ejbca-develop — Development discussions

Re: [Ejbca-develop] debug log ejbca.sh

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> this issue is still driving me crazy... :-[
> 
> ejbca.sh ca listcas takes nearly a minute on different systems.

A colleague found out that it took so much time because I set

ejbca.passwordlogrounds=16

It seems to me that the password check with the 2^16 rounds is performed many
times, not only once within kind of a session.

Ciao, Michael.

[Ejbca-develop] EJBCA certificatedata cleanup

[Randy Yu <yu...@ec...>]

For EJBCA certificatedata maintenance, what is the best procedure to purge unused/old certificates issues by a CA this is no longer in use?

--
Randy Yu

[Ejbca-develop] EJBCA Web Services

[Liliana C. <lil...@bu...>]

Hello all,

I'm trying to use EJBCA Web Services to create end entities and P12 certificates.

I've arrived to create them, but I need to save the certificate in a particular location. To do this, I've found a sample code using
KeyStoreHelper class. The problem is that this class is not included within the WSDL (org.ejbca.core.protocol.ws) and I cannot import it
(org.ejbca.core.protocol.ws.common.KeyStoreHelper is unknown).

        String username = user1.getUsername();
        String password = user1.getPassword();
        String outputPath = "C:\\temp\\ClientEJBCA_WS";
        String filepath = username + ".p12";

        if(result==null){
            System.err.println("No keystore could be generated for user");
            System.exit(1);
        }else{
            filepath = outputPath + "/" + filepath;
        }
        try {
            fos = new FileOutputStream(filepath);
        } catch (FileNotFoundException ex) {
            Logger.getLogger(ClientEJBCA_WS.class.getName()).log(Level.SEVERE, null, ex);
        }
        KeyStore ks = KeyStoreHelper.getKeyStore(result.getKeystoreData(),"PKCS12",password);
        ks.store(fos, password.toCharArray());
        try {
            fos.close();
            System.out.println("Keystore generated, written to " + filepath);
        } catch (IOException ex) {
            Logger.getLogger(ClientEJBCA_WS.class.getName()).log(Level.SEVERE, null, ex);
        }
    }

Where can I find KeyStoreHelper class ?

Thanks in advance for your help.

Best regards,

Liliana Cabalantti
Suivi de projets - Atos France
Big Data & Security Service Line
T. +33 (0)1 30 80 63 95
F. +33 (0)1 30 80 63 40
lil...@at...<mailto:lil...@at...>
Avenue Jean Jaurès - BP 68
78340 Les Clayes-sous-Bois
http://www.atos.net<http://www.atos.net/>
[cid:image001.png@01D0501B.F3583E10]

>>>>> Bull a rejoint le groupe Atos  <<<<<

Re: [Ejbca-develop] connect CA to another crypto token

[Branko M. <br...@ma...>]

On Mon, 16 Feb 2015 22:34:15 +0100
Michael Ströder <mi...@st...> wrote:

> I'm currently testing how to restore keys on another USB token (in this case
> Aventra myEID).
> 
> The problem is that if the layout/enumeration changes it may not be possible
> to use the old crypto token instance in EJBCA anymore.

Hm... One thing that can help you in case of slot order changing would
be using the slot label instead of slot number when creating a crypto
token.

This is something that was in particular introduced when we discovered
(the hard way) that nCipher HSM does not guarantee slot ordering,
and that it probably depends on order the HSM (encrypted) key material
is read from the disk.

Best regards

-- 
Branko Majic
Jabber: br...@ma...
Please use only Free formats when sending attachments to me.

Бранко Мајић
Џабер: br...@ma...
Молим вас да додатке шаљете искључиво у слободним форматима.

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Tomas G. <to...@pr...>]

I created this issue in Jira.

https://jira.primekey.se/browse/ECA-4104

On 2015-02-17 09:32, Michael Ströder wrote:
> Michael Ströder wrote:
>> Tomas Gustavsson wrote:
>>> To reproduce, what do you mean by changed/removed? You just pulled the
>>> smart card from the reader, or did you do something else?
>>
>> In case the token cannot be recovered in the same manner, e.g. hardware
>> damage, one is stuck. One cannot reach the Crypto Token UI anymore.
>>
>> Or there might be the case where you want to add a new token with the old keys
>> and some new keys but preserve the old Crypto Token configuration for some
>> time without having the old token plugged in.
>
> Ah yes. For simply reproducing the exception you can just pull the token.
> The UI frame for Crypto Tokens is not reachable anymore then.
>
> Ciao, Michael.
>
>>> On February 16, 2015 9:44:23 PM GMT+01:00, "Michael Ströder" <mi...@st...> wrote:
>>>> Branko Majic wrote:
>>>>> It's a more low-level issue with how the PKCS#11 security provider is
>>>>> implemented in Java.
>>>>>
>>>>> Basically, you have no way to tell the PKCS#11 Java security provider
>>>>> to reestablish a new session. There's also a bunch of cashing
>>>> happening
>>>>> there, so if you create keys etc outside of EJBCA's running JVM, you
>>>>> won't see them in EJBCA.
>>>>>
>>>>> Fixing this would require quite a bit more effort, unfortunately
>>>>> (implementing a custom Java security provider, and maintaining it).
>>>>
>>>> Even worse (with SVN revision 20683):
>>>> When a crypto token was changed/removed you won't be able to access the
>>>> "Crypto Tokens" UI in the adminweb anymore (see below) even after
>>>> restarting
>>>> JBOSS... :-(
>>>>
>>>> Ciao, Michael.
>>>>
>>>> 21:43:44,424 ERROR
>>>> [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/ejbca/adminweb].[Faces
>>>> Servlet]] (http--0.0.0.0-8443-1) Servlet.service() for servlet Faces
>>>> Servlet
>>>> threw exception: java.lang.RuntimeException: Attempted to find a slot
>>>> for a
>>>> PKCS#11 crypto token, but it did not exists. Perhaps the token was
>>>> removed?
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>> Get technology previously reserved for billion-dollar corporations, FREE
>> http://pubads.g.doubleclick.net/gampad/clk?id=190641631&iu=/4140/ostg.clktrk
>>
>>
>>
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>
>
> --
> Michael Ströder                 Klauprechtstr. 11
> Dipl.-Inform.                   D-76137 Karlsruhe, Germany
> Tel.: +49 721 8304316           Mobil: +49 170 2391920
> E-Mail: mi...@st...    http://www.stroeder.com
>

Re: [Ejbca-develop] connect CA to another crypto token

[Michael S. <mi...@st...>]

Tomas Gustavsson wrote:
> Do you mean you can not create a new crypto Token at all? In that case
> there is Probably something wrong with the new smart card.

I was stuck in the Crypto Token UI not reachable anymore (see my other mail).

> Or you just mean that there is no function in the gui to change crypto
> token of an existing CA?

Yes. It would be handy to have such a function when migrating keys to another
hardware token. You would have to check whether a key still matches the CA's
public key though.

Ciao, Michael.

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> Tomas Gustavsson wrote:
>> To reproduce, what do you mean by changed/removed? You just pulled the
>> smart card from the reader, or did you do something else?
> 
> In case the token cannot be recovered in the same manner, e.g. hardware
> damage, one is stuck. One cannot reach the Crypto Token UI anymore.
> 
> Or there might be the case where you want to add a new token with the old keys
> and some new keys but preserve the old Crypto Token configuration for some
> time without having the old token plugged in.

Ah yes. For simply reproducing the exception you can just pull the token.
The UI frame for Crypto Tokens is not reachable anymore then.

Ciao, Michael.

