From: Arnaud D. <arn...@gm...> - 2017-03-21 15:00:36
|
Hi, Thanks Markus, it works. I try now to use JKS instead of P12. We have a JKSCryptoToken which seems to work fine with this configuration: GLOB.WORKERGENID1.CLASSPATH=org.signserver.server.signers.CryptoWorker GLOB.WORKERGENID1.SIGNERTOKEN.CLASSPATH=org.signserver.server.cryptotokens.KeystoreCryptoToken WORKERGENID1.NAME=CryptoJKS WORKERGENID1.KEYSTORETYPE=JKS WORKERGENID1.KEYSTOREPATH=/opt/signserver/keystore.jks WORKERGENID1.KEYSTOREPASSWORD=foobar WORKERGENID1.DEFAULTKEY=test The TimestampWorker configuration looks like: GLOB.WORKERGENID1.CLASSPATH=org.signserver.module.tsa.TimeStampSigner WORKERGENID1.NAME=TimeStampSigner WORKERGENID1.AUTHTYPE=NOAUTH WORKERGENID1.CRYPTOTOKEN=CryptoJKS WORKERGENID1.DEFAULTTSAPOLICYOID=1.1.1.1 WORKERGENID1.SIGNATUREALGORITHM=SHA256WithRSA WORKERGENID1.DEFAULTKEY=my-key We upload the signercert and signsercertchain to the TimeStampSigner without problem The getstatus command shows Current version of server is : SignServer CE 3.7.0 Status of CryptoWorker with id 1 (CryptoJKS) is: Worker status : Active Token status : Active Status of Signer with id 2 (PDFSigner) is: Worker status : Active Token status : Active Status of Signer with id 3 (TimeStampSigner) is: Worker status : Active Token status : Active Signings : 0 But when we are use the following command to test the setup is correct bin/signclient timestamp http://localhost:8080/signserver/process?workerName=TimeStampSigner The result is Exception in thread "main" org.signserver.cli.spi.UnexpectedCommandFailureException: java.io.IOException: Server returned HTTP response code: 500 for URL: http://localhost:8080/signserver/process?workerName=TimeStampSigner at org.signserver.client.cli.defaultimpl.TimeStampCommand.execute(TimeStampCommand.java:343) at org.signserver.cli.CommandLineInterface.execute(CommandLineInterface.java:97) at org.signserver.client.cli.ClientCLI.main(ClientCLI.java:45) Caused by: java.io.IOException: Server returned HTTP response code: 500 for URL: http://localhost:8080/signserver/process?workerName=TimeStampSigner at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1676) at org.signserver.client.cli.defaultimpl.TimeStampCommand.tsaRequest(TimeStampCommand.java:676) at org.signserver.client.cli.defaultimpl.TimeStampCommand.run(TimeStampCommand.java:364) at org.signserver.client.cli.defaultimpl.TimeStampCommand.execute(TimeStampCommand.java:335) ... 2 more and the logs shows: [#|2017-03-21T14:42:59.564+0100|INFO|glassfish3.1.2|javax.enterprise.system.std.com.sun.enterprise.server.logging|_ThreadID=92;_ThreadName=Thread-2;|ERROR [TimeStampSigner] OperatorCreationException: org.bouncycastle.operator.OperatorCreationException: cannot create signer: no such algorithm: SHA256WITHRSA for provider SUN at org.bouncycastle.operator.jcajce.JcaContentSignerBuilder.build(Unknown Source) at org.signserver.module.tsa.TimeStampSigner.getTimeStampTokenGenerator(TimeStampSigner.java:753) at org.signserver.module.tsa.TimeStampSigner.processData(TimeStampSigner.java:477) at org.signserver.ejb.WorkerProcessImpl.process(WorkerProcessImpl.java:282) at org.signserver.ejb.WorkerSessionBean.process(WorkerSeƒssionBean.java:177) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at org.glassfish.ejb.security.application.EJBSecurityManager.runMethod(EJBSecurityManager.java:1052) at org.glassfish.ejb.security.application.EJBSecurityManager.invoke(EJBSecurityManager.java:1124) at