ejbca-develop — Development discussions

Re: [Ejbca-develop] I need to modify httpserver.hostname after ejbca installation

[Liliana C. <lil...@bu...>]

Thanks for your response Tomas. 

Liliana Cabalantti 
Bull, Architect of an Open WorldT 
BSS/TrustWay 
Tél : +33 1 30 80 63 95 
Fax : +33 1 30 80 63 40 
lil...@bu...



-----Message d'origine-----
De : Tomas Gustavsson [mailto:to...@pr...] 
Envoyé : lundi 3 novembre 2014 15:04
À : ejb...@li...
Objet : Re: [Ejbca-develop] I need to modify httpserver.hostname after ejbca installation


Hi, yes hostname can be changed. Issued TLS certificates needs to be updated/renewed when hostnames change in order to not have browser warnings.

Regards,
Tomas
**********
PrimeKey Solutions AB
Anderstorpsvägen 16, 171 54 Solna, Sweden
Mob: +46 (0)707421096
Internet: www.primekey.se
Twitter: twitter.com/primekeyPKI
**********

On 2014-11-03 09:57, Liliana Cabalantti wrote:
> Hello,
>
> I'm working with ejbca_ce_6_0_3 and jboss-as-7.1.1.Final.
>
> I'm setting up a PKI in a HSM appliance using 
> httpserver.hostname=localhost. Once the PKI will be operational, the 
> appliance will be integrated to a network. I'd like to know if 
> httpserver.hostname can be modified so that the CAs, RAs already 
> generated are still available.
>
> Thanks for your help.
>
> Best regards,
>
> Liliana Cabalantti
>
> Bull, Architect of an Open WorldT
>
> BSS/TrustWay
>
> Tél : +33 1 30 80 63 95
>
> Fax : +33 1 30 80 63 40
>
> lil...@bu... <mailto:lil...@bu...>
>
> BULL_logo
>
>
>
> ----------------------------------------------------------------------
> --------
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

------------------------------------------------------------------------------
_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] I need to modify httpserver.hostname after ejbca installation

[Tomas G. <to...@pr...>]

Hi, yes hostname can be changed. Issued TLS certificates needs to be 
updated/renewed when hostnames change in order to not have browser warnings.

Regards,
Tomas
**********
PrimeKey Solutions AB
Anderstorpsvägen 16, 171 54 Solna, Sweden
Mob: +46 (0)707421096
Internet: www.primekey.se
Twitter: twitter.com/primekeyPKI
**********

On 2014-11-03 09:57, Liliana Cabalantti wrote:
> Hello,
>
> I’m working with ejbca_ce_6_0_3 and jboss-as-7.1.1.Final.
>
> I’m setting up a PKI in a HSM appliance using
> httpserver.hostname=localhost. Once the PKI will be operational, the
> appliance will be
> integrated to a network. I’d like to know if httpserver.hostname can be
> modified so that the CAs, RAs already generated are still available.
>
> Thanks for your help.
>
> Best regards,
>
> Liliana Cabalantti
>
> Bull, Architect of an Open World™
>
> BSS/TrustWay
>
> Tél : +33 1 30 80 63 95
>
> Fax : +33 1 30 80 63 40
>
> lil...@bu... <mailto:lil...@bu...>
>
> BULL_logo
>
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] Failed Registering mariadb module on Jboss EAP 6.2.0

[Tomas G. <to...@pr...>]

This one seems to works for me with module.xml in:
jboss-eap-6.2/modules/system/layers/base/org/mariadb/main

<?xml version="1.0" encoding="UTF-8"?>
<module xmlns="urn:jboss:module:1.0" name="org.mariadb">
   <resources>
     <resource-root path="mariadb-java-client-1.1.5.jar"/>
   </resources>
   <dependencies>
     <module name="javax.api"/>
     <module name="javax.transaction.api"/>
   </dependencies>
</module>

/subsystem=datasources/jdbc-driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)


You need to analyze your server.lgo to see why JBoss does not like your 
driver. Perhaps you have written with root privileges?

