Menu
▾
▴
signserver-develop
You can subscribe to this list here.
| 2008 |
Jan
(1) |
Feb
(4) |
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(4) |
Dec
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2009 |
Jan
(2) |
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
(4) |
Dec
|
| 2010 |
Jan
(1) |
Feb
|
Mar
|
Apr
(4) |
May
|
Jun
(1) |
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2011 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(1) |
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
(3) |
| 2012 |
Jan
(1) |
Feb
(8) |
Mar
(10) |
Apr
|
May
(12) |
Jun
(2) |
Jul
(28) |
Aug
(15) |
Sep
(12) |
Oct
(2) |
Nov
|
Dec
(16) |
| 2013 |
Jan
(30) |
Feb
(1) |
Mar
|
Apr
(11) |
May
(2) |
Jun
(11) |
Jul
(15) |
Aug
(4) |
Sep
(1) |
Oct
(10) |
Nov
(1) |
Dec
(2) |
| 2014 |
Jan
(8) |
Feb
(13) |
Mar
(12) |
Apr
(24) |
May
(2) |
Jun
(1) |
Jul
(1) |
Aug
|
Sep
(2) |
Oct
(1) |
Nov
(2) |
Dec
(1) |
| 2015 |
Jan
(3) |
Feb
(6) |
Mar
|
Apr
|
May
(7) |
Jun
(7) |
Jul
(3) |
Aug
(5) |
Sep
(1) |
Oct
(8) |
Nov
(6) |
Dec
|
| 2016 |
Jan
|
Feb
(3) |
Mar
(5) |
Apr
(9) |
May
(26) |
Jun
(8) |
Jul
|
Aug
|
Sep
(11) |
Oct
(8) |
Nov
(1) |
Dec
(2) |
| 2017 |
Jan
(4) |
Feb
(7) |
Mar
(7) |
Apr
(4) |
May
(1) |
Jun
(5) |
Jul
(3) |
Aug
(3) |
Sep
(1) |
Oct
(4) |
Nov
(5) |
Dec
(1) |
| 2018 |
Jan
(4) |
Feb
(1) |
Mar
(1) |
Apr
(1) |
May
|
Jun
(1) |
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2019 |
Jan
|
Feb
(1) |
Mar
(2) |
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
(1) |
Oct
|
Nov
(2) |
Dec
|
| 2020 |
Jan
(3) |
Feb
|
Mar
(2) |
Apr
(3) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2021 |
Jan
|
Feb
|
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2022 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(2) |
Jul
|
Aug
|
Sep
(1) |
Oct
|
Nov
|
Dec
(1) |
| 2023 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
(1) |
| 2025 |
Jan
|
Feb
(1) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Markus K. <ma...@pr...> - 2014-06-04 08:16:58
|
On 2014-05-29 21:35, Antoine Louiset wrote:
> Hi Markus !
>
> It works now. Thanks a lot, when the keys are already generated, the
> signatures are immediate.
>
> The key generation is quite long and it seems that it depends to the
> number of keys present in the HSM. In the case of PKCS11Cryptotoken, the
> key generation is done by Cesecore.
>
> Do you know if I could accelerate this process ? Do you know if keys are
> reload systematically just for generation ? Could the shared library
> responsible of that ?
I made a quick look through the code, see below some of the noteworthy
methods called. The only think I discovered that would cause the time to
increase with an increased number of keys is in
P11KeyStore.engineSetEntry where it iterates over existing keys to check
that the new key alias does not already exist. Not sure if this could be
the reason though. I could also have missed something.
---
cesecore.PKCS11CryptoToken.generateKeyPair(keySpec,alias)
-> cesecore.KeyStoreTools.generateKeyPair(keySpec, alias);
KeyPairGenerator.getInstance(algorithm, this.providerName)
kpg.initialize(spec);
-> generateKeyPair(kpg, keyEntryName, sigAlg);
KeyPair keyPair = kpg.generateKeyPair()
-> setKeyEntry(keyEntryName, keyPair.getPrivate(),chain);
KeyStore.setKeyEntry(alias, key, null, chain);
-> keyStoreSpi.engineSetKeyEntry(alias,key,password,chain);
-> P11KeyStore.engineSetEntry(alias, entry, PasswordProt);
Iterates over existing aliases.