>> On February 16, 2015 9:44:23 PM GMT+01:00, "Michael Ströder" <mi...@st...> wrote:
>>> Branko Majic wrote:
>>>> It's a more low-level issue with how the PKCS#11 security provider is
>>>> implemented in Java.
>>>>
>>>> Basically, you have no way to tell the PKCS#11 Java security provider
>>>> to reestablish a new session. There's also a bunch of cashing
>>> happening
>>>> there, so if you create keys etc outside of EJBCA's running JVM, you
>>>> won't see them in EJBCA.
>>>>
>>>> Fixing this would require quite a bit more effort, unfortunately
>>>> (implementing a custom Java security provider, and maintaining it).
>>>
>>> Even worse (with SVN revision 20683):
>>> When a crypto token was changed/removed you won't be able to access the
>>> "Crypto Tokens" UI in the adminweb anymore (see below) even after
>>> restarting
>>> JBOSS... :-(
>>>
>>> Ciao, Michael.
>>>
>>> 21:43:44,424 ERROR
>>> [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/ejbca/adminweb].[Faces
>>> Servlet]] (http--0.0.0.0-8443-1) Servlet.service() for servlet Faces
>>> Servlet
>>> threw exception: java.lang.RuntimeException: Attempted to find a slot
>>> for a
>>> PKCS#11 crypto token, but it did not exists. Perhaps the token was
>>> removed?
> 
> 
> 
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=190641631&iu=/4140/ostg.clktrk
> 
> 
> 
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 


--
Michael Ströder                 Klauprechtstr. 11
Dipl.-Inform.                   D-76137 Karlsruhe, Germany
Tel.: +49 721 8304316           Mobil: +49 170 2391920
E-Mail: mi...@st...    http://www.stroeder.com

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Michael S. <mi...@st...>]

Tomas Gustavsson wrote:
> To reproduce, what do you mean by changed/removed? You just pulled the
> smart card from the reader, or did you do something else?

In case the token cannot be recovered in the same manner, e.g. hardware
damage, one is stuck. One cannot reach the Crypto Token UI anymore.

Or there might be the case where you want to add a new token with the old keys
and some new keys but preserve the old Crypto Token configuration for some
time without having the old token plugged in.

Ciao, Michael.

> On February 16, 2015 9:44:23 PM GMT+01:00, "Michael Ströder" <mi...@st...> wrote:
>> Branko Majic wrote:
>>> It's a more low-level issue with how the PKCS#11 security provider is
>>> implemented in Java.
>>>
>>> Basically, you have no way to tell the PKCS#11 Java security provider
>>> to reestablish a new session. There's also a bunch of cashing
>> happening
>>> there, so if you create keys etc outside of EJBCA's running JVM, you
>>> won't see them in EJBCA.
>>>
>>> Fixing this would require quite a bit more effort, unfortunately
>>> (implementing a custom Java security provider, and maintaining it).
>>
>> Even worse (with SVN revision 20683):
>> When a crypto token was changed/removed you won't be able to access the
>> "Crypto Tokens" UI in the adminweb anymore (see below) even after
>> restarting
>> JBOSS... :-(
>>
>> Ciao, Michael.
>>
>> 21:43:44,424 ERROR
>> [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/ejbca/adminweb].[Faces
>> Servlet]] (http--0.0.0.0-8443-1) Servlet.service() for servlet Faces
>> Servlet
>> threw exception: java.lang.RuntimeException: Attempted to find a slot
>> for a
>> PKCS#11 crypto token, but it did not exists. Perhaps the token was
>> removed?

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Tomas G. <to...@pr...>]

To reproduce, what do you mean by changed/removed? You just pulled the smart card from the reader, or did you do something else? 

Cheers, 
Tomas 

On February 16, 2015 9:44:23 PM GMT+01:00, "Michael Ströder" <mi...@st...> wrote:
>Branko Majic wrote:
>> It's a more low-level issue with how the PKCS#11 security provider is
>> implemented in Java.
>> 
>> Basically, you have no way to tell the PKCS#11 Java security provider
>> to reestablish a new session. There's also a bunch of cashing
>happening
>> there, so if you create keys etc outside of EJBCA's running JVM, you
>> won't see them in EJBCA.
>> 
>> Fixing this would require quite a bit more effort, unfortunately
>> (implementing a custom Java security provider, and maintaining it).
>
>Even worse (with SVN revision 20683):
>When a crypto token was changed/removed you won't be able to access the
>"Crypto Tokens" UI in the adminweb anymore (see below) even after
>restarting
>JBOSS... :-(
>
>Ciao, Michael.
>
>21:43:44,424 ERROR
>[org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/ejbca/adminweb].[Faces
>Servlet]] (http--0.0.0.0-8443-1) Servlet.service() for servlet Faces
>Servlet
>threw exception: java.lang.RuntimeException: Attempted to find a slot
>for a
>PKCS#11 crypto token, but it did not exists. Perhaps the token was
>removed?
>	at
>org.cesecore.keys.token.CryptoTokenSessionBean.getCryptoToken(CryptoTokenSessionBean.java:101)
>[cesecore-ejb.jar:]
>	at sun.reflect.GeneratedMethodAccessor158.invoke(Unknown Source)
>[:1.7.0_75]
>	at
>sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>[rt.jar:1.7.0_75]
>	at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_75]
>	at
>org.jboss.as.ee.component.ManagedReferenceMethodInterceptorFactory$ManagedReferenceMethodInterceptor.processInvocation(ManagedReferenceMethodInterceptorFactory.java:72)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.WeavedInterceptor.processInvocation(WeavedInterceptor.java:53)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.interceptors.UserInterceptorFactory$1.processInvocation(UserInterceptorFactory.java:36)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.jpa.interceptor.SBInvocationInterceptor.processInvocation(SBInvocationInterceptor.java:47)
>[jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.InitialInterceptor.processInvocation(InitialInterceptor.java:21)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.interceptors.ComponentDispatcherInterceptor.processInvocation(ComponentDispatcherInterceptor.java:53)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.component.pool.PooledInstanceInterceptor.processInvocation(PooledInstanceInterceptor.java:51)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.tx.CMTTxInterceptor.invokeInNoTx(CMTTxInterceptor.java:211)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.as.ejb3.tx.CMTTxInterceptor.supports(CMTTxInterceptor.java:363)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.as.ejb3.tx.CMTTxInterceptor.processInvocation(CMTTxInterceptor.java:194)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.component.interceptors.CurrentInvocationContextInterceptor.processInvocation(CurrentInvocationContextInterceptor.java:41)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:32)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:173)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:72)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.cesecore.keys.token.CryptoTokenSessionLocal$$$view25.getCryptoToken(Unknown
>Source)
>[cesecore-ejb-interface.jar:]
>	at
>org.cesecore.keys.token.CryptoTokenManagementSessionBean.getCryptoTokenInfo(CryptoTokenManagementSessionBean.java:125)
>[cesecore-ejb.jar:]
>	at
>org.cesecore.keys.token.CryptoTokenManagementSessionBean.getCryptoTokenInfos(CryptoTokenManagementSessionBean.java:117)
>[cesecore-ejb.jar:]
>	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>[rt.jar:1.7.0_75]
>	at
>sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
>[rt.jar:1.7.0_75]
>	at
>sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>[rt.jar:1.7.0_75]
>	at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_75]
>	at
>org.jboss.as.ee.component.ManagedReferenceMethodInterceptorFactory$ManagedReferenceMethodInterceptor.processInvocation(ManagedReferenceMethodInterceptorFactory.java:72)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.WeavedInterceptor.processInvocation(WeavedInterceptor.java:53)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.interceptors.UserInterceptorFactory$1.processInvocation(UserInterceptorFactory.java:36)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.jpa.interceptor.SBInvocationInterceptor.processInvocation(SBInvocationInterceptor.java:47)
>[jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.InitialInterceptor.processInvocation(InitialInterceptor.java:21)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.interceptors.ComponentDispatcherInterceptor.processInvocation(ComponentDispatcherInterceptor.java:53)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.component.pool.PooledInstanceInterceptor.processInvocation(PooledInstanceInterceptor.java:51)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.tx.CMTTxInterceptor.invokeInNoTx(CMTTxInterceptor.java:211)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.as.ejb3.tx.CMTTxInterceptor.supports(CMTTxInterceptor.java:363)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.as.ejb3.tx.CMTTxInterceptor.processInvocation(CMTTxInterceptor.java:194)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.component.interceptors.CurrentInvocationContextInterceptor.processInvocation(CurrentInvocationContextInterceptor.java:41)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:32)
>[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:173)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
>[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
>	at
>org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:72)
>[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.cesecore.keys.token.CryptoTokenManagementSessionLocal$$$view29.getCryptoTokenInfos(Unknown
>Source) [cesecore-ejb-interface.jar:]
>	at
>org.ejbca.ui.web.admin.cryptotoken.CryptoTokenMBean.getCryptoTokenGuiList(CryptoTokenMBean.java:310)
>[classes:]
>	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>[rt.jar:1.7.0_75]
>	at
>sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
>[rt.jar:1.7.0_75]
>	at
>sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>[rt.jar:1.7.0_75]
>	at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_75]
>	at javax.el.BeanELResolver.getValue(BeanELResolver.java:302)
>[jboss-el-api_2.2_spec-1.0.0.Final.jar:1.0.0.Final]
>	at
>com.sun.faces.el.DemuxCompositeELResolver._getValue(DemuxCompositeELResolver.java:173)
>[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at
>com.sun.faces.el.DemuxCompositeELResolver.getValue(DemuxCompositeELResolver.java:200)
>[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at org.apache.el.parser.AstValue.getValue(AstValue.java:169)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:189)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.jasper.el.JspValueExpression.getValue(JspValueExpression.java:101)
>[jbossweb-7.0.13.Final.jar:]
>	at javax.faces.component.UIData.getValue(UIData.java:614)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at javax.faces.component.UIData.getDataModel(UIData.java:1145)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at javax.faces.component.UIData.setRowIndex(UIData.java:451)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at
>com.sun.faces.renderkit.html_basic.TableRenderer.encodeBegin(TableRenderer.java:77)
>[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at
>javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:816)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at javax.faces.component.UIData.encodeBegin(UIData.java:983)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:928)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at javax.faces.render.Renderer.encodeChildren(Renderer.java:148)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at
>javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:840)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:930)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:933)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at
>com.sun.faces.application.ViewHandlerImpl.doRenderView(ViewHandlerImpl.java:266)
>[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at
>com.sun.faces.application.ViewHandlerImpl.renderView(ViewHandlerImpl.java:197)
>[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at
>com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:110)
>[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
>[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at
>com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:139)
>[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at javax.faces.webapp.FacesServlet.service(FacesServlet.java:266)
>[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
>	at
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.owasp.filters.ContentSecurityPolicyFilter.doFilter(ContentSecurityPolicyFilter.java:198)
>[ejbca-common-web.jar:EJBCA 6.3.1Alpha (working copy)]
>	at
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
>[jbossweb-7.0.13.Final.jar:]
>	at org.owasp.filters.ClickjackFilter.doFilter(ClickjackFilter.java:36)
>[ejbca-common-web.jar:EJBCA 6.3.1Alpha (working copy)]
>	at
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.myfaces.webapp.filter.ExtensionsFilter.doFilter(ExtensionsFilter.java:374)
>[tomahawk-1.1.14.jar:1.1.14]
>	at
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.ejbca.ui.web.admin.ProxiedAuthenticationFilter.doFilter(ProxiedAuthenticationFilter.java:109)
>[classes:]
>	at
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:397)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
>[jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153)
>[jboss-as-web-7.1.1.Final.jar:7.1.1.Final]
>	at
>org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671)
>[jbossweb-7.0.13.Final.jar:]
>	at
>org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930)
>[jbossweb-7.0.13.Final.jar:]
>	at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_75]
>
>
>
>
>------------------------------------------------------------------------
>
>------------------------------------------------------------------------------
>Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>from Actuate! Instantly Supercharge Your Business Reports and
>Dashboards
>with Interactivity, Sharing, Native Excel Exports, App Integration &
>more
>Get technology previously reserved for billion-dollar corporations,
>FREE
>http://pubads.g.doubleclick.net/gampad/clk?id=190641631&iu=/4140/ostg.clktrk
>
>------------------------------------------------------------------------
>
>_______________________________________________
>Ejbca-develop mailing list
>Ejb...@li...
>https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] connect CA to another crypto token

