Menu
▾
▴
openca-ocspd — Discussions about OCSP Responder
You can subscribe to this list here.
| 2010 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
(1) |
Sep
|
Oct
(2) |
Nov
(10) |
Dec
(8) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2011 |
Jan
(4) |
Feb
(17) |
Mar
(16) |
Apr
(1) |
May
(5) |
Jun
(7) |
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2012 |
Jan
|
Feb
(5) |
Mar
|
Apr
(4) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2013 |
Jan
(18) |
Feb
|
Mar
|
Apr
(6) |
May
|
Jun
|
Jul
(3) |
Aug
(5) |
Sep
(12) |
Oct
(6) |
Nov
(6) |
Dec
(4) |
| 2014 |
Jan
|
Feb
(4) |
Mar
|
Apr
|
May
(10) |
Jun
|
Jul
(4) |
Aug
(8) |
Sep
(5) |
Oct
|
Nov
(16) |
Dec
(3) |
| 2015 |
Jan
|
Feb
|
Mar
(12) |
Apr
(40) |
May
(51) |
Jun
(8) |
Jul
(5) |
Aug
|
Sep
(6) |
Oct
|
Nov
(2) |
Dec
|
| 2016 |
Jan
|
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
|
Jul
(3) |
Aug
(1) |
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2017 |
Jan
|
Feb
|
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(5) |
Nov
(6) |
Dec
|
| 2018 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(1) |
Aug
|
Sep
|
Oct
(5) |
Nov
|
Dec
|
| 2019 |
Jan
(2) |
Feb
|
Mar
|
Apr
(63) |
May
(2) |
Jun
|
Jul
(2) |
Aug
(4) |
Sep
|
Oct
|
Nov
|
Dec
|
| 2022 |
Jan
|
Feb
|
Mar
|
Apr
|
May
(3) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2024 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(1) |
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: mahmoud e. <mah...@ya...> - 2010-11-30 12:39:18
|
Dear all :
i would to ask you that if i could do
Openca high availability so if one CA down the other openca go up
if it is availble could you please tell me how
thanks alot;
eng/mahmoud elsaid
telecommunication engineering
--- On Wed, 11/17/10, Massimiliano Pala <Massimiliano.Pala@Dartmouth.edu> wrote:
From: Massimiliano Pala <Massimiliano.Pala@Dartmouth.edu>
Subject: Re: need your help about ocsp
To: "OpenCA OCSDP" <ope...@li...>
Cc: "mahmoud elsaid" <mah...@ya...>, "Openca Users" <ope...@li...>
Date: Wednesday, November 17, 2010, 1:38 PM
Hello,
I suggest you to wait until the v2.0.0 will be released (very soon). Then
download the package and follow the instructions in the INSTALL/README
files.
If you have specific issues, please, write to the OCSPD mailing list (you
have to subscribe).
Cheers,
Max
On 11/03/2010 10:21 AM, mahmoud elsaid wrote:
> Dear sir :
>
> Recently I installed openca version 1.1.0 and I need to install and
> configure OCSP responder so I need your help
|
|
From: Massimiliano P. <Massimiliano.Pala@Dartmouth.edu> - 2010-11-26 15:25:09
|
Hi, the application actually sends an OCSP request (check RFC-2560) which contains an identifier (Hash) of the ca certificate plus the serial number of the cert itself. For more details check out the RFC if you are interested. Later, Max On 11/26/2010 07:53 AM, mhretabk wrote: > Thank you for all your cooperation but still i have one question, while > a browser or other aplication making OCSP request does it request by > serial or send the whole X509 certificate? |
|
From: Massimiliano P. <Massimiliano.Pala@Dartmouth.edu> - 2010-11-24 14:36:08
|
Hi,
the error is related to a missing keyword in the configuration file.
If you installed the software in /opt/ocspd, then the configuration
file should be in:
/opt/ocspd/etc/ocspd/ocspd.xml
If you edit the file, it should have the following:
<pki:general>
<!-- Directory where configurations about libPKI token (e.g., token.d/,
hsm.d/, etc... ) are located -->
<pki:pkiConfigDir>/opt/ocspd/etc/ocspd/pki</pki:pkiConfigDir>
<!-- Name of the token configuration to be used for the server, check
the libPKI documentations for more details -->
The pkiConfigDir is where the pki tokens configuration files are stored,
which is usually in (as per this example, PREFIX=/opt/ocspd):
PREFIX/etc/ocsdp/etc/ocspd/pki
in that directory there are a bunch of other subdirs. Check the LibPKI wiki
for more info about their contents:
http://wiki.openca.org/wiki/index.php/LibPKI_configuration_files
I hope this helps!!!
