Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 509481

Summary: RFE: support sMIMECapabilities extensions in certificates (RFC 4262)
Product: [Retired] Dogtag Certificate System Reporter: Nelson Bolyard <nelson>
Component: CAAssignee: Christina Fu <cfu>
Status: CLOSED CURRENTRELEASE QA Contact: Chandrasekar Kannan <ckannan>
Severity: medium Docs Contact:
Priority: high    
Version: unspecifiedCC: awnuk, benl, dlackey, ksiddiqu, msauton, tao
Target Milestone: ---Keywords: FutureFeature
Target Release: ---   
Hardware: All   
OS: Linux   
URL: ftp://ftp.rfc-editor.org/in-notes/rfc4262.txt
Whiteboard:
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-04 19:53:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 445047, 530474    
Attachments:
Description Flags
a dual-use user cert profile with S/MIME capabilities extension cfu: review? (awnuk)

Description Nelson Bolyard 2009-07-03 02:47:55 UTC 
RFC 4262 defines a new certificate extension which is merely an  
sMIMECapabilities SEQUENCE, just like the one put into a signed S/MIME email.
Microsoft's Certificate Server product puts these extensions into S/MIME
encryption certs that it issues.  DogTag should fully support them. 

This certificate extension has an identifying OID of
   sMIMECapabilities (1 2 840 113549 1 9 15) 
and the OCTET STRING encapsulates a data structure that is identical to 
the data structure of the SMIMECapabilities attribute defined in RFC 3851.
Comment 1 Christina Fu 2009-10-21 00:01:18 UTC 
Nelson,
Is this extension widely used by major applications?  thanks.
Comment 2 Nelson Bolyard 2009-10-21 02:30:29 UTC 
Microsoft email software uses them.  Don't know about any other MUAs or MTAs,
but a CA product that doesn't support them will probably be locked out of 
shops that are predominately MS outlook.
Comment 8 Marc Sauton 2010-08-27 18:07:46 UTC 
There is a way to "partially" accomplish this:
Use the GenericExtDefault extension defined in the profile framework (I initially searched for GenericASN1Ext which should not be used)

It is defined in
pki/base/common/src/com/netscape/cms/profile/def/GenericExtDefault.java:   
public GenericExtDefault() {

Create a custom profile like:

desc=testms.GenericExtDefault
visible=true
enable=true
enableBy=admin
name= testms.GenericExtDefault ManualUserDualSignEnc
auth.class_id=
input.list=i1,i2,i3
input.i1.class_id=dualKeyGenInputImpl
input.i2.class_id=subjectNameInputImpl
input.i3.class_id=submitterInfoInputImpl
output.list=o1
output.o1.class_id=certOutputImpl
policyset.list=encryptionCertSet,signingCertSet
...
policyset.signingCertSet.list=1,2,3,4,6,7,8,9,gen
...
policyset.signingCertSet.gen.constraint.class_id=noConstraintImpl
policyset.signingCertSet.gen.constraint.name=No Constraint
policyset.signingCertSet.gen.default.class_id=genericExtDefaultImpl
policyset.signingCertSet.gen.default.name=Generic Extension
policyset.signingCertSet.gen.default.params.genericExtOID=1.2.840.113549.1.9.15
policyset.signingCertSet.gen.default.params.genericExtData=30673...snip...0101

The "issue" is the data till has to be generated "manually".
Like with an openssl SMIME-CAPS definition for ASN1:SEQUENCE to define S/MIME Capabilities in openssl.cnf or with a openssl asn1parse command

Then I can enroll for a signing cert, and can sign e-mails with a mail client.

Generating the ASN1 DER encoded sequence for S/MIME capabilities may not be trivial when creating the profiles, or may be need by agents during enrollment, which is not very convenient.
That second part should probably have some kind of improved support.
Comment 18 Christina Fu 2010-11-12 00:47:32 UTC 
TIP

$ svn commit
Sending        ca/shared/conf/CS.cfg
Adding         ca/shared/profiles/ca/caUserSMIMEcapCert.cfg
Transmitting file data ..
Committed revision 1495.
Comment 19 Marc Sauton 2010-11-12 00:58:11 UTC 
added
bz 652482 - rhcs80 pki-java-tools ExtJoiner java.io.IOException: extra DER value data (constructor)

for comment 16