[Tomas G. <to...@pr...>]

Do you mean you can not create a new crypto Token at all? In that case there is Probably something wrong with the new smart card. 

Or you just mean that there is no function in the gui to change crypto token of an existing CA? 

Cheers, 
Tomas 

On February 16, 2015 10:34:15 PM GMT+01:00, "Michael Ströder" <mi...@st...> wrote:
>HI!
>
>I'm currently testing how to restore keys on another USB token (in this
>case
>Aventra myEID).
>
>The problem is that if the layout/enumeration changes it may not be
>possible
>to use the old crypto token instance in EJBCA anymore.
>
>But even when adding an USB token with the very same CA keys one cannot
>create
>a new crypto token and connect that to the existing CA. Which is very
>bad
>since all issued certs are tied to the CA.
>
>Any solution?
>
>Ciao, Michael.
>
>
>
>------------------------------------------------------------------------
>
>------------------------------------------------------------------------------
>Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>from Actuate! Instantly Supercharge Your Business Reports and
>Dashboards
>with Interactivity, Sharing, Native Excel Exports, App Integration &
>more
>Get technology previously reserved for billion-dollar corporations,
>FREE
>http://pubads.g.doubleclick.net/gampad/clk?id=190641631&iu=/4140/ostg.clktrk
>
>------------------------------------------------------------------------
>
>_______________________________________________
>Ejbca-develop mailing list
>Ejb...@li...
>https://lists.sourceforge.net/lists/listinfo/ejbca-develop

[Ejbca-develop] Smartcard-HSM und Schlüsselimport

[Michael S. <mi...@st...>]

Hallo Andreas,

vielen Dank für Deinen Hinweis. Ich habe durchaus auch mit Eurem USB-Token
getestet.

Aber aus Sicherheitsgründen bietet Euer Smartcard-HSM ja keinen Import mit
pkcs15-init. Obwohl mir Euer Backup-/Restore-Verfahren durchaus zusagt, bin
ich trotzdem bei langlebigen Schlüsseln sehr besorgt wg. des proprietären
Verfahrens und der sich darus ergebenden Abhängigkeit.
Daher kommt das Smartcard-HSM da nicht in Frage.

Ich glaube auch nicht, dass die EJBCA bald mit einem geschmeidigen JCE-Support
daherkommt. Nun ja, vielleicht schaffst Du es ja.

Und beim OpenSC-PKCS#11-Modul bin ich heute auch mit dem Aventra-EID auf einen
seg-fault gelaufen... :-(
Ja, ich weiss. Für den seg-fault im sc-hsm-Modul gibt's einen Patch. Und daher
benutze ich OpenSC aus dem git-repo...

Ciao, Michael.

Andreas Schwier wrote:
>>> But I wonder why EJBCA does not reconnect to the Smartcard-HSM once it was
>>> unavailable. I have to restart JBOSS to access the token via PKCS#11 module
>>> again.
>>>
>>> Ciao, Michael.
>>>
>>> [1]
>>> http://www.smartcard-hsm.com/2014/09/05/Accessing_your_SmartCard-HSM_from_EJBCA.html
>>>
>>
>> It's a more low-level issue with how the PKCS#11 security provider is
>> implemented in Java.
>>
>> Basically, you have no way to tell the PKCS#11 Java security provider
>> to reestablish a new session. There's also a bunch of cashing happening
>> there, so if you create keys etc outside of EJBCA's running JVM, you
>> won't see them in EJBCA.
>>
>> Fixing this would require quite a bit more effort, unfortunately
>> (implementing a custom Java security provider, and maintaining it).
> 
> We have a JCE Provider for the SmartCard-HSM. Unfortunately I'm no
> expert on the EJBCA source code and can't tell how it could be integrated.
> 
> But if someone wants to give it a try, let me know.
> 
> Andreas

--
Michael Ströder                 Klauprechtstr. 11
Dipl.-Inform.                   D-76137 Karlsruhe, Germany
Tel.: +49 721 8304316
E-Mail: mi...@st...    http://www.stroeder.com

[Ejbca-develop] connect CA to another crypto token

[Michael S. <mi...@st...>]

HI!

I'm currently testing how to restore keys on another USB token (in this case
Aventra myEID).

The problem is that if the layout/enumeration changes it may not be possible
to use the old crypto token instance in EJBCA anymore.

But even when adding an USB token with the very same CA keys one cannot create
a new crypto token and connect that to the existing CA. Which is very bad
since all issued certs are tied to the CA.

Any solution?

Ciao, Michael.