Cheers,
Tomas

On 2014-11-03 07:08, eilaf sorkatti wrote:
> There is no need to edit standalone.xml am i right?, Here is my details
> "I was wrong am using JBOSS EAP 6.3":
> I put module.xml on
> /root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main , it
> contains:
>
> <?xml version"1.0" encoding="UTF-8"?>
> <module xmlns="urn:jboss:module:1.0" name="org.mariadb">
>    <resources>
>      <resource-root path="mariadb-java-client-1.1.5.jar"/>
>    </resources>
>    <dependencies>
>      <module name="javax.api"/>
>      <module name="javax.transaction.api"/>
>    </dependencies>
> </module>
>
> I put the connector on the same directory. I run ./jboss-cli.sh
> then write the command
>   /subsystem=datasources/jdbc-
> driver=org.mariadb.jdbc.
> Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>
> Then I get that error!!!
>
> On Sun, Nov 2, 2014 at 1:58 PM, eilaf sorkatti <eil...@gm...
> <mailto:eil...@gm...>> wrote:
>
>     sorry the urn:jboss:module:1.0
>
>     On Sun, Nov 2, 2014 at 1:58 PM, eilaf sorkatti
>     <eil...@gm... <mailto:eil...@gm...>> wrote:
>
>         There is no need to edit standalone.xml am i right?, Here is my
>         details "I was wrong am using JBOSS EAP 6.3":
>         I put module.xml on
>         /root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main
>         , it contains:
>
>         <?xml version"1.0" encoding="UTF-8"?>
>         <module xmlns="urn:jboss:module:1.9" name="org.mariadb">
>            <resources>
>              <resource-root path="mariadb-java-client-1.1.5.jar"/>
>            </resources>
>            <dependencies>
>              <module name="javax.api"/>
>              <module name="javax.transaction.api"/>
>            </dependencies>
>         </module>
>
>         I put the connector on the same directory. I run ./jboss-cli.sh
>         then write the command
>           /subsystem=datasources/jdbc-driver=org.mariadb.jdbc.
>         Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>
>         Then I get that error!!!
>
>
>         On Sun, Nov 2, 2014 at 12:38 PM, EJBCA Support
>         <ejb...@pr... <mailto:ejb...@pr...>>
>         wrote:
>
>
>             Seems there is something wrong in your file, or you are not
>             matching the
>             driver version in module.xml with the jar file you are
>             placing there.
>
>             You have to give full details of what you do in order to
>             figure out what
>             is wrong.
>
>             (it works for me ;-))
>
>             Cheers,
>             Tomas
>
>             On 2014-11-02 06:48, eilaf sorkatti wrote:
>              >
>              > Hi,
>              > Am using JBOSS EAP 6.2.0, I Create the JDBC module
>             configuration file
>              > module.xml. when I try to register driver for mariaDB i get:
>              >   /subsystem=datasources/jdbc-
>              >
>             driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>              > {
>              >      "outcome" => "failed",
>              >      "failure-description" => "JBAS010441: Failed to load
>             module for
>              > driver [org.mariadb]",
>              >      "rolled-back" => true
>              > }
>              >
>              > --
>              > Eilaf Hamad Elnil Mugbil
>              > University Of Khartoum
>              > School Of Mathematical science
>              >
>              >
>              >
>             ------------------------------------------------------------------------------
>              >
>              >
>              >
>              > _______________________________________________
>              > Ejbca-develop mailing list
>              > Ejb...@li...
>             <mailto:Ejb...@li...>
>              > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>              >
>
>
>
>             ------------------------------------------------------------------------------
>             _______________________________________________
>             Ejbca-develop mailing list
>             Ejb...@li...
>             <mailto:Ejb...@li...>
>             https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>
>
>
>         --
>         Eilaf Hamad Elnil Mugbil
>         University Of Khartoum
>         School Of Mathematical science
>
>
>
>
>     --
>     Eilaf Hamad Elnil Mugbil
>     University Of Khartoum
>     School Of Mathematical science
>
>
>
>
> --
> Eilaf Hamad Elnil Mugbil
> University Of Khartoum
> School Of Mathematical science
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] Failed Registering mariadb module on Jboss EAP 6.2.0

[eilaf s. <eil...@gm...>]

There is no need to edit standalone.xml am i right?, Here is my details "I
was wrong am using JBOSS EAP 6.3":
I put module.xml on
/root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main , it
contains:

<?xml version"1.0" encoding="UTF-8"?>
<module xmlns="urn:jboss:module:1.0" name="org.mariadb">
  <resources>
    <resource-root path="mariadb-java-client-1.1.5.jar"/>
  </resources>
  <dependencies>
    <module name="javax.api"/>
    <module name="javax.transaction.api"/>
  </dependencies>
</module>

I put the connector on the same directory. I run ./jboss-cli.sh
then write the command
 /subsystem=datasources/jdbc-
driver=org.mariadb.jdbc.
Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)

Then I get that error!!!

On Sun, Nov 2, 2014 at 1:58 PM, eilaf sorkatti <eil...@gm...>
wrote:

> sorry the urn:jboss:module:1.0
>
> On Sun, Nov 2, 2014 at 1:58 PM, eilaf sorkatti <eil...@gm...>
> wrote:
>
>> There is no need to edit standalone.xml am i right?, Here is my details
>> "I was wrong am using JBOSS EAP 6.3":
>> I put module.xml on
>> /root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main , it
>> contains:
>>
>> <?xml version"1.0" encoding="UTF-8"?>
>> <module xmlns="urn:jboss:module:1.9" name="org.mariadb">
>>   <resources>
>>     <resource-root path="mariadb-java-client-1.1.5.jar"/>
>>   </resources>
>>   <dependencies>
>>     <module name="javax.api"/>
>>     <module name="javax.transaction.api"/>
>>   </dependencies>
>> </module>
>>
>> I put the connector on the same directory. I run ./jboss-cli.sh
>> then write the command
>>  /subsystem=datasources/jdbc-driver=org.mariadb.jdbc.
>>
>> Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>>
>> Then I get that error!!!
>>
>>
>> On Sun, Nov 2, 2014 at 12:38 PM, EJBCA Support <ejb...@pr...
>> > wrote:
>>
>>>
>>> Seems there is something wrong in your file, or you are not matching the
>>> driver version in module.xml with the jar file you are placing there.
>>>
>>> You have to give full details of what you do in order to figure out what
>>> is wrong.
>>>
>>> (it works for me ;-))
>>>
>>> Cheers,
>>> Tomas
>>>
>>> On 2014-11-02 06:48, eilaf sorkatti wrote:
>>> >
>>> > Hi,
>>> > Am using JBOSS EAP 6.2.0, I Create the JDBC module configuration file
>>> > module.xml. when I try to register driver for mariaDB i get:
>>> >   /subsystem=datasources/jdbc-
>>> >
>>> driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>>> > {
>>> >      "outcome" => "failed",
>>> >      "failure-description" => "JBAS010441: Failed to load module for
>>> > driver [org.mariadb]",
>>> >      "rolled-back" => true
>>> > }
>>> >
>>> > --
>>> > Eilaf Hamad Elnil Mugbil
>>> > University Of Khartoum
>>> > School Of Mathematical science
>>> >
>>> >
>>> >
>>> ------------------------------------------------------------------------------
>>> >
>>> >
>>> >
>>> > _______________________________________________
>>> > Ejbca-develop mailing list
>>> > Ejb...@li...
>>> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>> >
>>>
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> _______________________________________________
>>> Ejbca-develop mailing list
>>> Ejb...@li...
>>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>>
>>
>>
>>
>> --
>> Eilaf Hamad Elnil Mugbil
>> University Of Khartoum
>> School Of Mathematical science
>>
>
>
>
> --
> Eilaf Hamad Elnil Mugbil
> University Of Khartoum
> School Of Mathematical science
>