com.sun.ejb.containers.BaseContainer.invokeBeanMethod(BaseContainer.java:5388) at com.sun.ejb.EjbInvocation.invokeBeanMethod(EjbInvocation.java:619) at com.sun.ejb.containers.interceptors.AroundInvokeChainImpl.invokeNext(InterceptorManager.java:800) at com.sun.ejb.EjbInvocation.proceed(EjbInvocation.java:571) at com.sun.ejb.containers.interceptors.SystemInterceptorProxy.doAround(SystemInterceptorProxy.java:162) at com.sun.ejb.containers.interceptors.SystemInterceptorProxy.aroundInvoke(SystemInterceptorProxy.java:144) at sun.reflect.GeneratedMethodAccessor100.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at com.sun.ejb.containers.interceptors.AroundInvokeInterceptor.intercept(InterceptorManager.java:861) at com.sun.ejb.containers.interceptors.AroundInvokeChainImpl.invokeNext(InterceptorManager.java:800) at com.sun.ejb.containers.interceptors.InterceptorManager.intercept(InterceptorManager.java:370) at com.sun.ejb.containers.BaseContainer.__intercept(BaseContainer.java:5360) at com.sun.ejb.containers.BaseContainer.intercept(BaseContainer.java:5348) at com.sun.ejb.containers.EJBLocalObjectInvocationHandler.invoke(EJBLocalObjectInvocationHandler.java:214) at com.sun.ejb.containers.EJBLocalObjectInvocationHandlerDelegate.invoke(EJBLocalObjectInvocationHandlerDelegate.java:88) at com.sun.proxy.$Proxy268.process(Unknown Source) at org.signserver.web.GenericProcessServlet.processRequest(GenericProcessServlet.java:487) at org.signserver.web.GenericProcessServlet.doPost(GenericProcessServlet.java:374) at javax.servlet.http.HttpServlet.service(HttpServlet.java:688) at javax.servlet.http.HttpServlet.service(HttpServlet.java:770) at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1542) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:281) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:655) at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:595) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:161) at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:331) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:231) at com.sun.enterprise.v3.services.impl.ContainerMapper$AdapterCallable.call(ContainerMapper.java:317) at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:195) at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:849) at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:746) at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:1045) at com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:228) at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:137) at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:104) at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:90) at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:79) at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:54) at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:59) at com.sun.grizzly.ContextTask.run(ContextTask.java:71) at com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:532) at com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:513) at java.lang.Thread.run(Thread.java:745) Caused by: java.security.NoSuchAlgorithmException: no such algorithm: SHA256WITHRSA for provider SUN at sun.security.jca.GetInstance.getService(GetInstance.java:100) at sun.security.jca.GetInstance.getInstance(GetInstance.java:218) at java.security.Signature.getInstance(Signature.java:403) at org.bouncycastle.jcajce.ProviderJcaJceHelper.createSignature(Unknown Source) at org.bouncycastle.operator.jcajce.OperatorHelper.createSignature(Unknown Source) ... 