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Andreas S. <and...@ca...>]

>> But I wonder why EJBCA does not reconnect to the Smartcard-HSM once it was
>> unavailable. I have to restart JBOSS to access the token via PKCS#11 module
>> again.
>>
>> Ciao, Michael.
>>
>> [1]
>> http://www.smartcard-hsm.com/2014/09/05/Accessing_your_SmartCard-HSM_from_EJBCA.html
>>
> 
> It's a more low-level issue with how the PKCS#11 security provider is
> implemented in Java.
> 
> Basically, you have no way to tell the PKCS#11 Java security provider
> to reestablish a new session. There's also a bunch of cashing happening
> there, so if you create keys etc outside of EJBCA's running JVM, you
> won't see them in EJBCA.
> 
> Fixing this would require quite a bit more effort, unfortunately
> (implementing a custom Java security provider, and maintaining it).

We have a JCE Provider for the SmartCard-HSM. Unfortunately I'm no
expert on the EJBCA source code and can't tell how it could be integrated.

But if someone wants to give it a try, let me know.

Andreas


-- 

    ---------    CardContact Software & System Consulting
   |.##> <##.|   Andreas Schwier
   |#       #|   Schülerweg 38
   |#       #|   32429 Minden, Germany
   |'##> <##'|   Phone +49 571 56149
    ---------    http://www.cardcontact.de
                 http://www.tscons.de
                 http://www.openscdp.org
                 http://www.smartcard-hsm.com


-- 

    ---------    CardContact Software & System Consulting
   |.##> <##.|   Andreas Schwier
   |#       #|   Schülerweg 38
   |#       #|   32429 Minden, Germany
   |'##> <##'|   Phone +49 571 56149
    ---------    http://www.cardcontact.de
                 http://www.tscons.de
                 http://www.openscdp.org
                 http://www.smartcard-hsm.com

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> Branko Majic wrote:
>> It's a more low-level issue with how the PKCS#11 security provider is
>> implemented in Java.
>>
>> Basically, you have no way to tell the PKCS#11 Java security provider
>> to reestablish a new session. There's also a bunch of cashing happening
>> there, so if you create keys etc outside of EJBCA's running JVM, you
>> won't see them in EJBCA.
>>
>> Fixing this would require quite a bit more effort, unfortunately
>> (implementing a custom Java security provider, and maintaining it).
> 
> Even worse (with SVN revision 20683):
> When a crypto token was changed/removed you won't be able to access the
> "Crypto Tokens" UI in the adminweb anymore (see below) even after restarting
> JBOSS... :-(

And bin/ejbca.sh cryptotoken list also fails with same exception. Sigh...

Ciao, Michael.

> 21:43:44,424 ERROR
> [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/ejbca/adminweb].[Faces
> Servlet]] (http--0.0.0.0-8443-1) Servlet.service() for servlet Faces Servlet
> threw exception: java.lang.RuntimeException: Attempted to find a slot for a
> PKCS#11 crypto token, but it did not exists. Perhaps the token was removed?
> 	at
> org.cesecore.keys.token.CryptoTokenSessionBean.getCryptoToken(CryptoTokenSessionBean.java:101)
> [cesecore-ejb.jar:]
> 	at sun.reflect.GeneratedMethodAccessor158.invoke(Unknown Source) [:1.7.0_75]
> 	at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> [rt.jar:1.7.0_75]
> 	at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_75]
> 	at
> org.jboss.as.ee.component.ManagedReferenceMethodInterceptorFactory$ManagedReferenceMethodInterceptor.processInvocation(ManagedReferenceMethodInterceptorFactory.java:72)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.WeavedInterceptor.processInvocation(WeavedInterceptor.java:53)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.interceptors.UserInterceptorFactory$1.processInvocation(UserInterceptorFactory.java:36)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.jpa.interceptor.SBInvocationInterceptor.processInvocation(SBInvocationInterceptor.java:47)
> [jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.InitialInterceptor.processInvocation(InitialInterceptor.java:21)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.interceptors.ComponentDispatcherInterceptor.processInvocation(ComponentDispatcherInterceptor.java:53)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.component.pool.PooledInstanceInterceptor.processInvocation(PooledInstanceInterceptor.java:51)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.tx.CMTTxInterceptor.invokeInNoTx(CMTTxInterceptor.java:211)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at org.jboss.as.ejb3.tx.CMTTxInterceptor.supports(CMTTxInterceptor.java:363)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.as.ejb3.tx.CMTTxInterceptor.processInvocation(CMTTxInterceptor.java:194)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.component.interceptors.CurrentInvocationContextInterceptor.processInvocation(CurrentInvocationContextInterceptor.java:41)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:32)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:173)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:72)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.cesecore.keys.token.CryptoTokenSessionLocal$$$view25.getCryptoToken(Unknown Source)
> [cesecore-ejb-interface.jar:]
> 	at
> org.cesecore.keys.token.CryptoTokenManagementSessionBean.getCryptoTokenInfo(CryptoTokenManagementSessionBean.java:125)
> [cesecore-ejb.jar:]
> 	at
> org.cesecore.keys.token.CryptoTokenManagementSessionBean.getCryptoTokenInfos(CryptoTokenManagementSessionBean.java:117)
> [cesecore-ejb.jar:]
> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.7.0_75]
> 	at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
> [rt.jar:1.7.0_75]
> 	at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> [rt.jar:1.7.0_75]
> 	at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_75]
> 	at
> org.jboss.as.ee.component.ManagedReferenceMethodInterceptorFactory$ManagedReferenceMethodInterceptor.processInvocation(ManagedReferenceMethodInterceptorFactory.java:72)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.WeavedInterceptor.processInvocation(WeavedInterceptor.java:53)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.interceptors.UserInterceptorFactory$1.processInvocation(UserInterceptorFactory.java:36)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.jpa.interceptor.SBInvocationInterceptor.processInvocation(SBInvocationInterceptor.java:47)
> [jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.InitialInterceptor.processInvocation(InitialInterceptor.java:21)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.interceptors.ComponentDispatcherInterceptor.processInvocation(ComponentDispatcherInterceptor.java:53)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.component.pool.PooledInstanceInterceptor.processInvocation(PooledInstanceInterceptor.java:51)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.tx.CMTTxInterceptor.invokeInNoTx(CMTTxInterceptor.java:211)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at org.jboss.as.ejb3.tx.CMTTxInterceptor.supports(CMTTxInterceptor.java:363)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.as.ejb3.tx.CMTTxInterceptor.processInvocation(CMTTxInterceptor.java:194)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.component.interceptors.CurrentInvocationContextInterceptor.processInvocation(CurrentInvocationContextInterceptor.java:41)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:32)
> [jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:173)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
> [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
> 	at
> org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:72)
> [jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.cesecore.keys.token.CryptoTokenManagementSessionLocal$$$view29.getCryptoTokenInfos(Unknown
> Source) [cesecore-ejb-interface.jar:]
> 	at
> org.ejbca.ui.web.admin.cryptotoken.CryptoTokenMBean.getCryptoTokenGuiList(CryptoTokenMBean.java:310)
> [classes:]
> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.7.0_75]
> 	at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
> [rt.jar:1.7.0_75]
> 	at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> [rt.jar:1.7.0_75]
> 	at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_75]
> 	at javax.el.BeanELResolver.getValue(BeanELResolver.java:302)
> [jboss-el-api_2.2_spec-1.0.0.Final.jar:1.0.0.Final]
> 	at
> com.sun.faces.el.DemuxCompositeELResolver._getValue(DemuxCompositeELResolver.java:173)
> [jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at
> com.sun.faces.el.DemuxCompositeELResolver.getValue(DemuxCompositeELResolver.java:200)
> [jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at org.apache.el.parser.AstValue.getValue(AstValue.java:169)
> [jbossweb-7.0.13.Final.jar:]
> 	at org.apache.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:189)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.jasper.el.JspValueExpression.getValue(JspValueExpression.java:101)
> [jbossweb-7.0.13.Final.jar:]
> 	at javax.faces.component.UIData.getValue(UIData.java:614)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at javax.faces.component.UIData.getDataModel(UIData.java:1145)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at javax.faces.component.UIData.setRowIndex(UIData.java:451)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at
> com.sun.faces.renderkit.html_basic.TableRenderer.encodeBegin(TableRenderer.java:77)
> [jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at
> javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:816)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at javax.faces.component.UIData.encodeBegin(UIData.java:983)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:928)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at javax.faces.render.Renderer.encodeChildren(Renderer.java:148)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at
> javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:840)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:930)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:933)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at
> com.sun.faces.application.ViewHandlerImpl.doRenderView(ViewHandlerImpl.java:266)
> [jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at
> com.sun.faces.application.ViewHandlerImpl.renderView(ViewHandlerImpl.java:197)
> [jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at
> com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:110)
> [jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
> [jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:139)
> [jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at javax.faces.webapp.FacesServlet.service(FacesServlet.java:266)
> [jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.owasp.filters.ContentSecurityPolicyFilter.doFilter(ContentSecurityPolicyFilter.java:198)
> [ejbca-common-web.jar:EJBCA 6.3.1Alpha (working copy)]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
> [jbossweb-7.0.13.Final.jar:]
> 	at org.owasp.filters.ClickjackFilter.doFilter(ClickjackFilter.java:36)
> [ejbca-common-web.jar:EJBCA 6.3.1Alpha (working copy)]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.myfaces.webapp.filter.ExtensionsFilter.doFilter(ExtensionsFilter.java:374)
> [tomahawk-1.1.14.jar:1.1.14]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.ejbca.ui.web.admin.ProxiedAuthenticationFilter.doFilter(ProxiedAuthenticationFilter.java:109)
> [classes:]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:397)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
> [jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153)
> [jboss-as-web-7.1.1.Final.jar:7.1.1.Final]
> 	at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368)
> [jbossweb-7.0.13.Final.jar:]
> 	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877)
> [jbossweb-7.0.13.Final.jar:]
> 	at
> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671)
> [jbossweb-7.0.13.Final.jar:]
> 	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930)
> [jbossweb-7.0.13.Final.jar:]
> 	at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_75]
> 
> 