-> storePkey(alias, pke)
-> storeChain(alias, X509Certificate[]);
---
Let me know if you make some more progress.
Cheers,
Markus
>
> Thanks !
>
>
> Antoine
>
> Le 29/04/2014 11:48, Antoine Louiset a écrit :
>> Call activation method of the cryptotoken
>
--
Kind regards,
Markus Kilås
PKI Specialist
PrimeKey Solutions AB
Anderstorpsv. 16
171 54 Solna
Sweden
Phone: +46 70 424 94 85
Skype: markusatskype
Email: mar...@pr...
www.primekey.se
|
|
From: Antoine L. <ant...@yo...> - 2014-05-29 19:43:20
|
Hi Markus ! It works now. Thanks a lot, when the keys are already generated, the signatures are immediate. The key generation is quite long and it seems that it depends to the number of keys present in the HSM. In the case of PKCS11Cryptotoken, the key generation is done by Cesecore. Do you know if I could accelerate this process ? Do you know if keys are reload systematically just for generation ? Could the shared library responsible of that ? Thanks ! Antoine Le 29/04/2014 11:48, Antoine Louiset a écrit : > Call activation method of the cryptotoken |
|
From: Marcus L. <mar...@pr...> - 2014-05-07 09:16:45
|
We are happy to announce that SignServer 3.5.1 has been released! This is a maintenance release with in total 33 issues resolved. The most noteworthy changes can be seen below. SignServer 3.5.1 Release Notes: New features and improvements: - Support for passing meta data in requests - Support for configuring the number of certificates to include in signature - API for billing/accounting - Command to print time-stamp requests and responses - Improved error reporting for crypto tokens and RenewalWorker - Improved ability to have custom modules - Always display connect dialog when starting the AdminGUI - Many more Read the full changelog for details (https://jira.primekey.se/browse/DSS?report=com.atlassian.jira.plugin.system.project:changelog-panel#selectedTab=com.atlassian.jira.plugin.system.project%3Achangelog-panel). Regards, The PrimeKey SignServer team |
|
From: Antoine L. <ant...@yo...> - 2014-04-29 10:07:47
|
Thanks Markus, I think it will resolve my problems. Today, the certificates are stored in the HSM but we could save them in database. I'll make some tests to : - generate the key pair - call generatecertreq - save the certificate in database - in the worker, get the certificate in the database (with the alias sent in the request) - in the worker, get the private key in the HSM (with the alias sent in the request) I delete the step "Call activation method of the cryptotoken". I hope it will work ! Have a nice day ! Antoine Le 29/04/2014 10:44, Markus Kilås a écrit : > On 2014-04-28 16:26, Antoine Louiset wrote: >> >> Le 28/04/2014 14:05, Markus Kilås a écrit : >>> On 2014-04-28 09:35, Antoine Louiset wrote: >>>> Thanks for your answer. In my case, this is not really the configuration which changes but the private key changes for each request. So I need to activate the cryptotoken each time. It s still slow as in earlier versions, not slower. >>> How does the private key change? >> I send the alias of the certificate and the private key to use in the >> request. So for each signing, a new alias is used. >>> Are you generating a new key for every request? Even that shouldn't >>> require to run activate again as long as it is SignServer who generated >>> the key. >> Not necessary. Sometimes, I generate a new key, sometimes, it is not >> needed. This is not signserver which generate the keys, this is an >> independant program. When signserver generates new keys, it could send >> for signing the demand to EJBCA ? Is that case, the keystore is updated >> at this moment ? Could it be done in a Java program ? > The 'generatekey' command (CLI/EJB or AdminWS) can generate new > key-pairs in the KeyStore used by the CryptoToken. Those keys are then > immediately available. As far as I can see it won't require any extra > activation. > > The 'generatecertreq' command can be used to get a PKCS#11 certificate > signing request (CSR) which can be sent to the CA to get the certificate. > > The 'installcertificate' and 'installcertificatechain' commands updates > the ceritificate worker properties with