3VycHJlZXQua2F1ckBl
bnRydXN0LmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABB6geve4NJUGxoPb
rO6t3C6BQVuH3GATrFjkd5qsm9nw0dGdvUSMvuZ6u43s1HCJ52kZfRZCcBfaFqB+
ZnrdzNKgADAKBggqhkjOPQQDAgNIADBFAiBcZP41hfNsxcagSPcQYh2T0B/Co2Vn
lX0pvbQAiE/7vgIhAItV8S22hUKjzr6ocWG055RRBgyxYLI71kweUHK5ZlC3
-----END CERTIFICATE REQUEST-----
./sscep_static: data payload size: 333 bytes
./sscep_static: request payload encrypt failed
140148955121328:error:21082096:PKCS7 routines:PKCS7_RECIP_INFO_set:encryption not supported for this key type:pk7_lib.c:541:
140148955121328:error:21073078:PKCS7 routines:PKCS7_encrypt:error adding recipient:pk7_smime.c:503:
[root@localhost sscep]#
Could you elaborate what could be done to make ecc keys work with it?
from sscep.
40148955121328:error:21082096:PKCS7 routines:PKCS7_RECIP_INFO_set:encryption not supported for this key type:pk7_lib.c:541:
gives you the reason.
EC keys can be used for Digital Signatures but they are not (directly) usable for encryption. (This requires a workaround involving static ECDH parameters)
I suspect that the SCEP RA Server certificate ca.crt-0 is also an EC certificate. Try an RSA certificate for the SCEP server certificate instead. (I would be surprised if this actually works with an EC SCEP RA server certificate with the static ECDH parameters, though).
I also have never tried to use sscep with EC end entity keys. From your test and from a quick glance at the code it looks like it could work, but I would not bet on it.
from sscep.
Related Issues (20)
- getca option -> "cannot parse response"
- I want to add 'I' option on making enrollment on sscep-0.9.0 version to use specific ip address on multi ethernet port.
- Building sscep client in Rockey Linux8 Failed HOT 1
- sscep for FreeRTOS
- sscep enroll server response status code: 500, MIME header: missing HOT 1
- sscep.exe not writing certificate to disk
- Request PQ Dilithium5 Cert with SSCEP HOT 1
- Private key requirement for certificate enrollent? HOT 1
- OpenSSL Engines are no longer available, is there support for OpenSSL Provider tpm2? HOT 7
- How to contribute with the project HOT 2
- Pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp
- HTTP username and password support HOT 2
- how to get the certificates chain in the sscep enroll request HOT 1
- PKCS7_RECIP_INFO_set:encryption not supported for this key type HOT 1
- Can't decipher errors
- Documentation Discrepeancy HOT 1
- Cannot Enroll with a CSR Signed By a Key Stored in TPM 2.0 HOT 7
- How to revoke/unenroll a certificate with SSCEP? HOT 2
- sscep should support EC keys by using CMS instead of PKCS#7
- New release HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sscep.