--
Michael Ströder                 Klauprechtstr. 11
Dipl.-Inform.                   D-76137 Karlsruhe, Germany
Tel.: +49 721 8304316           Mobil: +49 170 2391920
E-Mail: mi...@st...    http://www.stroeder.com

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Michael S. <mi...@st...>]

Branko Majic wrote:
> It's a more low-level issue with how the PKCS#11 security provider is
> implemented in Java.
> 
> Basically, you have no way to tell the PKCS#11 Java security provider
> to reestablish a new session. There's also a bunch of cashing happening
> there, so if you create keys etc outside of EJBCA's running JVM, you
> won't see them in EJBCA.
> 
> Fixing this would require quite a bit more effort, unfortunately
> (implementing a custom Java security provider, and maintaining it).

Even worse (with SVN revision 20683):
When a crypto token was changed/removed you won't be able to access the
"Crypto Tokens" UI in the adminweb anymore (see below) even after restarting
JBOSS... :-(

Ciao, Michael.

21:43:44,424 ERROR
[org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/ejbca/adminweb].[Faces
Servlet]] (http--0.0.0.0-8443-1) Servlet.service() for servlet Faces Servlet
threw exception: java.lang.RuntimeException: Attempted to find a slot for a
PKCS#11 crypto token, but it did not exists. Perhaps the token was removed?
	at
org.cesecore.keys.token.CryptoTokenSessionBean.getCryptoToken(CryptoTokenSessionBean.java:101)
[cesecore-ejb.jar:]
	at sun.reflect.GeneratedMethodAccessor158.invoke(Unknown Source) [:1.7.0_75]
	at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
[rt.jar:1.7.0_75]
	at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_75]
	at
org.jboss.as.ee.component.ManagedReferenceMethodInterceptorFactory$ManagedReferenceMethodInterceptor.processInvocation(ManagedReferenceMethodInterceptorFactory.java:72)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.WeavedInterceptor.processInvocation(WeavedInterceptor.java:53)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.interceptors.UserInterceptorFactory$1.processInvocation(UserInterceptorFactory.java:36)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.jpa.interceptor.SBInvocationInterceptor.processInvocation(SBInvocationInterceptor.java:47)
[jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.InitialInterceptor.processInvocation(InitialInterceptor.java:21)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.interceptors.ComponentDispatcherInterceptor.processInvocation(ComponentDispatcherInterceptor.java:53)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.component.pool.PooledInstanceInterceptor.processInvocation(PooledInstanceInterceptor.java:51)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.tx.CMTTxInterceptor.invokeInNoTx(CMTTxInterceptor.java:211)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at org.jboss.as.ejb3.tx.CMTTxInterceptor.supports(CMTTxInterceptor.java:363)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.as.ejb3.tx.CMTTxInterceptor.processInvocation(CMTTxInterceptor.java:194)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.component.interceptors.CurrentInvocationContextInterceptor.processInvocation(CurrentInvocationContextInterceptor.java:41)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:32)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:173)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:72)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.cesecore.keys.token.CryptoTokenSessionLocal$$$view25.getCryptoToken(Unknown Source)
[cesecore-ejb-interface.jar:]
	at
org.cesecore.keys.token.CryptoTokenManagementSessionBean.getCryptoTokenInfo(CryptoTokenManagementSessionBean.java:125)
[cesecore-ejb.jar:]
	at
org.cesecore.keys.token.CryptoTokenManagementSessionBean.getCryptoTokenInfos(CryptoTokenManagementSessionBean.java:117)
[cesecore-ejb.jar:]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.7.0_75]
	at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
[rt.jar:1.7.0_75]
	at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
[rt.jar:1.7.0_75]
	at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_75]
	at
org.jboss.as.ee.component.ManagedReferenceMethodInterceptorFactory$ManagedReferenceMethodInterceptor.processInvocation(ManagedReferenceMethodInterceptorFactory.java:72)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.WeavedInterceptor.processInvocation(WeavedInterceptor.java:53)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.interceptors.UserInterceptorFactory$1.processInvocation(UserInterceptorFactory.java:36)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.jpa.interceptor.SBInvocationInterceptor.processInvocation(SBInvocationInterceptor.java:47)
[jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.InitialInterceptor.processInvocation(InitialInterceptor.java:21)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.interceptors.ComponentDispatcherInterceptor.processInvocation(ComponentDispatcherInterceptor.java:53)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.component.pool.PooledInstanceInterceptor.processInvocation(PooledInstanceInterceptor.java:51)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.tx.CMTTxInterceptor.invokeInNoTx(CMTTxInterceptor.java:211)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at org.jboss.as.ejb3.tx.CMTTxInterceptor.supports(CMTTxInterceptor.java:363)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.as.ejb3.tx.CMTTxInterceptor.processInvocation(CMTTxInterceptor.java:194)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.component.interceptors.CurrentInvocationContextInterceptor.processInvocation(CurrentInvocationContextInterceptor.java:41)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:32)
[jboss-as-ejb3-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:173)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:1.1.1.Final]
	at
org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:72)
[jboss-as-ee-7.1.1.Final.jar:7.1.1.Final]
	at
org.cesecore.keys.token.CryptoTokenManagementSessionLocal$$$view29.getCryptoTokenInfos(Unknown
Source) [cesecore-ejb-interface.jar:]
	at
org.ejbca.ui.web.admin.cryptotoken.CryptoTokenMBean.getCryptoTokenGuiList(CryptoTokenMBean.java:310)
[classes:]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.7.0_75]
	at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
[rt.jar:1.7.0_75]
	at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
[rt.jar:1.7.0_75]
	at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_75]
	at javax.el.BeanELResolver.getValue(BeanELResolver.java:302)
[jboss-el-api_2.2_spec-1.0.0.Final.jar:1.0.0.Final]
	at
com.sun.faces.el.DemuxCompositeELResolver._getValue(DemuxCompositeELResolver.java:173)
[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at
com.sun.faces.el.DemuxCompositeELResolver.getValue(DemuxCompositeELResolver.java:200)
[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at org.apache.el.parser.AstValue.getValue(AstValue.java:169)
[jbossweb-7.0.13.Final.jar:]
	at org.apache.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:189)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.jasper.el.JspValueExpression.getValue(JspValueExpression.java:101)
[jbossweb-7.0.13.Final.jar:]
	at javax.faces.component.UIData.getValue(UIData.java:614)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at javax.faces.component.UIData.getDataModel(UIData.java:1145)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at javax.faces.component.UIData.setRowIndex(UIData.java:451)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at
com.sun.faces.renderkit.html_basic.TableRenderer.encodeBegin(TableRenderer.java:77)
[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at
javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:816)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at javax.faces.component.UIData.encodeBegin(UIData.java:983)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:928)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at javax.faces.render.Renderer.encodeChildren(Renderer.java:148)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at
javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:840)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:930)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at javax.faces.component.UIComponent.encodeAll(UIComponent.java:933)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at
com.sun.faces.application.ViewHandlerImpl.doRenderView(ViewHandlerImpl.java:266)
[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at
com.sun.faces.application.ViewHandlerImpl.renderView(ViewHandlerImpl.java:197)
[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at
com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:110)
[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:139)
[jsf-impl-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at javax.faces.webapp.FacesServlet.service(FacesServlet.java:266)
[jsf-api-1.2_15-jbossorg-2.jar:1.2_15.jbossorg-1-20111019-SNAPSHOT]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
[jbossweb-7.0.13.Final.jar:]
	at
org.owasp.filters.ContentSecurityPolicyFilter.doFilter(ContentSecurityPolicyFilter.java:198)
[ejbca-common-web.jar:EJBCA 6.3.1Alpha (working copy)]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
[jbossweb-7.0.13.Final.jar:]
	at org.owasp.filters.ClickjackFilter.doFilter(ClickjackFilter.java:36)
[ejbca-common-web.jar:EJBCA 6.3.1Alpha (working copy)]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.myfaces.webapp.filter.ExtensionsFilter.doFilter(ExtensionsFilter.java:374)
[tomahawk-1.1.14.jar:1.1.14]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
[jbossweb-7.0.13.Final.jar:]
	at
org.ejbca.ui.web.admin.ProxiedAuthenticationFilter.doFilter(ProxiedAuthenticationFilter.java:109)
[classes:]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:397)
[jbossweb-7.0.13.Final.jar:]
	at
org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
[jboss-as-jpa-7.1.1.Final.jar:7.1.1.Final]
	at
org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153)
[jboss-as-web-7.1.1.Final.jar:7.1.1.Final]
	at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368)
[jbossweb-7.0.13.Final.jar:]
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877)
[jbossweb-7.0.13.Final.jar:]
	at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671)
[jbossweb-7.0.13.Final.jar:]
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930)
[jbossweb-7.0.13.Final.jar:]
	at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_75]