-- 
Eilaf Hamad Elnil Mugbil
University Of Khartoum
School Of Mathematical science

Re: [Ejbca-develop] Failed Registering mariadb module on Jboss EAP 6.2.0

[eilaf s. <eil...@gm...>]

sorry the urn:jboss:module:1.0

On Sun, Nov 2, 2014 at 1:58 PM, eilaf sorkatti <eil...@gm...>
wrote:

> There is no need to edit standalone.xml am i right?, Here is my details "I
> was wrong am using JBOSS EAP 6.3":
> I put module.xml on
> /root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main , it
> contains:
>
> <?xml version"1.0" encoding="UTF-8"?>
> <module xmlns="urn:jboss:module:1.9" name="org.mariadb">
>   <resources>
>     <resource-root path="mariadb-java-client-1.1.5.jar"/>
>   </resources>
>   <dependencies>
>     <module name="javax.api"/>
>     <module name="javax.transaction.api"/>
>   </dependencies>
> </module>
>
> I put the connector on the same directory. I run ./jboss-cli.sh
> then write the command
>  /subsystem=datasources/jdbc-driver=org.mariadb.jdbc.
>
> Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>
> Then I get that error!!!
>
>
> On Sun, Nov 2, 2014 at 12:38 PM, EJBCA Support <ejb...@pr...>
> wrote:
>
>>
>> Seems there is something wrong in your file, or you are not matching the
>> driver version in module.xml with the jar file you are placing there.
>>
>> You have to give full details of what you do in order to figure out what
>> is wrong.
>>
>> (it works for me ;-))
>>
>> Cheers,
>> Tomas
>>
>> On 2014-11-02 06:48, eilaf sorkatti wrote:
>> >
>> > Hi,
>> > Am using JBOSS EAP 6.2.0, I Create the JDBC module configuration file
>> > module.xml. when I try to register driver for mariaDB i get:
>> >   /subsystem=datasources/jdbc-
>> >
>> driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>> > {
>> >      "outcome" => "failed",
>> >      "failure-description" => "JBAS010441: Failed to load module for
>> > driver [org.mariadb]",
>> >      "rolled-back" => true
>> > }
>> >
>> > --
>> > Eilaf Hamad Elnil Mugbil
>> > University Of Khartoum
>> > School Of Mathematical science
>> >
>> >
>> >
>> ------------------------------------------------------------------------------
>> >
>> >
>> >
>> > _______________________________________________
>> > Ejbca-develop mailing list
>> > Ejb...@li...
>> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> >
>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>
>
>
> --
> Eilaf Hamad Elnil Mugbil
> University Of Khartoum
> School Of Mathematical science
>



-- 
Eilaf Hamad Elnil Mugbil
University Of Khartoum
School Of Mathematical science

Re: [Ejbca-develop] Failed Registering mariadb module on Jboss EAP 6.2.0

[eilaf s. <eil...@gm...>]

There is no need to edit standalone.xml am i right?, Here is my details "I
was wrong am using JBOSS EAP 6.3":
I put module.xml on
/root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main , it
contains:

<?xml version"1.0" encoding="UTF-8"?>
<module xmlns="urn:jboss:module:1.9" name="org.mariadb">
  <resources>
    <resource-root path="mariadb-java-client-1.1.5.jar"/>
  </resources>
  <dependencies>
    <module name="javax.api"/>
    <module name="javax.transaction.api"/>
  </dependencies>
</module>

I put the connector on the same directory. I run ./jboss-cli.sh
then write the command
 /subsystem=datasources/jdbc-driver=org.mariadb.jdbc.
Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)

Then I get that error!!!