the new certificates. > Note, though that this changes the configuration and thus require a new > activate. An other alternative would be to have a command which stores > the certificates in the HSM replacing the dummy certificate stored there > just to point out the keys. > Where do you store the certificates today? > > The RenewalWorker can be set up to do the above steps + request > certificates from EJBCA over web services. Note though that it also > updates the configuration with the aliases of the new keys and thus > require activation. The RenewalWorker implementation could maybe be > changed to optionally instead skip those steps. > > > Cheers, > Markus > > >>>> This is not a problem of changing the configuration of the worker. I do not update the configuration of the worker, I send the alias directly in the request. >>> Regards, >>> Markus >>> >>>> Le 28 avr. 2014 09:18, =?ISO-8859-1?Q?Markus_Kil=E5s?= <ma...@pr...> a écrit : >>>>> On 2014-04-27 19:22, Antoine Louiset wrote: >>>>>> Hi, >>>>>> >>>>>> I upgrade to signserver 3.5.0. The HSM is quite slow. >>>>> You mean that activation is still slow as in earlier versions or slower now? >>>>> >>>>>> If I do not call PKCS11CryptoToken activate method, I can not get the >>>>>> certificate (and the private key) in the keystore so I can not sign anymore. >>>>> Yes, you need to call activate if the configuration changed. Normally >>>>> this doesn't happen so often. >>>>> >>>>> Do you change configuration of the workers frequently? >>>>> >>>>>> If I call PKCS11CryptoToken activate method, it takes 13 seconds. So >>>>>> it's quiet long, the getKeystore() method is now very fast. >>>>>> >>>>>> In PKCS11CryptoToken.java in Cesecore, we could see that in the activate >>>>>> method, the keystore is created for each call : >>>>>> >>>>>> final KeyStore keyStore = createKeyStore(authCode); >>>>>> setKeyStore(keyStore); >>>>>> >>>>>> Is there a way tu just update the keystore and not create it each time ? >>>>>> Or another idea to accelerate the process ? >>>>> I think the issue is that after a configuration change of the worker a >>>>> new instance is created. This also means a new instance of the >>>>> PKCS11CryptoToken (both the SignServer one and the CESeCore one it uses >>>>> internally). This means that we could not cache any KeyStore instance there. >>>>> >>>>> We have some open tickets for separating the worker and crypto token >>>>> which would mean that a worker could be changed and the crypto token >>>>> stay active: >>>>> https://jira.primekey.se/browse/DSS-716 >>>>> >>>>> >>>>> Regards, >>>>> Markus >>>>> >>>>>> Thanks for your help, >>>>>> >>>>>> >>>>>> Antoine >>>>>> >>>>>> >>>>>> Le 19/03/2014 21:35, Tomas Gustavsson a écrit : >>>>>>> Interesting, thanks for the info. >>>>>>> >>>>>>> >>>>>>> On 19 mars 2014 16:45:23 CET, Luis Maia <lui...@gm...> wrote: >>>>>>>> On 03/19/2014 09:04 AM, Tomas Gustavsson wrote: >>>>>>>>> SunPKCS11 always keeps the session open and reuses it. Authentication >>>>>>>> is >>>>>>>>> needed in order to create new sessions right, so even if SunPKCS11 >>>>>>>> would >>>>>>>>> be able to create new sessions, it would have to store the PKCS#11 >>>>>>>>> password (i.e. autologin), preventing use of smart cards for PKCS#11 >>>>>>>>> login etc. >>>>>>>>> >>>>>>>>> If the session is broken (network pulled) you usually need to restart >>>>>>>>> Java in order for SunPKCS11 to create new sessions. >>>>>>>> Actually if the card invalidates the session with the provider logout() >>>>>>>> >>>>>>>> method you do not have to restart JAVA. >>>>>>>> >>>>>>>> I've been developing a smartcard library (used in persistent applets >>>>>>> >from the browser) using the SUNPKCS11 and taking care of issues like >>>>>>>> terminal disconnection events, card removal, card insertion,etc. >>>>>>>> I noticed that some middleware for smartcards do not invalidate >>>>>>>> sessions >>>>>>>> when the logout method is called, but apart from that (required a few >>>>>>>> changes in the middleware source code) it works without restarting java >>>>>>>> >>>>>>>> for long-lived sessions interacting with the webapp (and multiple cards >>>>>>>> >>>>>>>> being removed and inserted, browser refreshed,etc). >>>>>>>> >>>>>>>> As i cache the keystore across multiple signatures, when a card is >>>>>>>> removed if i call the logout method and reinsert a new card it works >>>>>>>> fine, but i must catch the insertion events and force a logout >>>>>>>> (SUNPKCS11 is not aware of cards being removed). >>>>>>>> >>>>>>>> To implement the card events we used Threads checking with the >>>>>>>> smartcardio the card presence or absence from the terminal (you can >>>>>>>> even >>>>>>>> use blocking methods). >>>>>>>> It may not be the nicest solution but it works with buggy middleware >>>>>>>> and >>>>>>>> since the session will only be reestablished when a card is absent it >>>>>>>> is >>>>>>>> fast. >>>>>>>> >>>>>>>> >>>>>>>> Cheers, >>>>>>>> Luís. >>>>>>>> >>>>>>>>> Cheers, >>>>>>>>> Tomas >>>>>>>>> >>>>>>>>> On 2014-03-19 09:33, Markus Kilås wrote: >>>>>>>>>> On 2014-03-18 15:56, Luis Maia wrote: >>>>>>>>>>> On Tue, Mar 18, 2014 at 2:35 PM, Markus Kilås <ma...@pr... >>>>>>>>>>> <mailto:ma...@pr...>> wrote: >>>>>>>>>>> >>>>>>>>>>> On 2014-03-18 14:10, Luis Maia wrote: >>>>>>>>>>> > >>>>>>>>>>> > Em 18/03/2014 09:10, "Markus Kilås" <ma...@pr... >>>>>>>>>>> <mailto:ma...@pr...> >>>>>>>>>>> > <mailto:ma...@pr... <mailto:ma...@pr...>>> >>>>>>>> escreveu: >>>>>>>>>>> >> >>>>>>>>>>> >> On 2014-03-18 09:32, Antoine Louiset wrote: >>>>>>>>>>> >> > call the getKeystore() method because the private key >>>>>>>> changes >>>>>>>>>>> for every >>>>>>>>>>> >> > signing. >>>>>>>>>>> > >>>>>>>>>>> >> Yes, a quick look in the CESeCore code seems to show that >>>>>>>> after >>>>>>>>>>> >> activation the keystore is cached. So I believe it is >>>>>>>> likely that >>>>>>>>>>> >> upgrading to SignServer 3.5 would resolve this issue for >>>>>>>> you. >>>>>>>>>>> > >>>>>>>>>>> > I am not so sure that caching is a solution, because the >>>>>>>> keystore >>>>>>>>>>> would >>>>>>>>>>> > return the cached private key... >>>>>>>>>>> >>>>>>>>>>> In SignServer 3.5 (or if it was 3.4) we have the option to >>>>>>>> actually >>>>>>>>>>> cache the PrivateKey instance which gives a different >>>>>>>> performance as >>>>>>>>>>> compared to the normal way the getPrivateKey() method obtains >>>>>>>> the key >>>>>>>>>>> (from the keystore) so I don't think the PrivateKey is >>>>>>>> completely cached >>>>>>>>>>> only because the KeyStore is. >>>>>>>>>>> >>>>>>>>>>> Anyway, would it be a problem if the PrivateKey was cached? >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> I have no idea how the underlying implementation should work, but >>>>>>>> i've >>>>>>>>>>> seen some EID pkcs#11 devices behaving erratically if the private >>>>>>>> key is >>>>>>>>>>> cached. >>>>>>>>>> I could imagine their would be problem if a cached PrivateKey >>>>>>>> instance >>>>>>>>>> tries to use some session not available anymore. Haven't experienced >>>>>>>>>> this yet when testing with Utimaco and SoftHSM but for sure their >>>>>>>> could >>>>>>>>>> be some issues. >>>>>>>>>> >>>>>>>>>>> An explanation I've been told (feature not a bug) to throw >>>>>>>> exception's >>>>>>>>>>> on cached keys from their developers is due to the strict non >>>>>>>> caching >>>>>>>>>>> policy in qualified signatures... >>>>>>>>>>> This would also mean that a session would remain established and >>>>>>>> the >>>>>>>>>>> card would try to reuse the session of a qualified signature and >>>>>>>> throw >>>>>>>>>>> an exception. >>>>>>>>>>> >>>>>>>>>>> Also, in a library I've been implementing, the pin would be cached >>>>>>>> for a >>>>>>>>>>> qualified signature and an exception thrown immediately IF the >>>>>>>> private >>>>>>>>>>> key object was reused (which is kind of stupid) instead of >>>>>>>> destroying >>>>>>>>>>> the previous session... >>>>>>>>>>> >>>>>>>>>>> Notice that I've no idea what should be the "right" implementation, >>>>>>>> but >>>>>>>>>>> i've had problems before with maintaining sessions and had to make >>>>>>>> some >>>>>>>>>>> workarounds. >>>>>>>>>> I think the SunPKCS11 implementation often re-uses old sessions, I >>>>>>>> tried >>>>>>>>>> some time to have it close all old session but it