56 more |#] [#|2017-03-21T14:42:59.566+0100|INFO|glassfish3.1.2|javax.enterprise.system.std.com.sun.enterprise.server.logging|_ThreadID=92;_ThreadName=Thread-2;|ERROR [WorkerProcessImpl] SignServerException calling signer with id 3 : cannot create signer: no such algorithm: SHA256WITHRSA for provider SUN org.signserver.common.SignServerException: SignServerException calling signer with id 3 : cannot create signer: no such algorithm: SHA256WITHRSA for provider SUN at org.signserver.ejb.WorkerProcessImpl.process(WorkerProcessImpl.java:286) at org.signserver.ejb.WorkerSessionBean.process(WorkerSessionBean.java:177) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at org.glassfish.ejb.security.application.EJBSecurityManager.runMethod(EJBSecurityManager.java:1052) at org.glassfish.ejb.security.application.EJBSecurityManager.invoke(EJBSecurityManager.java:1124) at com.sun.ejb.containers.BaseContainer.invokeBeanMethod(BaseContainer.java:5388) at com.sun.ejb.EjbInvocation.invokeBeanMethod(EjbInvocation.java:619) at com.sun.ejb.containers.interceptors.AroundInvokeChainImpl.invokeNext(InterceptorManager.java:800) at com.sun.ejb.EjbInvocation.proceed(EjbInvocation.java:571) at com.sun.ejb.containers.interceptors.SystemInterceptorProxy.doAround(SystemInterceptorProxy.java:162) at com.sun.ejb.containers.interceptors.SystemInterceptorProxy.aroundInvoke(SystemInterceptorProxy.java:144) at sun.reflect.GeneratedMethodAccessor100.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at com.sun.ejb.containers.interceptors.AroundInvokeInterceptor.intercept(InterceptorManager.java:861) at com.sun.ejb.containers.interceptors.AroundInvokeChainImpl.invokeNext(InterceptorManager.java:800) at com.sun.ejb.containers.interceptors.InterceptorManager.intercept(InterceptorManager.java:370) at com.sun.ejb.containers.BaseContainer.__intercept(BaseContainer.java:5360) at com.sun.ejb.containers.BaseContainer.intercept(BaseContainer.java:5348) at com.sun.ejb.containers.EJBLocalObjectInvocationHandler.invoke(EJBLocalObjectInvocationHandler.java:214) at com.sun.ejb.containers.EJBLocalObjectInvocationHandlerDelegate.invoke(EJBLocalObjectInvocationHandlerDelegate.java:88) at com.sun.proxy.$Proxy268.process(Unknown Source) at org.signserver.web.GenericProcessServlet.processRequest(GenericProcessServlet.java:487) at org.signserver.web.GenericProcessServlet.doPost(GenericProcessServlet.java:374) at javax.servlet.http.HttpServlet.service(HttpServlet.java:688) at javax.servlet.http.HttpServlet.service(HttpServlet.java:770) at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1542) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:281) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:655) at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:595) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:161) at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:331) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:231) at com.sun.enterprise.v3.services.impl.ContainerMapper$AdapterCallable.call(ContainerMapper.java:317) at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:195) at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:849) at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:746) at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:1045) at com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:228) at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:137) at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:104) at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:90) at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:79) at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:54) at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:59) at