[Ejbca-develop] Interop cmpforopenssl with EJBCA

Discussion:

dominic peter

2012-10-09 11:59:14 UTC

Hi,

Has anyone tried to interop cmpforopenssl client with EJBCA.

I am trying to send an 'ir' request to EJBCA from the cmpforopenssl client
using the following command,

./cmpclient --server localhost --port 8080 --path ejbca/publicweb/cmp
--srvcert myAdminCA.cacert.pem --ir --user test1 --password test1
--newclcert test1.pem --newkey test1.key --subject
"C=IN,ST=KAR,L=TEST,O=TEST,OU=
EN,CN=EETest1"

I am seeing the following error on the EJBCA after sending the 'ir' request
from the client,

15:40:36,975 ERROR [CrmfMessageHandler] Could not extract password from
CRMF request using the RegTokenPwd authentication module
15:40:36,997 INFO [CmpServlet] Sent a CMP response to: 127.0.0.1, process
time 217.

On the cmpclient i am seeing the following error,

INFO: Sending Initialization Request
ERROR: received no initial Client Certificate. FILE cmpclient.c, LINE 401
3078551176:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong
tag:tasn_dec.c:1319:
3078551176:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested
asn1 error:tasn_dec.c:381:Type=X509
3078551176:error:32090087:CMP routines:CMP_doInitialRequestSeq:pkibody
error:cmp_ses.c:384:bodytype=23, error="PKIStatus: rejection,
PKIFailureInfo: wrongAuthority"

And ideas ?

Thanks in advance.

Regards

ejbca-support

2012-10-09 12:12:52 UTC

Permalink

Post by dominic peter
Hi,

Hi Dominic,

Post by dominic peter
Has anyone tried to interop cmpforopenssl client with EJBCA.

Yes,
http://www.ejbca.org/adminguide.html#Interoperability

Post by dominic peter
I am trying to send an 'ir' request to EJBCA from the cmpforopenssl client using the following command,
./cmpclient --server localhost --port 8080 --path ejbca/publicweb/cmp --srvcert myAdminCA.cacert.pem --ir --user test1 --password test1 --newclcert test1.pem --newkey test1.key --subject "C=IN,ST=KAR,L=TEST,O=TEST,OU=
EN,CN=EETest1"
I am seeing the following error on the EJBCA after sending the 'ir' request from the client,
15:40:36,975 ERROR [CrmfMessageHandler] Could not extract password from CRMF request using the RegTokenPwd authentication module
15:40:36,997 INFO [CmpServlet] Sent a CMP response to: 127.0.0.1, process time 217.
On the cmpclient i am seeing the following error,
INFO: Sending Initialization Request
ERROR: received no initial Client Certificate. FILE cmpclient.c, LINE 401
3078551176 <tel:3078551176>:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=X509
3078551176 <tel:3078551176>:error:32090087:CMP routines:CMP_doInitialRequestSeq:pkibody error:cmp_ses.c:384:bodytype=23, error="PKIStatus: rejection, PKIFailureInfo: wrongAuthority"
And ideas ?

Check configuration.

Cheers,
Anders
tech support

Post by dominic peter
Thanks in advance.
Regards
------------------------------------------------------------------------------
Don't let slow site performance ruin your business. Deploy New Relic APM
Deploy New Relic app performance management and know exactly
what is happening inside your Ruby, Python, PHP, Java, and .NET app
Try New Relic at no cost today and get our sweet Data Nerd shirt too!
http://p.sf.net/sfu/newrelic-dev2dev
_______________________________________________
Ejbca-develop mailing list
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

dominic peter

2012-10-10 09:22:26 UTC

Permalink

Hi Anders,

Thank you very much for the reply.

*RA mode:

*I checked by updating the cmp configuration for '*RA*' mode as per the
link that you sent.
But still i am getting the same error. Following is the content of the
cmp.properties file,

cmp.operationmode=ra
cmp.responseprotection=pbe
cmp.ra.authenticationsecret=password

Am i missing something here ? Is just updating the configuration file
enough for the configurations to take effect ?

Also can you please help me understand why i am getting the following error
on the EJBC server,

*ERROR [CrmfMessageHandler] Could not extract password from CRMF request
using the RegTokenPwd authentication module
*
Is this due to some missing parameters in the 'ir' message sent from
cmpclient ?

*Client Mode:*

I also tried by configuring the EJBCA in *client mode*. In this case, the
'ir' message exchange was successful. But the 'cr' message exchange failed.
Following was the error message on the EJBCA server,

*ERROR [CrmfMessageHandler] Could not create CmpPbeVerifyer*

Any idea what is the reason for this error ?

Packet captures for both RA and client mode is attached to this mail.

Also please help me understand the necessary initializations or any other
prerequisites on the cmpclient side if any for interop with EJBCA.

Regards
Dominic