Re: [Ejbca-develop] Invalid DN chars

[Michael S. <mi...@st...>]

Michael =?UTF-8?B?U3Ryw7ZkZXI=?= wrote:
> Tomas Gustavsson <to...@pr...> wrote
>> It's just some legacy input validation for usability.
> 
> Something related to special XML / HTML character entities? ;-]
> 
>> One at a time 
>> every character has been needed to be allowed, but not & so far 
>> (assuming you are using the latest version) :)
> 
> "&" is very common in legal company names.
> 
> Example: Foo GmbH & Co. KG
> 
> And how about the "#"?

Using latest and greatest I'm still getting:

"Only characters, numbers, underscores, minus and whitespace are allowed in
field Subject DN"

In this case I was generating a sub-CA CSR for an external CA.

Ciao, Michael.

[Ejbca-develop] Peer Systems in EJBCA Enterprise 6.3 - introduction and tutorial

[Tomas G. <to...@pr...>]

In EJBCA Enterprise 6.3 there is a new exciting feature, Peer Systems. 
You can read about it in the EJBCA Blog.
http://blog.ejbca.org/

Cheers,
Tomas

Re: [Ejbca-develop] Migration of ejbca GUI implementation

[Tomas G. <to...@pr...>]

I'm not sure it is designed to be used for anything actually.

/T

On 2015-02-02 14:10, Andreas Kuehne wrote:
> Hi Tomas,
>
> great, I'll do my very best ;-)
>
> What about the timestamp in the zip entry name? Is it intended to do
> same sanity checks? Like 'import newer profiles only' ?
>
> Greetings,
>
> Andrreas
>> Hi,
>>
>> I think a patch would be accepted. Especially if accompanied by an
>> updated JUnit test.
>>
>>
>> Cheers,
>> Tomas
>>
>> On 2015-01-30 14:15, Andreas Kuehne wrote:
>>> Hi folks,
>>>
>>> a question again regarding the 'profile upload' functionality:
>>>
>>> The zip of profiles includes a timestamp (I guess). So I assumed glibly
>>> that I am able to update a profile to a newer version. But as I must
>>> learn from the code the 'profile upload' creates a new profile, but did
>>> _not_ update an existing profile!
>>>
>>> Did you leave out the update on purpose? Or would you accept a patch to
>>> enable updating?
>>>
>>> Greetings,
>>>
>>> Andreas
>>>> Hi,
>>>>
>>>> How are you remote controling the GUI? Sounds cool.
>>>>
>>>> We'll introduce new features as the business cases and needs arise. No
>>>> immediate plans for other upload functionality.
>>>>
>>>> In Enterprise edition there is a separate tool for dumping and importing
>>>> a whole installation (except keys) for easily moving from say acceptance
>>>> environment to production.
>>>>
>>>> Cheers,
>>>> Tomas
>>>>
>>>> On 2014-11-17 15:56, Andreas Kuehne wrote:
>>>>> Hi folks,
>>>>>
>>>>> as I can see in the recent version of ejbca you are using a new style of
>>>>> GUI implementation. This new approach makes it a bit harder for me to
>>>>> 'remote control' the GUI. But I'm happy to see that you introduced a
>>>>> 'bulk upload' of certificate profiles. That's very handy! Do you plan to
>>>>> introduce such an upload functionality for the other administration
>>>>> aspects, too?
>>>>>
>>>>> Greetings,
>>>>>
>>>>> Andreas
>>>>>
>>>> ------------------------------------------------------------------------------
>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>>>> Get technology previously reserved for billion-dollar corporations, FREE
>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>>>> _______________________________________________
>>>> Ejbca-develop mailing list
>>>> Ejb...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>>>
>>>
>> ------------------------------------------------------------------------------
>> Dive into the World of Parallel Programming. The Go Parallel Website,
>> sponsored by Intel and developed in partnership with Slashdot Media, is your
>> hub for all things parallel software development, from weekly thought
>> leadership blogs to news, videos, case studies, tutorials and more. Take a
>> look and join the conversation now. http://goparallel.sourceforge.net/
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>
>

Re: [Ejbca-develop] Migration of ejbca GUI implementation

[Andreas K. <ku...@tr...>]

Hi Tomas,

great, I'll do my very best ;-)

What about the timestamp in the zip entry name? Is it intended to do
same sanity checks? Like 'import newer profiles only' ?

Greetings,

Andrreas
> Hi,
>
> I think a patch would be accepted. Especially if accompanied by an 
> updated JUnit test.
>
>
> Cheers,
> Tomas
>
> On 2015-01-30 14:15, Andreas Kuehne wrote:
>> Hi folks,
>>
>> a question again regarding the 'profile upload' functionality:
>>
>> The zip of profiles includes a timestamp (I guess). So I assumed glibly
>> that I am able to update a profile to a newer version. But as I must
>> learn from the code the 'profile upload' creates a new profile, but did
>> _not_ update an existing profile!
>>
>> Did you leave out the update on purpose? Or would you accept a patch to
>> enable updating?
>>
>> Greetings,
>>
>> Andreas
>>> Hi,
>>>
>>> How are you remote controling the GUI? Sounds cool.
>>>
>>> We'll introduce new features as the business cases and needs arise. No
>>> immediate plans for other upload functionality.
>>>
>>> In Enterprise edition there is a separate tool for dumping and importing
>>> a whole installation (except keys) for easily moving from say acceptance
>>> environment to production.
>>>
>>> Cheers,
>>> Tomas
>>>
>>> On 2014-11-17 15:56, Andreas Kuehne wrote:
>>>> Hi folks,
>>>>
>>>> as I can see in the recent version of ejbca you are using a new style of
>>>> GUI implementation. This new approach makes it a bit harder for me to
>>>> 'remote control' the GUI. But I'm happy to see that you introduced a
>>>> 'bulk upload' of certificate profiles. That's very handy! Do you plan to
>>>> introduce such an upload functionality for the other administration
>>>> aspects, too?
>>>>
>>>> Greetings,
>>>>
>>>> Andreas
>>>>
>>> ------------------------------------------------------------------------------
>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>>> Get technology previously reserved for billion-dollar corporations, FREE
>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> Ejbca-develop mailing list
>>> Ejb...@li...
>>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>>
>>
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>


-- 
Andreas Kühne 
phone: +49 177 293 24 97 
mailto: ku...@tr...