On Sun, Nov 2, 2014 at 12:38 PM, EJBCA Support <ejb...@pr...>
wrote:

>
> Seems there is something wrong in your file, or you are not matching the
> driver version in module.xml with the jar file you are placing there.
>
> You have to give full details of what you do in order to figure out what
> is wrong.
>
> (it works for me ;-))
>
> Cheers,
> Tomas
>
> On 2014-11-02 06:48, eilaf sorkatti wrote:
> >
> > Hi,
> > Am using JBOSS EAP 6.2.0, I Create the JDBC module configuration file
> > module.xml. when I try to register driver for mariaDB i get:
> >   /subsystem=datasources/jdbc-
> >
> driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
> > {
> >      "outcome" => "failed",
> >      "failure-description" => "JBAS010441: Failed to load module for
> > driver [org.mariadb]",
> >      "rolled-back" => true
> > }
> >
> > --
> > Eilaf Hamad Elnil Mugbil
> > University Of Khartoum
> > School Of Mathematical science
> >
> >
> >
> ------------------------------------------------------------------------------
> >
> >
> >
> > _______________________________________________
> > Ejbca-develop mailing list
> > Ejb...@li...
> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >
>
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>



-- 
Eilaf Hamad Elnil Mugbil
University Of Khartoum
School Of Mathematical science

Re: [Ejbca-develop] Failed Registering mariadb module on Jboss EAP 6.2.0

[EJBCA S. <ejb...@pr...>]

Seems there is something wrong in your file, or you are not matching the 
driver version in module.xml with the jar file you are placing there.

You have to give full details of what you do in order to figure out what 
is wrong.

(it works for me ;-))

Cheers,
Tomas

On 2014-11-02 06:48, eilaf sorkatti wrote:
>
> Hi,
> Am using JBOSS EAP 6.2.0, I Create the JDBC module configuration file
> module.xml. when I try to register driver for mariaDB i get:
>   /subsystem=datasources/jdbc-
> driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
> {
>      "outcome" => "failed",
>      "failure-description" => "JBAS010441: Failed to load module for
> driver [org.mariadb]",
>      "rolled-back" => true
> }
>
> --
> Eilaf Hamad Elnil Mugbil
> University Of Khartoum
> School Of Mathematical science
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

[Ejbca-develop] Failed Registering mariadb module on Jboss EAP 6.2.0

[eilaf s. <eil...@gm...>]

Hi,
Am using JBOSS EAP 6.2.0, I Create the JDBC module configuration file
module.xml. when I try to register driver for mariaDB i get:
 /subsystem=datasources/jdbc-
driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
{
    "outcome" => "failed",
    "failure-description" => "JBAS010441: Failed to load module for driver
[org.mariadb]",
    "rolled-back" => true
}

-- 
Eilaf Hamad Elnil Mugbil
University Of Khartoum
School Of Mathematical science

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Andreas K. <ku...@tr...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
Hi Branko, hi Michael,

I remember that we once wrote code using a separate thread to look for
Card-Insertions to reestablish the PKCS#11 connection. Not a big deal,
just a bit of polling and an indirection to access the (currently
inserted) card. Our stuff is OS, I can provide a pointer to it ...

Greetings,

Andreas
> On Thu, 30 Oct 2014 12:13:08 +0100
> "Michael Ströder" <mi...@st...> wrote:
>
>> HI!
>>
>> I'm currently testing EJBCA (latest SVN) with Smartcard-HSM as
described on
>> [1].
>>
>> Versions:
>> - EJBCA (latest SVN)
>> - OpenSC with PKCS#11 module built from git repo
>> - openSUSE 13.1 and pcsc-lite from their chipcard-repo
>>
>> Sometimes the Smartcard-HSM is no longer reachable due to some issues
with the
>> way openSUSE starts pcscd via udev during hotplug. Yes, I have to
sort that out
>> somewhere else.
>>
>> But I wonder why EJBCA does not reconnect to the Smartcard-HSM once
it was
>> unavailable. I have to restart JBOSS to access the token via PKCS#11
module
>> again.
>>
>> Ciao, Michael.
>>
>> [1]
>>
http://www.smartcard-hsm.com/2014/09/05/Accessing_your_SmartCard-HSM_from_EJBCA.html
>>
>
> It's a more low-level issue with how the PKCS#11 security provider is
> implemented in Java.
>
> Basically, you have no way to tell the PKCS#11 Java security provider
> to reestablish a new session. There's also a bunch of cashing happening
> there, so if you create keys etc outside of EJBCA's running JVM, you
> won't see them in EJBCA.
>
> Fixing this would require quite a bit more effort, unfortunately
> (implementing a custom Java security provider, and maintaining it).
>
> Best regards
>
>
>
>
------------------------------------------------------------------------------
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop


- -- 
Andreas Kühne
phone: +49 177 293 24 97
mailto: ku...@tr...

Trustable Ltd. Niederlassung Deutschland Ströverstr. 18 - 59427 Unna
Amtsgericht Hamm HRB 5868

Directors Andreas Kühne, Heiko Veit

Company UK Company No: 5218868 Registered in England and Wales
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (MingW32)
 
iQEcBAEBAgAGBQJUUn0OAAoJEJFyHkFEeCGVnE8IAI+weiXAq0mXQghD+sfrH108
JOdOod/kGwv5TD8IutAjOX2NKKUPFOZtj6Y8A9BYosUCRvSHWZ+2YivTQMOyVR2c
gVy/bq/upfa/OZcTGAaOWZOeyhlXK7c4yRtq241un8MhfhW2WeeZ6RBhCMZmxqBo
eu/x5iXdkMUn7tSuGstmpPzhWAU7qUOQjWqLJwE2rNz94PdSoHRKUbkQ7ca5Fr5m
/qrVRo9prvL/IOdCjyWvzo8E4fC5Eavo6sDVkH/B1Jban8TwOIZi7IMiUtB4K4bM
9hucPTj7rIyAlalxNM9oWh3CpkjBp68az/oHy31TCl87O5FcvNsmc2eib3Cx5FA=
=XFAv
-----END PGP SIGNATURE-----

