Bug 488291
| Summary: | Missing renewal feature for smart cards in TMS | ||
|---|---|---|---|
| Product: | [Retired] Dogtag Certificate System | Reporter: | Christina Fu <cfu> |
| Component: | TPS | Assignee: | Christina Fu <cfu> |
| Status: | CLOSED ERRATA | QA Contact: | Chandrasekar Kannan <ckannan> |
| Severity: | medium | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 1.1 | CC: | alee, benl, jmagne |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-07-22 23:32:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 493118 | ||
| Bug Blocks: | 443788 | ||
| Attachments: | |||
Created attachment 337338 [details]
profiles change to give renewal grace period
Created attachment 337339 [details]
smart card renewal sample signing profile
Created attachment 337340 [details]
smart card renewal sample encryption profile
Created attachment 337341 [details]
added smart card enrollment profiles to CA's CS.cfg
Submitted is the basic renewal feature for smart card (token) certificate renewal. Note: * The grace period check on TPS is currently disabled. It relies on the CA to make decisions. * To enable a token for renewal, agent needs to go to TUS agent interface and change the policy to "RENEW=YES" (this is different from the default of "RE_ENROLL=YES" * Currently labels are not tunable in CS.cfg. It will be added later. * This feature will require the newest ESC from today's (would-be) changes. * To try renewal, format and enroll token. Then when you press "Enroll" button again on ESC for the same token, you will be exercising the renewal code. Jack please review. Created attachment 337351 [details]
tps spec file change
Created attachment 337355 [details]
ca spec file changes
Attachment (id=337337) +jmagne ; Check for memory leaks though, lots of new complex code. (In reply to comment #9) > Attachment (id=337337) +jmagne ; > > Check for memory leaks though, lots of new complex code. yes, that will be done post Beta. This feature is not on by default and will not affect existing functionality. Attachment (id=337338) +jmagne Attachments (id=337340) (id=337341) (id=337351) (id=337355) +jmagne /home/cfu/dogtag/src-tps/pki/base/tps [cfu@claw tps]$ svn commit Sending tps/doc/CS.cfg Sending tps/src/cms/CertEnroll.cpp Sending tps/src/engine/RA.cpp Sending tps/src/include/cms/CertEnroll.h Sending tps/src/include/engine/RA.h Sending tps/src/include/processor/RA_Enroll_Processor.h Sending tps/src/include/processor/RA_Processor.h Sending tps/src/include/tus/tus_db.h Sending tps/src/processor/RA_Enroll_Processor.cpp Sending tps/src/tus/tus_db.c Transmitting file data .......... Committed revision 356. /home/cfu/dogtag/src-tps/pki/base/ca/shared [cfu@claw shared]$ svn commit Sending shared/conf/CS.cfg Sending shared/profiles/ca/caTokenUserEncryptionKeyEnrollment.cfg Adding shared/profiles/ca/caTokenUserEncryptionKeyRenewal.cfg Sending shared/profiles/ca/caTokenUserSigningKeyEnrollment.cfg Adding shared/profiles/ca/caTokenUserSigningKeyRenewal.cfg Transmitting file data ..... Committed revision 357. /home/cfu/dogtag/src-tps/pki/dogtag/tps [cfu@claw tps]$ svn commit Sending tps/pki-tps.spec Transmitting file data . Committed revision 358. /home/cfu/dogtag/src-tps/pki/dogtag/ca [cfu@claw ca]$ svn commit Sending ca/pki-ca.spec Transmitting file data . Committed revision 359. |
Created attachment 337337 [details] smart card cert renewal feature implementation