Cheers,
Max
On 11/24/2010 06:42 AM, mhretabk wrote:
> Hi all,
>
> I have installed openca ocspd 2.0.0 but when i try to run it it logs "
> Missing pkiConfigDir in configuration!" in the error log file can any
> one please help what to do to make it work
>
> Thank you in advance.
|
|
From: mhretabk <mhr...@ya...> - 2010-11-24 11:42:08
|
Hi all,
I have installed openca ocspd 2.0.0 but when i try to run it it logs " Missing
pkiConfigDir in configuration!" in the error log file can any one please help
what to do to make it work
Thank you in advance.
|
|
From: mhretabk <mhr...@ya...> - 2010-11-19 06:47:58
|
I have installed the openca-ocspd v 2.0.0 on UBUNTU 10.04 correctly but the -p
argument doesn't work can you please tell me how to initiate the server?
Thank you in Advance
Mhretabk
________________________________
From: Massimiliano Pala <Massimiliano.Pala@Dartmouth.edu>
To: ope...@li...
Sent: Thu, November 18, 2010 6:42:06 AM
Subject: Re: [Openca-ocspd] Ocspd
Hi,
it should only ask for registration to *edit* pages. If the link is red,
then the page does not currently exists and it would ask you to create
one (which would need to register).
Please, when installing the OCSPD, follow the main instructions in the
README file for now. It also might be useful to take a look at the LibPKI
wiki pages to get acquainted with the configuration of the tokens.
Cheers,
Max
On 11/18/2010 09:11 AM, mhretabk wrote:
> Hi,
>
> I have tried to access the openca wiki, but it doesn't allow me to
> access the articles, it asks to register but the registration doesn't
> work. can any one help me how to access it or tell me where to find
> documentation
|
|
From: Massimiliano P. <Massimiliano.Pala@Dartmouth.edu> - 2010-11-18 14:55:09
|
Hi, it should only ask for registration to *edit* pages. If the link is red, then the page does not currently exists and it would ask you to create one (which would need to register). Please, when installing the OCSPD, follow the main instructions in the README file for now. It also might be useful to take a look at the LibPKI wiki pages to get acquainted with the configuration of the tokens. Cheers, Max On 11/18/2010 09:11 AM, mhretabk wrote: > Hi, > > I have tried to access the openca wiki, but it doesn't allow me to > access the articles, it asks to register but the registration doesn't > work. can any one help me how to access it or tell me where to find > documentation |
|
From: mhretabk <mhr...@ya...> - 2010-11-18 14:12:04
|
Hi, I have tried to access the openca wiki, but it doesn't allow me to access the articles, it asks to register but the registration doesn't work. can any one help me how to access it or tell me where to find documentation |
|
From: Massimiliano P. <Massimiliano.Pala@Dartmouth.edu> - 2010-11-17 23:06:20
|
OpenCA OCSPD Project Overview:
==============================
The OpenCA OCSPD project is aimed to develop a robust and easy-to-install
OCSP daemon. The server is developed as a stand-alone application and can
be integrated into many different PKI solutions as it does not depend on
specific database scheme. Furthermore it can be used as a responder for
multiple CAs.
The OCSP Responder is an rfc2560 compliant OCSPD responder. The purpose of
such a server is to provide an on-line tool to verify the status of a
certificate (such as Mozilla/Firefox/Netscape7).
The Responder was included into the main OpenCA distribution package. It is
also possible to install the daemon as a stand-alone application, all you
will need is a CRL (or access to an LDAP server where to get the CRL from).
Project Status:
===============
OpenCA OCSPD version 2.0.0 Status: Released [17 Nov 2010]
OpenCA OCSPD version 1.9.0 Status: rc1 available [21 Oct 2006]
OpenCA OCSPD version 1.5.1 Status: rc1 available [21 Oct 2006]
OpenCA OCSPD version 1.1.1 Status: Released [19 Jul 2006]
Project developers' Tasks:
==========================
Massimiliano Pala is currently working on:
o Multiple certificate/keys usage for different CA
o LibPKI v0.6.0 support
o Harware support (PKCS#11, OpenSSL Engine)
o Support for POST and GET HTTP methods
o Support for EC key/certificates (if supported by
installed OpenSSL)
Open Issues:
============
o Better compliance to RFC-2560 in case multiple CAs are configured
Wishes:
=======
o
References:
===========
The OpenCA Project main website can be found at http://www.openca.org. You
can find all current versions and available documentation there.