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Branko M. <br...@ma...>]

On Thu, 30 Oct 2014 12:13:08 +0100
"Michael Ströder" <mi...@st...> wrote:

> HI!
> 
> I'm currently testing EJBCA (latest SVN) with Smartcard-HSM as described on
> [1].
> 
> Versions:
> - EJBCA (latest SVN)
> - OpenSC with PKCS#11 module built from git repo
> - openSUSE 13.1 and pcsc-lite from their chipcard-repo
> 
> Sometimes the Smartcard-HSM is no longer reachable due to some issues with the
> way openSUSE starts pcscd via udev during hotplug. Yes, I have to sort that out
> somewhere else.
> 
> But I wonder why EJBCA does not reconnect to the Smartcard-HSM once it was
> unavailable. I have to restart JBOSS to access the token via PKCS#11 module
> again.
> 
> Ciao, Michael.
> 
> [1]
> http://www.smartcard-hsm.com/2014/09/05/Accessing_your_SmartCard-HSM_from_EJBCA.html
> 

It's a more low-level issue with how the PKCS#11 security provider is
implemented in Java.

Basically, you have no way to tell the PKCS#11 Java security provider
to reestablish a new session. There's also a bunch of cashing happening
there, so if you create keys etc outside of EJBCA's running JVM, you
won't see them in EJBCA.

Fixing this would require quite a bit more effort, unfortunately
(implementing a custom Java security provider, and maintaining it).

Best regards

-- 
Branko Majic
Jabber: br...@ma...
Please use only Free formats when sending attachments to me.

Бранко Мајић
Џабер: br...@ma...
Молим вас да додатке шаљете искључиво у слободним форматима.

Re: [Ejbca-develop] ejbca.sh ra addendentity with e-mail notification fails

[Branko M. <br...@ma...>]

Hm... I guess the idea is to be able to create end entities without
necessarily sending out the mails.

This may be useful in case of batch generation for some weird
scenarios.

Best regards

On Tue, 21 Oct 2014 15:11:11 +0200
"Michael Ströder" <mi...@st...> wrote:

> On Tue, 21 Oct 2014 14:57:16 +0200 "Michael Ströder" <mi...@st...>
> wrote
> > what's wrong with the command-line below?
> > The end entity profile has various e-mail notifications configured but as you
> > can see the e-mail address is set.
> 
> Ok, --type 257 did it. But why is that required at all?
> The end entity profile already specifys all the stuff (end entity and
> notifications).
> 
> Ciao, Michael.
> 
> > /opt/ejbca_ce_6_2_0/bin/ejbca.sh ra addendentity --username
> > 'mi...@st...' --dn 'E=m...@st...,CN=Michael
> > Ströder,O=stroeder.com' --caname 'CA_Test-Email-CA-1-2014-10' --token
> > USERGENERATED --type 1 --altname 'rfc...@st...'
> > --eeprofile EEP_EmailUser --certprofile CP_EmailUser --email
> > 'mi...@st...' --password=foo123
> > [..]
> > Given userdata doesn't fullfill end entity profile. : Email notification is
> > required.
> 
> 
> 
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://p.sf.net/sfu/Zoho
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop



-- 
Branko Majic
Jabber: br...@ma...
Please use only Free formats when sending attachments to me.

Бранко Мајић
Џабер: br...@ma...
Молим вас да додатке шаљете искључиво у слободним форматима.

Re: [Ejbca-develop] No EJB receiver available for handling

[Branko M. <br...@ma...>]

On Thu, 23 Oct 2014 10:28:23 +0200
Michael Ströder <mi...@st...> wrote:

> Michael Ströder wrote:
> > It seems one of the latest SVN commits broke something.
> > See details below.
> 
> Hmm, running it with a more privileged user worked.
> 
> What the hell is --help doing?
> And why does it take so long?
> 
> # time bin/ejbca.sh ca init --help
> [..]
> real	0m22.982s
> user	0m16.744s
> sys	0m0.129s
> 
> Ciao, Michael.
> 

Perhaps the file ownership for some of the files is not correct or
something similar?

-- 
Branko Majic
Jabber: br...@ma...
Please use only Free formats when sending attachments to me.

Бранко Мајић
Џабер: br...@ma...
Молим вас да додатке шаљете искључиво у слободним форматима.

[Ejbca-develop] reconnect to PKCS#11 USB token

[Michael S. <mi...@st...>]

HI!

I'm currently testing EJBCA (latest SVN) with Smartcard-HSM as described on
[1].

Versions:
- EJBCA (latest SVN)
- OpenSC with PKCS#11 module built from git repo
- openSUSE 13.1 and pcsc-lite from their chipcard-repo

Sometimes the Smartcard-HSM is no longer reachable due to some issues with the
way openSUSE starts pcscd via udev during hotplug. Yes, I have to sort that out
somewhere else.