com.sun.grizzly.ContextTask.run(ContextTask.java:71) at com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:532) at com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:513) at java.lang.Thread.run(Thread.java:745) Caused by: org.signserver.common.SignServerException: cannot create signer: no such algorithm: SHA256WITHRSA for provider SUN at org.signserver.module.tsa.TimeStampSigner.processData(TimeStampSigner.java:600) at org.signserver.ejb.WorkerProcessImpl.process(WorkerProcessImpl.java:282) ... 52 more Caused by: org.bouncycastle.operator.OperatorCreationException: cannot create signer: no such algorithm: SHA256WITHRSA for provider SUN at org.bouncycastle.operator.jcajce.JcaContentSignerBuilder.build(Unknown Source) at org.signserver.module.tsa.TimeStampSigner.getTimeStampTokenGenerator(TimeStampSigner.java:753) at org.signserver.module.tsa.TimeStampSigner.processData(TimeStampSigner.java:477) ... 53 more Caused by: java.security.NoSuchAlgorithmException: no such algorithm: SHA256WITHRSA for provider SUN at sun.security.jca.GetInstance.getService(GetInstance.java:100) at sun.security.jca.GetInstance.getInstance(GetInstance.java:218) at java.security.Signature.getInstance(Signature.java:403) at org.bouncycastle.jcajce.ProviderJcaJceHelper.createSignature(Unknown Source) at org.bouncycastle.operator.jcajce.OperatorHelper.createSignature(Unknown Source) ... 56 more |#] [#|2017-03-21T14:42:59.584+0100|INFO|glassfish3.1.2|javax.enterprise.system.std.com.sun.enterprise.server.logging|_ThreadID=92;_ThreadName=Thread-2;|INFO [IWorkerLogger] AUDIT; DefaultTimeStampLogger; LOG_ID: 0ed1fc43-f42b-4622-ae4f-99fba7304288; CLIENT_IP: 127.0.0.1; REQUEST_FULLURL: http://localhost:8080/signserver/process?workerName=TimeStampSigner; RequestTime: 1490103779263; ResponseTime: 15; TimeStamp: 1490103779445; TimeSource: LocalComputerTimeSource; PKIStatus: ${TSA_PKISTATUS}; PKIFailureInfo: ${TSA_PKIFAILUREINFO}; SerialNumber: 4569cf4ec5c6cd9c; TSA_POLICYID: 1.2.250.1.302.2.1.1.0; SIGNER_CERT_SERIALNUMBER: 6cc9d2ed368a8e4d; SIGNER_CERT_ISSUERDN: CN=TEST - SIGN2 TEST CA,OU=794513986,O=TEST,L=CAEN,ST=CALVADOS,C=FR; TIMESTAMPREQUEST_ENCODED: MCwCAQEwITAJBgUrDgMCGgUABBQAAAAAAAAAAAAAAAAAAAAAAAAAAAIExHyg+Q==; TSA_TIMESTAMPRESPONSE_ENCODED: ${TSA_TIMESTAMPRESPONSE_ENCODED}; ARCHIVE_IDS: ${ARCHIVE_IDS}; PURCHASED: ${PURCHASED}; TSA_EXCEPTION: cannot create signer: no such algorithm: SHA256WITHRSA for provider SUN; EXCEPTION: SignServerException calling signer with id 3 : cannot create signer: no such algorithm: SHA256WITHRSA for provider SUN |#] We use signserver 3.7.0, we are using openjdk-7 and we have installed the JCE package. Have we made something wrong ? Can you help us going to the right direction ? Thanks a lot 2017-03-20 15:25 GMT+01:00 Markus Kilås <ma...@pr...