Trustable Ltd. Niederlassung Deutschland Ströverstr. 18 - 59427 Unna Amtsgericht Hamm HRB 5868

Directors Andreas Kühne, Heiko Veit

Company UK Company No: 5218868 Registered in England and Wales 

Re: [Ejbca-develop] Migration of ejbca GUI implementation

[Tomas G. <to...@pr...>]

Hi,

I think a patch would be accepted. Especially if accompanied by an 
updated JUnit test.


Cheers,
Tomas

On 2015-01-30 14:15, Andreas Kuehne wrote:
> Hi folks,
>
> a question again regarding the 'profile upload' functionality:
>
> The zip of profiles includes a timestamp (I guess). So I assumed glibly
> that I am able to update a profile to a newer version. But as I must
> learn from the code the 'profile upload' creates a new profile, but did
> _not_ update an existing profile!
>
> Did you leave out the update on purpose? Or would you accept a patch to
> enable updating?
>
> Greetings,
>
> Andreas
>> Hi,
>>
>> How are you remote controling the GUI? Sounds cool.
>>
>> We'll introduce new features as the business cases and needs arise. No
>> immediate plans for other upload functionality.
>>
>> In Enterprise edition there is a separate tool for dumping and importing
>> a whole installation (except keys) for easily moving from say acceptance
>> environment to production.
>>
>> Cheers,
>> Tomas
>>
>> On 2014-11-17 15:56, Andreas Kuehne wrote:
>>> Hi folks,
>>>
>>> as I can see in the recent version of ejbca you are using a new style of
>>> GUI implementation. This new approach makes it a bit harder for me to
>>> 'remote control' the GUI. But I'm happy to see that you introduced a
>>> 'bulk upload' of certificate profiles. That's very handy! Do you plan to
>>> introduce such an upload functionality for the other administration
>>> aspects, too?
>>>
>>> Greetings,
>>>
>>> Andreas
>>>
>> ------------------------------------------------------------------------------
>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>> Get technology previously reserved for billion-dollar corporations, FREE
>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>
>

Re: [Ejbca-develop] Migration of ejbca GUI implementation

[Andreas K. <ku...@tr...>]

Hi folks,

a question again regarding the 'profile upload' functionality:

The zip of profiles includes a timestamp (I guess). So I assumed glibly
that I am able to update a profile to a newer version. But as I must
learn from the code the 'profile upload' creates a new profile, but did
_not_ update an existing profile!

Did you leave out the update on purpose? Or would you accept a patch to
enable updating?

Greetings,

Andreas
> Hi,
>
> How are you remote controling the GUI? Sounds cool.
>
> We'll introduce new features as the business cases and needs arise. No 
> immediate plans for other upload functionality.
>
> In Enterprise edition there is a separate tool for dumping and importing 
> a whole installation (except keys) for easily moving from say acceptance 
> environment to production.
>
> Cheers,
> Tomas
>
> On 2014-11-17 15:56, Andreas Kuehne wrote:
>> Hi folks,
>>
>> as I can see in the recent version of ejbca you are using a new style of
>> GUI implementation. This new approach makes it a bit harder for me to
>> 'remote control' the GUI. But I'm happy to see that you introduced a
>> 'bulk upload' of certificate profiles. That's very handy! Do you plan to
>> introduce such an upload functionality for the other administration
>> aspects, too?
>>
>> Greetings,
>>
>> Andreas
>>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>


-- 
Andreas Kühne 
phone: +49 177 293 24 97 
mailto: ku...@tr...

Trustable Ltd. Niederlassung Deutschland Ströverstr. 18 - 59427 Unna Amtsgericht Hamm HRB 5868

Directors Andreas Kühne, Heiko Veit

Company UK Company No: 5218868 Registered in England and Wales 

Re: [Ejbca-develop] debug log ejbca.sh

[Michael S. <mi...@st...>]

Tomas,

this issue is still driving me crazy... :-[

ejbca.sh ca listcas takes nearly a minute on different systems.

Tomas Gustavsson wrote:
> On 2014-12-03 17:55, Michael Ströder wrote:
>> Tomas Gustavsson <to...@pr...> wrote
>>> Enable trace logging
>>
>> How?
>>
>> For ejbca.sh I'm looking here:
>> /dist/ejbca-ejb-cli/log4j.xml
>> /src/java/log4j.properties
>>
>> Are those the right files to tweak ejbca.sh console output?
> 
> Yes that should be it.
> 
> I was actually thinking about the server log as well, so you can see if there
> is anything on the server side that is slow. But the client is good first of
> course.

Could you please suggest a content of the files above writing out nearly
everything?

Ciao, Michael.

Re: [Ejbca-develop] R: MultiRDN Distinguished Name String to X500Name conversion

[Tomas G. <to...@pr...>]

Hi, thanks a lot.

I added your stuff to this issue for tracking.
https://jira.primekey.se/browse/ECA-3934

Cheers,
Tomas
*********
PrimeKey Solutions AB
Anderstorpsvägen 16, 171 54 Solna, Sweden
Mob: +46 (0)707421096
Internet: www.primekey.se
Twitter: twitter.com/primekeyPKI
**********

On 2014-12-22 13:15, fra...@in... wrote:
> Yes, EJBCA 6.2.0.
>
> Francesco Petruzzi
> Innovery S.p.A.
> fra...@in...
>
>
> -----Messaggio originale-----
> Da: Tomas Gustavsson [mailto:to...@pr...]
> Inviato: lunedì 22 dicembre 2014 11:24
> A: ejb...@li...
> Oggetto: Re: [Ejbca-develop] MultiRDN Distinguished Name String to X500Name
> conversion
>
> Hi,
>
> Thanks, which version of EJBCA did you make the patch against? 6.2.0?
>
> Regards,
> Tomas
>
> On 2014-12-22 10:10, fra...@in... wrote:
>> Hi all,
>>
>> I did modification to string to X500Name conversion for DN creation.
>> My patch rewrite stringToBcX500Name and supports MultiRDN features in
>> order to complains National rules in DN generation.
>> It can generate DN using + syntax for MultiRDN and maintains ordering
>> features. Additional + chars in DN names can be written using the
>> standard \+ syntax. Current ordering feature take account for the
>> first attribute in MultiRDN attribute.
>> MultiRDN content respects RFC ASN1 SET ordering rules.
>> Attached a modified version of CertTools.java for MultiRDN.
>>
>> For example
>> "DN=200590 + givenName=Enrico Maria + serialNumber=IT:MEZCAL86T16H523D
>> + surname=Ciaffi,O=Test1,C=IT,O=Test
>>
>> Results in
>> "SURNAME=Ciaffi+DN=200590+GIVENNAME=Enrico
>> Maria+SN=IT:MEZCAL86T16H523D,O=Test1,O=Test,C=IT"
>>
>>      0 30  125: SEQUENCE {
>>      2 31   11:   SET {
>>      4 30    9:     SEQUENCE {
>>      6 06    3:       OBJECT IDENTIFIER countryName (2 5 4 6)
>>     11 13    2:       PrintableString 'IT'
>>               :       }
>>               :     }
>>     15 31   13:   SET {
>>     17 30   11:     SEQUENCE {
>>     19 06    3:       OBJECT IDENTIFIER organizationName (2 5 4 10)
>>     24 0C    4:       UTF8String 'Test'
>>               :       }
>>               :     }
>>     30 31   14:   SET {
>>     32 30   12:     SEQUENCE {
>>     34 06    3:       OBJECT IDENTIFIER organizationName (2 5 4 10)
>>     39 0C    5:       UTF8String 'Test1'
>>               :       }
>>               :     }
>>     46 31   79:   SET {
>>     48 30   13:     SEQUENCE {
>>     50 06    3:       OBJECT IDENTIFIER surname (2 5 4 4)
>>     55 0C    6:       UTF8String 'Ciaffi'
>>               :       }
>>     63 30   13:     SEQUENCE {
>>     65 06    3:       OBJECT IDENTIFIER dnQualifier (2 5 4 46)
>>     70 13    6:       PrintableString '200590'
>>               :       }
>>     78 30   19:     SEQUENCE {
>>     80 06    3:       OBJECT IDENTIFIER givenName (2 5 4 42)
>>     85 0C   12:       UTF8String 'Enrico Maria'
>>               :       }
>>     99 30   26:     SEQUENCE {
>>    101 06    3:       OBJECT IDENTIFIER serialNumber (2 5 4 5)
>>    106 13   19:       PrintableString 'IT:MEZCAL86T16H523D'
>>               :       }
>>               :     }
>>               :   }
>>
>> I hope this contribution can be added to EjbCA for missing MultiRDN
> feature.
>> I test this patch in Italian Qualified Certification Authorities and
>> CNS certificate generation.
>>
>> Regards,
>>
>> Francesco Petruzzi
>> Innovery S.p.A.
>> fra...@in...
>>
>>
>> ---
>> Questa e-mail è stata controllata per individuare virus con Avast
> antivirus.
>> http://www.avast.com
>>
>>
>>
>> ----------------------------------------------------------------------
>> -------- Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT
>> Server from Actuate! Instantly Supercharge Your Business Reports and
>> Dashboards with Interactivity, Sharing, Native Excel Exports, App
>> Integration & more Get technology previously reserved for
>> billion-dollar corporations, FREE
>> http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.
>> clktrk
>>
>>
>>
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>
> ----------------------------------------------------------------------------
> --
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server from
> Actuate! Instantly Supercharge Your Business Reports and Dashboards with
> Interactivity, Sharing, Native Excel Exports, App Integration & more Get
> technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>
> ---
> Questa e-mail è stata controllata per individuare virus con Avast antivirus.
> http://www.avast.com
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] CRL status is: Expired