But I wonder why EJBCA does not reconnect to the Smartcard-HSM once it was
unavailable. I have to restart JBOSS to access the token via PKCS#11 module
again.

Ciao, Michael.

[1]
http://www.smartcard-hsm.com/2014/09/05/Accessing_your_SmartCard-HSM_from_EJBCA.html

Re: [Ejbca-develop] Using EJBCA as a Certificate Mangement System

[Tomas G. <to...@pr...>]

PrimeKey has an additional integration/configuration guide for CMP and 
LTE networks. It is available with Enterprise support subscriptions.

The admin guide is quite detailed though, for further assistance I can 
recommend support :-)

Regards,
Tomas
**********
PrimeKey Solutions AB
Anderstorpsvägen 16, 171 54 Solna, Sweden
Mob: +46 (0)707421096
Internet: www.primekey.se
Twitter: twitter.com/primekeyPKI
**********

On 2014-10-29 11:40, barinder singh wrote:
> Thanks for the clarification.
> Also want to know if there is a configuration guide for CMP
> configuration on EJBCA apart from the Admin guide, if you can share any
> link for configuring CMP on EJBCA it would be of great help.
>
> Thanks And Regards,
> Barinder
>
> On Tue, Oct 28, 2014 at 9:35 PM, Tomas Gustavsson <to...@pr...
> <mailto:to...@pr...>> wrote:
>
>
>     Yes you can. This is a very common use case of EJBCA, it is excellent
>     for this purpose.
>
>     Regards;
>     Tomas
>     -----
>     Save time and money with an Enterprise support subscription. Please see
>     www.primekey.se <http://www.primekey.se> for more information.
>     http://www.primekey.se/Products/EJBCA+PKI/
>     http://www.primekey.se/Services/Support/
>
>     On 2014-10-28 16:56, barinder singh wrote:
>      > Hi,
>      >
>      > I have gone through  EJBCA, i have one requirement of developing
>     the CMP
>      > client which will use the Certificate Management System using CMPv2
>      > protocol for Certificate Enrollment and Certificate Renewal. So can i
>      > use EJBCA which will act as a CMS system for certificate
>     enrollment and
>      > renewal.
>      >
>      > Thanks in Advance
>      > Barinder
>      >
>      >
>      >
>     ------------------------------------------------------------------------------
>      >
>      >
>      >
>      > _______________________________________________
>      > Ejbca-develop mailing list
>      > Ejb...@li...
>     <mailto:Ejb...@li...>
>      > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>      >
>
>     ------------------------------------------------------------------------------
>     _______________________________________________
>     Ejbca-develop mailing list
>     Ejb...@li...
>     <mailto:Ejb...@li...>
>     https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] Using EJBCA as a Certificate Mangement System

[barinder s. <pal...@gm...>]

Thanks for the clarification.
Also want to know if there is a configuration guide for CMP configuration
on EJBCA apart from the Admin guide, if you can share any link for
configuring CMP on EJBCA it would be of great help.

Thanks And Regards,
Barinder

On Tue, Oct 28, 2014 at 9:35 PM, Tomas Gustavsson <to...@pr...> wrote:

>
> Yes you can. This is a very common use case of EJBCA, it is excellent
> for this purpose.
>
> Regards;
> Tomas
> -----
> Save time and money with an Enterprise support subscription. Please see
> www.primekey.se for more information.
> http://www.primekey.se/Products/EJBCA+PKI/
> http://www.primekey.se/Services/Support/
>
> On 2014-10-28 16:56, barinder singh wrote:
> > Hi,
> >
> > I have gone through  EJBCA, i have one requirement of developing the CMP
> > client which will use the Certificate Management System using CMPv2
> > protocol for Certificate Enrollment and Certificate Renewal. So can i
> > use EJBCA which will act as a CMS system for certificate enrollment and
> > renewal.
> >
> > Thanks in Advance
> > Barinder
> >
> >
> >
> ------------------------------------------------------------------------------
> >
> >
> >
> > _______________________________________________
> > Ejbca-develop mailing list
> > Ejb...@li...
> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] Error on installation

[eilaf s. <eil...@gm...>]

Hi,
Am using JBOSS EAP 6.2.0, I Create the JDBC module configuration file
module.xml. when I try to register driver for mariaDB i get:
 /subsystem=datasources/jdbc-driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
{
    "outcome" => "failed",
    "failure-description" => "JBAS010441: Failed to load module for driver
[org.mariadb]",
    "rolled-back" => true
}


On Mon, Aug 18, 2014 at 5:17 PM, Tomas Gustavsson <to...@pr...> wrote:

>
> Sometimes JBoss is a bit buggy. Same thing happened to me, but it still
> is registered (if the regsiter command was success). Just restart JBoss
> and it should be there.
>
> On 2014-08-18 15:11, Miguel Angel Robledo wrote:
> > Hi,
> >
> > I'm installing ejbca on Ubuntu Server 12.04  64 bits and Ubuntu Server
> > 14.04 64 bits  with Jboss-as-7.1.1 and Mysql Database.
> >
> > I'm following the steps on http://ejbca.org/docs/installation.html#JBoss
> > but I get an error on the following step:
> >   4 - Register the driver by running the following two commands in the
> > # JBoss 7 CLI administration tool:
> >
> >
> /subsystem=datasources/jdbc-driver=com.mysql.jdbc.Driver:add(driver-name=com.mysql.jdbc.Driver,driver-class-name=com.mysql.jdbc.Driver,driver-module-name=com.mysql,driver-xa-datasource-class-name=com.mysql.jdbc.jdbc.jdbc2.optional.MysqlXADataSource)
> > :reload
> >
> > Next to :reload command I've get the next error:
> >
> > [standalone@localhost:9999 /] :reload
> > Communication error: java.util.concurrent.ExecutionException: Operation
> > failed
> > [disconnected /]
> >
> > I repeat this process with oracle-jdk7-installer and openjdk-7-jdk and
> > the same error appears.
> >
> > Thanks
> >
> > --
> > Miguel Angel Robledo Lyris | Consultoría IT
> > Santa Fe - Rep. Argentina
> >
> >
> >
> ------------------------------------------------------------------------------
> >
> >
> >
> > _______________________________________________
> > Ejbca-develop mailing list
> > Ejb...@li...
> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>



-- 
Eilaf Hamad Elnil Mugbil
University Of Khartoum
School Of Mathematical science

Re: [Ejbca-develop] Using EJBCA as a Certificate Mangement System

[Tomas G. <to...@pr...>]

Yes you can. This is a very common use case of EJBCA, it is excellent 
for this purpose.

Regards;
Tomas
-----
Save time and money with an Enterprise support subscription. Please see 
www.primekey.se for more information.
http://www.primekey.se/Products/EJBCA+PKI/
http://www.primekey.se/Services/Support/

On 2014-10-28 16:56, barinder singh wrote:
> Hi,
>
> I have gone through  EJBCA, i have one requirement of developing the CMP
> client which will use the Certificate Management System using CMPv2
> protocol for Certificate Enrollment and Certificate Renewal. So can i
> use EJBCA which will act as a CMS system for certificate enrollment and
> renewal.
>
> Thanks in Advance
> Barinder
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

[Ejbca-develop] Using EJBCA as a Certificate Mangement System

[barinder s. <pal...@gm...>]

Hi,

I have gone through  EJBCA, i have one requirement of developing the CMP
client which will use the Certificate Management System using CMPv2
protocol for Certificate Enrollment and Certificate Renewal. So can i use
EJBCA which will act as a CMS system for certificate enrollment and renewal.

Thanks in Advance
Barinder

Re: [Ejbca-develop] FW: Add a cryptographic algorithm to PKI system

[Tomas G. <to...@pr...>]

I wouldn't say easily. You need to have good knowledge about many 
things, among them BouncyCastle probably.
You need to dig deep, or find someone to do it for you.
Own cryptographic algorithms are rarely (never) interesting for the 
wider community as it is basically exclusively governments to create 
such things.

Cheers,
Tomas
-----
Save time and money with an Enterprise support subscription. Please see 
www.primekey.se for more information.
http://www.primekey.se/Products/EJBCA+PKI/
http://www.primekey.se/Services/Support/


On 2014-10-28 15:18, Ghaidaa Taj wrote:
> Sent from my Sony Xperia™ smartphone
>
>
>
> ---- Original Message ----
> Subject: Add a cryptographic algorithm to PKI system
> Sent: Oct 23, 2014 12:39 AM
> From: Ghaidaa Taj <gha...@gm...>
> To: Ejb...@li...
> Cc:
>
> Hi...i have developed my own cryptographic algorithm..and i want to
> attach it to ejbca package..to be an option along with other
> alternatives...am i able to do so easily??
> Thanks in advance..
>
> Sent from my Sony Xperia™ smartphone
>
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

[Ejbca-develop] FW: Add a cryptographic algorithm to PKI system

[Ghaidaa T. <gha...@gm...>]

Sent from my Sony Xperia™ smartphone

---- Original Message ----
Subject: Add a cryptographic algorithm to PKI system
Sent: Oct 23, 2014 12:39 AM
From: Ghaidaa Taj <gha...@gm...>
To: Ejb...@li...
Cc: 

Hi...i have developed my own cryptographic algorithm..and i want to attach it to ejbca package..to be an option along with other alternatives...am i able to do so easily??
Thanks in advance..

Sent from my Sony Xperia™ smartphone

Re: [Ejbca-develop] No EJB receiver available for handling

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> It seems one of the latest SVN commits broke something.
> See details below.

Hmm, running it with a more privileged user worked.

What the hell is --help doing?
And why does it take so long?

# time bin/ejbca.sh ca init --help
[..]
real	0m22.982s
user	0m16.744s
sys	0m0.129s

Ciao, Michael.

[Ejbca-develop] No EJB receiver available for handling

[Michael S. <mi...@st...>]

HI!

It seems one of the latest SVN commits broke something.
See details below.

Ciao, Michael.