always seems to >>>>>>>> have >>>>>>>>>> at least one left open, but was some time ago. >>>>>>>>>> >>>>>>>>>>> Meanwhile using our HSM none of this problems have ever surfaced, >>>>>>>> but >>>>>>>>>>> thinking about what Antoine told : >>>>>>>>>>> >>>>>>>>>>> " the private key changes for every signing." >>>>>>>>>>> >>>>>>>>>>> I keep wondering if caching the private key will maintain the >>>>>>>> session on >>>>>>>>>>> the device and will work properly. >>>>>>>>>> Yes, I was wondering about this statement too and I thought it means >>>>>>>>>> that he selects a key from the keystore based on which user it is. >>>>>>>> In >>>>>>>>>> that case caching the PrivateKey instance would not help, however >>>>>>>>>> caching the KeyStore (assuming it works with the HSM/PKCS#11 >>>>>>>>>> implementation) could give better performance as it might not have >>>>>>>> to >>>>>>>>>> ask the HSM to enumerate all keys every time. >>>>>>>>>> >>>>>>>>>>> I know i'm getting in middle of the discussion here, but i think we >>>>>>>> will >>>>>>>>>>> have the same problem soon when we will rotate our keys and it is >>>>>>>> nice >>>>>>>>>>> to have a discussion before we hit the problems. >>>>>>>>>> I think this is a useful discussion. Your input is very welcome. >>>>>>>>>> >>>>>>>>>> We are also interested in the topic of how to make it useful for >>>>>>>> signers >>>>>>>>>> to have access to multiple key-pairs and certificates. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Regards, >>>>>>>>>> >>>>>>>>>> Markus >>>>>>>>>> >>>>>>>>>>> Cheers, >>>>>>>>>>> >>>>>>>>>>> Luis. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>> ------------------------------------------------------------------------------ >>>>>>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>>>>>> "Graph Databases" is the definitive new guide to graph databases and >>>>>>>> their >>>>>>>>> applications. Written by three acclaimed leaders in the field, >>>>>>>>> this first edition is now available. Download your free book today! >>>>>>>>> http://p.sf.net/sfu/13534_NeoTech >>>>>>>>> _______________________________________________ >>>>>>>>> SignServer-develop mailing list >>>>>>>>> Sig...@li... >>>>>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>>>>> ------------------------------------------------------------------------------ >>>>>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>>>>> "Graph Databases" is the definitive new guide to graph databases and >>>>>>>> their >>>>>>>> applications. Written by three acclaimed leaders in the field, >>>>>>>> this first edition is now available. Download your free book today! >>>>>>>> http://p.sf.net/sfu/13534_NeoTech >>>>>>>> _______________________________________________ >>>>>>>> SignServer-develop mailing list >>>>>>>> Sig...@li... >>>>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>>>> ------------------------------------------------------------------------------ >>>>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>>>> "Graph Databases" is the definitive new guide to graph databases and their >>>>>>> applications. Written by three acclaimed leaders in the field, >>>>>>> this first edition is now available. Download your free book today! >>>>>>> http://p.sf.net/sfu/13534_NeoTech >>>>>>> _______________________________________________ >>>>>>> SignServer-develop mailing list >>>>>>> Sig...@li... >>>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>>> >>>>>> >>>>>> photo >>>>>> *Antoine Louiset* >>>>>> Co-founder Yousign >>>>>> t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr >>>>>> >>>>>> Facebook >>>>>> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> >>>>>> Twitter >>>>>> <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> >>>>>> LinkedIn >>>>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> >>>>>> YouTube >>>>>> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> >>>>>> Notre dernier article : Découvrez l’API Yousign >>>>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> >>>>>> Designed with WiseStamp - >>>>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get >>>>>> yours >>>>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> >>>>>> >>>>>> >>>>>> ------------------------------------------------------------------------------ >>>>>> Start Your Social Network Today - Download eXo Platform >>>>>> Build your Enterprise Intranet with eXo Platform Software >>>>>> Java Based Open Source Intranet - Social, Extensible, Cloud Ready >>>>>> Get Started Now And Turn Your Intranet Into A Collaboration Platform >>>>>> http://p.sf.net/sfu/ExoPlatform >>>>>> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> SignServer-develop mailing list >>>>>> Sig...