[Тимур <tim...@gm...>]

Hello, dears.

Could you please to prompt about clientToolBox.sh (healthCheckTest) on
EJBCA 3.11.0 ?
Before first run I have modified its properties file then run one but I see
it cannot connect to EJBCA:
error.log: "Unable to find valid certification path to requested target"
Here is my ejbcawsracli.properties:

jboss@rootca:/ejbca/ejbca_3_11_0/dist/clientToolBox$ cat
ejbcawsracli.properties | grep -v "#"
ejbcawsracli.url = https://rootca.teka.kz:8443/ejbca/ejbcaws/ejbcaws
ejbcawsracli.keystore.path = /ejbca/ejbca_3_11_0/p12/superadmin.p12
ejbcawsracli.keystore.password = tt76333key80890
ejbcawsracli.truststore.path=/ejbca/
jboss-5.0.1.GA/server/default/conf/keystore/truststore.jks

Where I'm wrong ?

thank you, Timur.

2014-12-18 19:10 GMT+06:00 Michael Ströder <mi...@st...>:

> Тимур wrote:
> > I have successfully installed and configured EJBCA 6.2.0 (r19221) based
> on
> > RHEL 5.7 / Java 7u45 / Oracle 10g R2 and all works fine, no errors.
> > Then two new users' CAs named "testca.bta.kz" and "Default CA" were
> created
> > (also without  errors) - all work fine.  Only question is why in
> > certificate authorities home page some CAs have their CRL status marked
> by
> > yellow warning triangle "CRL status: Expired" ?  How to fix CRL  ?
> > Could you please to see attached screenshots and config of my EJBCA
> > instance ?
>
> You probably did not set up a CRLUpdate service for those CAs yet.
>
> Ciao, Michael.
>
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>

[Ejbca-develop] R: MultiRDN Distinguished Name String to X500Name conversion

[<fra...@in...>]

Yes, EJBCA 6.2.0.

Francesco Petruzzi
Innovery S.p.A.
fra...@in...


-----Messaggio originale-----
Da: Tomas Gustavsson [mailto:to...@pr...] 
Inviato: lunedì 22 dicembre 2014 11:24
A: ejb...@li...
Oggetto: Re: [Ejbca-develop] MultiRDN Distinguished Name String to X500Name
conversion

Hi,

Thanks, which version of EJBCA did you make the patch against? 6.2.0?

Regards,
Tomas

On 2014-12-22 10:10, fra...@in... wrote:
> Hi all,
>
> I did modification to string to X500Name conversion for DN creation.
> My patch rewrite stringToBcX500Name and supports MultiRDN features in 
> order to complains National rules in DN generation.
> It can generate DN using + syntax for MultiRDN and maintains ordering 
> features. Additional + chars in DN names can be written using the 
> standard \+ syntax. Current ordering feature take account for the 
> first attribute in MultiRDN attribute.
> MultiRDN content respects RFC ASN1 SET ordering rules.
> Attached a modified version of CertTools.java for MultiRDN.
>
> For example
> "DN=200590 + givenName=Enrico Maria + serialNumber=IT:MEZCAL86T16H523D 
> + surname=Ciaffi,O=Test1,C=IT,O=Test
>
> Results in
> "SURNAME=Ciaffi+DN=200590+GIVENNAME=Enrico
> Maria+SN=IT:MEZCAL86T16H523D,O=Test1,O=Test,C=IT"
>
>     0 30  125: SEQUENCE {
>     2 31   11:   SET {
>     4 30    9:     SEQUENCE {
>     6 06    3:       OBJECT IDENTIFIER countryName (2 5 4 6)
>    11 13    2:       PrintableString 'IT'
>              :       }
>              :     }
>    15 31   13:   SET {
>    17 30   11:     SEQUENCE {
>    19 06    3:       OBJECT IDENTIFIER organizationName (2 5 4 10)
>    24 0C    4:       UTF8String 'Test'
>              :       }
>              :     }
>    30 31   14:   SET {
>    32 30   12:     SEQUENCE {
>    34 06    3:       OBJECT IDENTIFIER organizationName (2 5 4 10)
>    39 0C    5:       UTF8String 'Test1'
>              :       }
>              :     }
>    46 31   79:   SET {
>    48 30   13:     SEQUENCE {
>    50 06    3:       OBJECT IDENTIFIER surname (2 5 4 4)
>    55 0C    6:       UTF8String 'Ciaffi'
>              :       }
>    63 30   13:     SEQUENCE {
>    65 06    3:       OBJECT IDENTIFIER dnQualifier (2 5 4 46)
>    70 13    6:       PrintableString '200590'
>              :       }
>    78 30   19:     SEQUENCE {
>    80 06    3:       OBJECT IDENTIFIER givenName (2 5 4 42)
>    85 0C   12:       UTF8String 'Enrico Maria'
>              :       }
>    99 30   26:     SEQUENCE {
>   101 06    3:       OBJECT IDENTIFIER serialNumber (2 5 4 5)
>   106 13   19:       PrintableString 'IT:MEZCAL86T16H523D'
>              :       }
>              :     }
>              :   }
>
> I hope this contribution can be added to EjbCA for missing MultiRDN
feature.
> I test this patch in Italian Qualified Certification Authorities and 
> CNS certificate generation.
>
> Regards,
>
> Francesco Petruzzi
> Innovery S.p.A.
> fra...@in...
>
>
> ---
> Questa e-mail è stata controllata per individuare virus con Avast
antivirus.
> http://www.avast.com
>
>
>
> ----------------------------------------------------------------------
> -------- Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT 
> Server from Actuate! Instantly Supercharge Your Business Reports and 
> Dashboards with Interactivity, Sharing, Native Excel Exports, App 
> Integration & more Get technology previously reserved for 
> billion-dollar corporations, FREE 
> http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.
> clktrk
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

----------------------------------------------------------------------------
--
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server from
Actuate! Instantly Supercharge Your Business Reports and Dashboards with
Interactivity, Sharing, Native Excel Exports, App Integration & more Get
technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk
_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop


---
Questa e-mail è stata controllata per individuare virus con Avast antivirus.
http://www.avast.com