$ svn info
Path: .
Working Copy Root Path: /usr/src/michael/ejbca
URL: https://svn.cesecore.eu/svn/ejbca/trunk/ejbca
Relative URL: ^/trunk/ejbca
Repository Root: https://svn.cesecore.eu/svn/ejbca
Repository UUID: 37aeb1de-b14b-0410-9a0e-82b28170d228
Revision: 20069
Node Kind: directory
Schedule: normal
Last Changed Author: mikekushner
Last Changed Rev: 20068
Last Changed Date: 2014-10-22 18:30:45 +0200 (Wed, 22 Oct 2014)

$ bin/ejbca.sh ca init --help
log4j:WARN No appenders could be found for logger
(org.jboss.remoting.remote.connection).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more
info.
Exception in thread "main" java.util.ServiceConfigurationError:
org.ejbca.ui.cli.infrastructure.command.CliCommandPlugin: Provider
org.ejbca.ui.cli.keybind.InternalKeyBindingModifyCommand could not be
instantiated: java.lang.IllegalStateException: No EJB receiver available for
handling [appName:ejbca,modulename:cesecore-ejb,distinctname:] combination for
invocation context org.jboss.ejb.client.EJBClientInvocationContext@31f32e51
	at java.util.ServiceLoader.fail(ServiceLoader.java:224)
	at java.util.ServiceLoader.access$100(ServiceLoader.java:181)
	at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:377)
	at java.util.ServiceLoader$1.next(ServiceLoader.java:445)
	at
org.ejbca.ui.cli.infrastructure.library.CommandLibrary.<init>(CommandLibrary.java:53)
	at
org.ejbca.ui.cli.infrastructure.library.CommandLibrary.<clinit>(CommandLibrary.java:38)
	at org.ejbca.ui.cli.EjbcaEjbCli.main(EjbcaEjbCli.java:29)
Caused by: java.lang.IllegalStateException: No EJB receiver available for
handling [appName:ejbca,modulename:cesecore-ejb,distinctname:] combination for
invocation context org.jboss.ejb.client.EJBClientInvocationContext@31f32e51
	at
org.jboss.ejb.client.EJBClientContext.requireEJBReceiver(EJBClientContext.java:584)
	at
org.jboss.ejb.client.ReceiverInterceptor.handleInvocation(ReceiverInterceptor.java:119)
	at
org.jboss.ejb.client.EJBClientInvocationContext.sendRequest(EJBClientInvocationContext.java:181)
	at
org.jboss.ejb.client.EJBInvocationHandler.doInvoke(EJBInvocationHandler.java:136)
	at
org.jboss.ejb.client.EJBInvocationHandler.doInvoke(EJBInvocationHandler.java:121)
	at
org.jboss.ejb.client.EJBInvocationHandler.invoke(EJBInvocationHandler.java:104)
	at com.sun.proxy.$Proxy0.getAvailableTypesAndProperties(Unknown Source)
	at
org.ejbca.ui.cli.keybind.InternalKeyBindingModifyCommand.<init>(InternalKeyBindingModifyCommand.java:79)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
	at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:526)
	at java.lang.Class.newInstance(Class.java:374)
	at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:373)
	... 4 more

[Ejbca-develop] Add a cryptographic algorithm to PKI system

[Ghaidaa T. <gha...@gm...>]

Hi...i have developed my own cryptographic algorithm..and i want to attach it to ejbca package..to be an option along with other alternatives...am i able to do so easily??
Thanks in advance..

Sent from my Sony Xperia™ smartphone

Re: [Ejbca-develop] status GENERATED in case of expired enrollment code

[Tomas G. <to...@pr...>]

I do not think so. It is coded in the worker. 

Regards, 
Tomas 

"Michael Ströder" <mi...@st...> skrev: (21 oktober 2014 19:05:56 CEST)
>Tomas Gustavsson wrote:
>> Aha interesting. I see no direct issues using failed instead of
>generated. 
>
>Can I influence the state after password expiry without having to
>change the
>Java source code?
>
>Ciao, Michael.
>
>> "Michael Ströder" <mi...@st...> skrev: (21 oktober 2014
>17:26:22 CEST)
>>> HI!
>>>
>>> I've set up the "User Password Expire Service" which works and sends
>>> the user a
>>> notification about the expired enrollment code.
>>>
>>> But it sets the status of the user to GENERATED which triggers
>another
>>> e-mail
>>> notification in my setup informing the user about a cert being
>>> successfully
>>> issued to him.
>>>
>>> Why not set the user to status FAILED?
>>>
>>> Ciao, Michael.
>
>
>
>------------------------------------------------------------------------
>
>------------------------------------------------------------------------------
>Comprehensive Server Monitoring with Site24x7.
>Monitor 10 servers for $9/Month.
>Get alerted through email, SMS, voice calls or mobile push
>notifications.
>Take corrective actions from your mobile device.
>http://p.sf.net/sfu/Zoho
>
>------------------------------------------------------------------------
>
>_______________________________________________
>Ejbca-develop mailing list
>Ejb...@li...
>https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] status GENERATED in case of expired enrollment code

[Michael S. <mi...@st...>]

Tomas Gustavsson wrote:
> Aha interesting. I see no direct issues using failed instead of generated. 

Can I influence the state after password expiry without having to change the
Java source code?

Ciao, Michael.

> "Michael Ströder" <mi...@st...> skrev: (21 oktober 2014 17:26:22 CEST)
>> HI!
>>
>> I've set up the "User Password Expire Service" which works and sends
>> the user a
>> notification about the expired enrollment code.
>>
>> But it sets the status of the user to GENERATED which triggers another
>> e-mail
>> notification in my setup informing the user about a cert being
>> successfully
>> issued to him.
>>
>> Why not set the user to status FAILED?
>>
>> Ciao, Michael.