@li... >>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>>> >>>>> >>>>> -- >>>>> Kind regards, >>>>> Markus Kilås >>>>> PKI Specialist >>>>> >>>>> PrimeKey Solutions AB >>>>> >>>>> Anderstorpsv. 16 >>>>> 171 54 Solna >>>>> Sweden >>>>> >>>>> Phone: +46 70 424 94 85 >>>>> Skype: markusatskype >>>>> Email: mar...@pr... >>>>> >>>>> www.primekey.se >>>>> >>>>> >>> >> >> >> >> photo >> *Antoine Louiset* >> Co-founder Yousign >> t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr >> >> Facebook >> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> >> Twitter >> <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> >> LinkedIn >> <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> >> YouTube >> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> >> Notre dernier article : Découvrez l’API Yousign >> <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> >> Designed with WiseStamp - >> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398690047952%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get >> yours >> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398690047952%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> > > photo *Antoine Louiset* Co-founder Yousign t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr Facebook <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> Twitter <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> LinkedIn <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> YouTube <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> Notre dernier article : Découvrez l’API Yousign <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> Designed with WiseStamp - <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398764363589%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get yours <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398764363589%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> |
|
From: Markus K. <ma...@pr...> - 2014-04-29 08:44:18
|
On 2014-04-28 16:26, Antoine Louiset wrote: > > > Le 28/04/2014 14:05, Markus Kilås a écrit : >> On 2014-04-28 09:35, Antoine Louiset wrote: >>> Thanks for your answer. In my case, this is not really the configuration which changes but the private key changes for each request. So I need to activate the cryptotoken each time. It s still slow as in earlier versions, not slower. >> How does the private key change? > I send the alias of the certificate and the private key to use in the > request. So for each signing, a new alias is used. >> Are you generating a new key for every request? Even that shouldn't >> require to run activate again as long as it is SignServer who generated >> the key. > Not necessary. Sometimes, I generate a new key, sometimes, it is not > needed. This is not signserver which generate the keys, this is an > independant program. When signserver generates new keys, it could send > for signing the demand to EJBCA ? Is that case, the keystore is updated > at this moment ? Could it be done in a Java program ? The 'generatekey' command (CLI/EJB or AdminWS) can generate new key-pairs in the KeyStore used by the CryptoToken. Those keys are then immediately available. As far as I can see it won't require any extra activation. The 'generatecertreq' command can be used to get a PKCS#11 certificate signing request (CSR) which can be sent to the CA to get the certificate. The 'installcertificate' and 'installcertificatechain' commands updates the ceritificate worker properties with the new certificates. Note, though that this changes the configuration and thus require a new activate. An other alternative would be to have a command which stores