You can also download any part of the software or documentation also at the
official ftp site:
ftp://ftp.openca.org
or from one of the official mirrors:
http://www.openca.org/mirrors.shtml
|
|
From: Massimiliano P. <Massimiliano.Pala@Dartmouth.edu> - 2010-11-17 21:36:31
|
Hello, I suggest you to wait until the v2.0.0 will be released (very soon). Then download the package and follow the instructions in the INSTALL/README files. If you have specific issues, please, write to the OCSPD mailing list (you have to subscribe). Cheers, Max On 11/03/2010 10:21 AM, mahmoud elsaid wrote: > Dear sir : > > Recently I installed openca version 1.1.0 and I need to install and > configure OCSP responder so I need your help |
|
From: Massimiliano P. <Massimiliano.Pala@Dartmouth.edu> - 2010-11-17 21:34:27
|
Hello, our OCSP works on Ubuntu. I am going to release the new version soon (v2.0.0) which requires LibPKI (v0.6+) to be installed on your system. The OCSP is based on CRLs and it can retrieve the CRL from a database by using the supported URLs from LibPKI (or any other resource - that is http, https, ldap, etc.). No direct support for DB lookup (I assume the DB of certificates from OpenCA?) is currently supported. Cheers, Max On 11/04/2010 01:57 AM, mhretabk wrote: > Hi i want to use the openCA ocsp responder with mysql database can you > please help me how to configure it because i couldn't find any > documentation on it and i also want to ask if it works on ubuntu. |
|
From: Massimiliano P. <Massimiliano.Pala@Dartmouth.edu> - 2010-10-18 15:16:53
|
Hi Marc,
the RC1 has some issues that I am working on. Please do not use it in
any production environment - it is not stable (threading issues). I shall
release the new 2.0 version soon.
Thanks for the feedback.
Cheers,
Max
On 10/18/2010 08:46 AM, Marc Werner wrote:
> Hi folks,
>
> I successfully compiled the openca ocsp responder under RedHat
> Enterprise Linux 5.5. It starts normal as an init-task and works
> correctly. The starting options are:
>
> openssl ocsp -index /etc/ocsp/index.txt -CA /etc/ocsp/ca.cer
> -rsigner /etc/ocsp/ocsp.crt -rkey /etc/ocsp/ocsp.key -port 55444
>
>
> But sometimes the programm crashes. Connecting via telnet to the
> assigned port and pressing<enter> two times will affect the following
> message in verbose-mode:
>
> Invalid request
> Responder Error: malformedrequest (1)
>
> The telnet echo:
>
> HTTP/1.0 200 OK
> Content-type: application/ocsp-response
> Content-Length: 5
>
> 0
> Connection closed by foreign host.
>
> What happened? Is this a bug? Thank you in advance for your help!
--
Best Regards,
Massimiliano Pala
--o------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager] op...@ac...
pro...@op...
Dartmouth Computer Science Dept Home Phone: +1 (603) 369-9332
PKI/Trust Laboratory Work Phone: +1 (603) 646-8734
--o------------------------------------------------------------------------
People who think they know everything are a great annoyance to those of us
who do.
-- Isaac Asimov
|
|
From: Marc W. <mar...@cc...> - 2010-10-18 13:04:56
|
Hi folks, I successfully compiled the openca ocsp responder under RedHat Enterprise Linux 5.5. It starts normal as an init-task and works correctly. The starting options are: openssl ocsp -index /etc/ocsp/index.txt -CA /etc/ocsp/ca.cer -rsigner /etc/ocsp/ocsp.crt -rkey /etc/ocsp/ocsp.key -port 55444 But sometimes the programm crashes. Connecting via telnet to the assigned port and pressing <enter> two times will affect the following message in verbose-mode: Invalid request Responder Error: malformedrequest (1) The telnet echo: HTTP/1.0 200 OK Content-type: application/ocsp-response Content-Length: 5 0 Connection closed by foreign host. What happened? Is this a bug? Thank you in advance for your help! Kind regards Marc Werner |
|
From: Massimiliano P. <Massimiliano.Pala@Dartmouth.edu> - 2010-08-27 23:28:13
|
Dear OpenCA Community, we recently worked very hard to provide a new look to our website. We hope that the change will help you to easily find the required resources. Please provide us with feedback about the new layout by sending us simple comments (e.g., "I really like it!", "I preferred the old layout..") or suggestions (e.g., "The link to AbC should be moved here..", "You should add a new link to DeFgh.."). Best Regards, Massimiliano Pala OpenCA Labs |
4 messages has been excluded from this view by a project administrator.