>: > On 03/20/2017 11:41 AM, Arnaud Defos wrote: > > Hi, > > > > Thanks for your answer. > > > > I try to follow instructions to setup 3.7.0 timestamp signer for demo > > (it is not the same instructions for the current version) but I have > > several errors on the timestamp signer : > > > > Here is an extract of : >bin/signserver getstatus brief all > > > > Status of CryptoWorker with id 7 (CryptoTokenP12) is: > > Worker status : Active > > Token status : Active > > > > Worker properties: > > KEYSTORETYPE=PKCS12 > > > > CLASSPATH=org.signserver.common.ProcessableConfig > > > > DEFAULTKEY=Signer 2 > > > > KEYSTOREPATH=/opt/signserver/res/test/dss10/dss10_signer2.p12 > > > > SIGNERCERT= > > > > NAME=CryptoTokenP12 > > > > > > SIGNERCERTCHAIN=MIIEhzCCAm+gAwIBAgIITQ7wWwEnF4EwDQYJKoZIh > vcNAQELBQAwTTEXMBUGA1UEAwwORFNTIFJvb3QgQ0EgMTAxEDAOBgNVBAsMB > 1Rlc3RpbmcxEzARBgNVBAoMClNpZ25TZXJ2ZXIxCzAJBgNVBAYTAlNFMB4XD > TE0MTAxMDA4NDQyOVoXDTM0MTAxMDA4NDQyOVowQDEUMBIGA1UEAwwLVFMgU > 2lnbmVyIDIxGzAZBgNVBAoMElNpZ25TZXJ2ZXIgVGVzdGluZzELMAkGA1UEB > hMCU0UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCiQkk9WQ+ > ufdrnms7oDcGdt7Sd8lH0gNIjwCYWFgQEugp+Jq/HSgx1t0N74OTC/vzEGSBuP// > aWEwJWayz3RHNj53R3SuDZI/zL8OzLHCuKoJ+4zuWeWC9IcJjChfz64MzvMjnfKQpWG > oje23IU9rxGyN8U4hap/f376wlSF5biP3H2u61/qqC2PE5g9DAPKBP1whWkztl6GGpViV > xBlGymsyDnmzZI39rvySsBbnWayggOB337Nuwi/O4aoKyk7cA3xvaby2UdOUD8Tj7c5mR > KqCnHwVIoh9spRrzrqlHOm29xsv/CkXFiTLGpwHqjsIWdZuveBQ+ > nPwqO5jvKkybAgMBAAGjeDB2MB0GA1UdDgQWBBRKRH8HvWJ0mZHx15nOIECp > LNbOEzAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCB6Id7orbsCqPtxWKQJ > YrnYWAWiMA4GA1UdDwEB/wQEAwIHgDAWBgNVHSUBAf8EDDAKBgg > rBgEFBQcDCDANBgkqhkiG9w0BAQsFAAOCAgEAcVo//K7a0PDKQypvdYLMR5byNr+ > lvQlvf2ebnnbL7epgZor+5iKPy8NbEfdlu1PzQaJKcM9XVc68cW > yuS1JStJHQuCeFDt8JBe2Wy+z6sC905nxkh495YYHFzjV8OpA5K7f8fcEnres+ > 7BJM9opnLlWZwCcZx1UjWy1ETOuT//0311Uhn/MXd3V3cfx3oCRrZ+EgS/ > XFg1FFqnk1Ntxa4AIpyr8dWR8boTG9uN/kd5D8gLJUINwCI+ > AMfzsnotMqYwpUGtnaayssTpVQqQ8w2vUvJ8mlqbbOZS+d1HJ+xAWhXjVwxk9t++ > LUTXW6lKp8YuYNN2w+j/Ga4o76QO1tsRAhtgVYiiTOf9nHO9fJvLj+N/qxVr2OWq+/ > C9n87moyZHuD0aDW6FoqkG/Adh0g1GNolop6M1C+iu/SRrdFF7aoBr083lQxI32OLsFrICWqZ > X1+cWk5yZn6ARuiDLX4GSaz63VmoqEW4TPN51HIGX0p4VVOagfqNQrEg86pTlZF > pBfQ9LlmpYV/B2x5Snbpe/raW67hQ1NvrrDV/ilxxKXdFLXXBARqn6/ > t73F0SkyFtCHhSieOm1TMli3IdHgV7up88TE5PnJ6VT6n+ > mcaQxz4bUmpFKCoFFlIaHpQSW2iQQsOXgKt/GOJEajR/MGhZNJeTpWK4Bs4uffGDwu+Tck\= > > > > > > Authorized clients (serial number, issuer DN): > > > > > > Status of Signer with id 8 (TimeStampSigner) is: > > Worker status : *Offline* > > Token status : Active > > Signings : 0 > > > > *Errors: * > > * - No signer certificate available* > > * - No key available for purpose: null* > > * - Unsupported certificate type* > > * > > * > > Worker properties: > > CRYPTOTOKEN=CryptoTokenP12 > > > > CLASSPATH=org.signserver.common.ProcessableConfig > > > > AUTHTYPE=NOAUTH > > > > SIGNERCERT= > > > > NAME=TimeStampSigner > > > > WORKERLOGGER=org.signserver.module.tsa.DefaultTimeStampLogger > > > > SIGNERCERTCHAIN= > > > > DEFAULTTSAPOLICYOID=1.2.3 > > > > > > Authorized clients (serial number, issuer DN): > > > > Signer certificate: > > * Error: No Signer Certificate have been uploaded to this signer.* > > > > > > Do you have any ideas ? > > > > Thanks for your help ! > > > > > > Arnaud > > Hi Arnaud, > > You probably should specify in your TimeStampSigner which key in > CryptoTokenP12 that it should use. > > For instance set the worker property DEFAULTKEY=Signer 2 in > TimeStampSigner. > > > Cheers, > Markus > PrimeKey Solutions > > > Save time and money with an Enterprise support subscription. Please see > www.primekey.se for more information. > https://www.primekey.se/technologies/products-overview/ > https://www.primekey.se/service-support/support/ > > ------------------------------------------------------------ > ------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > SignServer-develop mailing list > Sig...@li... > https://lists.sourceforge.net/lists/listinfo/signserver-develop > |