the certificates in the HSM replacing the dummy certificate stored there just to point out the keys. Where do you store the certificates today? The RenewalWorker can be set up to do the above steps + request certificates from EJBCA over web services. Note though that it also updates the configuration with the aliases of the new keys and thus require activation. The RenewalWorker implementation could maybe be changed to optionally instead skip those steps. Cheers, Markus >> >>> This is not a problem of changing the configuration of the worker. I do not update the configuration of the worker, I send the alias directly in the request. >> >> Regards, >> Markus >> >>> Le 28 avr. 2014 09:18, =?ISO-8859-1?Q?Markus_Kil=E5s?= <ma...@pr...> a écrit : >>>> >>>> On 2014-04-27 19:22, Antoine Louiset wrote: >>>>> Hi, >>>>> >>>>> I upgrade to signserver 3.5.0. The HSM is quite slow. >>>> You mean that activation is still slow as in earlier versions or slower now? >>>> >>>>> If I do not call PKCS11CryptoToken activate method, I can not get the >>>>> certificate (and the private key) in the keystore so I can not sign anymore. >>>> Yes, you need to call activate if the configuration changed. Normally >>>> this doesn't happen so often. >>>> >>>> Do you change configuration of the workers frequently? >>>> >>>>> If I call PKCS11CryptoToken activate method, it takes 13 seconds. So >>>>> it's quiet long, the getKeystore() method is now very fast. >>>>> >>>>> In PKCS11CryptoToken.java in Cesecore, we could see that in the activate >>>>> method, the keystore is created for each call : >>>>> >>>>> final KeyStore keyStore = createKeyStore(authCode); >>>>> setKeyStore(keyStore); >>>>> >>>>> Is there a way tu just update the keystore and not create it each time ? >>>>> Or another idea to accelerate the process ? >>>> I think the issue is that after a configuration change of the worker a >>>> new instance is created. This also means a new instance of the >>>> PKCS11CryptoToken (both the SignServer one and the CESeCore one it uses >>>> internally). This means that we could not cache any KeyStore instance there. >>>> >>>> We have some open tickets for separating the worker and crypto token >>>> which would mean that a worker could be changed and the crypto token >>>> stay active: >>>> https://jira.primekey.se/browse/DSS-716 >>>> >>>> >>>> Regards, >>>> Markus >>>> >>>>> Thanks for your help, >>>>> >>>>> >>>>> Antoine >>>>> >>>>> >>>>> Le 19/03/2014 21:35, Tomas Gustavsson a écrit : >>>>>> Interesting, thanks for the info. >>>>>> >>>>>> >>>>>> On 19 mars 2014 16:45:23 CET, Luis Maia <lui...@gm...> wrote: >>>>>>> On 03/19/2014 09:04 AM, Tomas Gustavsson wrote: >>>>>>>> SunPKCS11 always keeps the session open and reuses it. Authentication >>>>>>> is >>>>>>>> needed in order to create new sessions right, so even if SunPKCS11 >>>>>>> would >>>>>>>> be able to create new sessions, it would have to store the PKCS#11 >>>>>>>> password (i.e. autologin), preventing use of smart cards for PKCS#11 >>>>>>>> login etc. >>>>>>>> >>>>>>>> If the session is broken (network pulled) you usually need to restart >>>>>>>> Java in order for SunPKCS11 to create new sessions. >>>>>>> Actually if the card invalidates the session with the provider logout() >>>>>>> >>>>>>> method you do not have to restart JAVA. >>>>>>> >>>>>>> I've been developing a smartcard library (used in persistent applets >>>>>> >from the browser) using the SUNPKCS11 and taking care of issues like >>>>>>> terminal disconnection events, card removal, card insertion,etc. >>>>>>> I noticed that some middleware for smartcards do not invalidate >>>>>>> sessions >>>>>>> when the logout method is called, but apart from that (required a few >>>>>>> changes in the middleware source code) it works without restarting java >>>>>>> >>>>>>> for long-lived sessions interacting with the webapp (and multiple cards >>>>>>> >>>>>>> being removed and inserted, browser refreshed,etc). >>>>>>> >>>>>>> As i cache the keystore across multiple signatures, when a card is >>>>>>> removed if i call the logout method and reinsert a new card it works >>>>>>> fine, but i must catch the insertion events and force a logout >>>>>>> (SUNPKCS11 is not aware of cards being removed). >>>>>>> >>>>>>> To implement the card events we used Threads checking with the >>>>>>> smartcardio the card presence or absence from the terminal (you can >>>>>>> even >>>>>>> use blocking methods). >>>>>>> It may not be the nicest solution but it works with buggy middleware >>>>>>> and >>>>>>> since the session will only be reestablished when a card is absent it >>>>>>> is >>>>>>> fast. >>>>>>> >>>>>>> >>>>>>> Cheers, >>>>>>> Luís. >>>>>>> >>>>>>>> Cheers, >>>>>>>> Tomas >>>>>>>> >>>>>>>> On 2014-03-19 09:33, Markus Kilås wrote: >>>>>>>>> On 2014-03-18 15:56, Luis Maia wrote: >>>>>>>>>> On Tue, Mar 18, 2014 at 2:35 PM, Markus Kilås <ma...@pr... >>>>>>>>>> <mailto:ma...@pr...>> wrote: >>>>>>>>>> >>>>>>>>>> On 2014-03-18 14:10, Luis Maia wrote: >>>>>>>>>> > >>>>>>>>>> > Em 18/03/2014 09:10, "Markus Kilås" <ma...@pr... >>>>>>>>>> <mailto:ma...@pr...> >>>>>>>>>> > <mailto:ma...@pr... <mailto:ma...@pr...>>> >>>>>>> escreveu: >>>>>>>>>> >> >>>>>>>>>> >> On 2014-03-18 09:32, Antoine Louiset wrote: >>>>>>>>>> >> > call the getKeystore() method because the private key >>>>>>> changes >>>>>>>>>> for every >>>>>>>>>> >> > signing. >>>>>>>>>> > >>>>>>>>>> >> Yes, a quick look in the CESeCore code seems to show that >>>>>>> after >>>>>>>>>> >> activation the keystore is cached. So I believe it is >>>>>>> likely that >>>>>>>>>> >> upgrading to SignServer 3.5 would resolve this issue for >>>>>>> you. >>>>>>>>>> > >>>>>>>>>> > I am not so sure that caching is a solution, because the >>>>>>> keystore >>>>>>>>>> would >>>>>>>>>> > return the cached private key... >>>>>>>>>> >>>>>>>>>> In SignServer 3.5 (or if it was 3.4) we have the option to >>>>>>> actually >>>>>>>>>> cache the PrivateKey instance which gives a different >>>>>>> performance as >>>>>>>>>> compared to the normal way the getPrivateKey() method obtains >>>>>>> the key >>>>>>>>>> (from the keystore) so I don't think the PrivateKey is >>>>>>> completely cached >>>>>>>>>> only because the KeyStore is. >>>>>>>>>> >>>>>>>>>> Anyway, would it be a problem if the PrivateKey was cached? >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> I have no idea how the underlying implementation should work, but >>>>>>> i've >>>>>>>>>> seen some EID pkcs#11 devices behaving erratically if the private >>>>>>> key is >>>>>>>>>> cached. >>>>>>>>> I could imagine their would be problem if a cached PrivateKey >>>>>>> instance >>>>>>>>> tries to use some session not available anymore. Haven't experienced >>>>>>>>> this yet when testing with Utimaco and SoftHSM but for sure their >>>>>>> could >>>>>>>>> be some issues. >>>>>>>>> >>>>>>>>>> An explanation I've been told (feature not a bug) to throw >>>>>>> exception's >>>>>>>>>> on cached keys from their developers is due to the strict non >>>>>>> caching >>>>>>>>>> policy in qualified signatures... >>>>>>>>>> This would also mean that a session would remain established and >>>>>>> the >>>>>>>>>> card would try to reuse the session of a qualified signature and >>>>>>> throw >>>>>>>>>> an exception. >>>>>>>>>> >>>>>>>>>> Also, in a library I've been implementing, the pin would be cached >>>>>>> for a >>>>>>>>>> qualified signature and an exception thrown immediately IF the >>>>>>> private >>>>>>>>>> key object was reused (which is kind of stupid) instead of >>>>>>> destroying >>>>>>>>>> the previous session... >>>>>>>>>> >>>>>>>>>> Notice that I've no idea what should be the "right" implementation, >>>>>>> but >>>>>>>>>> i've had problems before with maintaining sessions and had to make >>>>>>> some >>>>>>>>>> workarounds. >>>>>>>>> I think the SunPKCS11 implementation often re-uses old sessions, I >>>>>>> tried >>>>>>>>> some time to have it close all old session but it always seems to >>>>>>> have >>>>>>>>> at least one left open, but was some time ago. >>>>>>>>> >>>>>>>>>> Meanwhile using our HSM none of this problems have ever surfaced, >>>>>>> but >>>>>>>>>> thinking about what Antoine told : >>>>>>>>>> >>>>>>>>>> " the private key changes for every signing." >>>>>>>>>> >>>>>>>>>> I keep wondering if caching the private key will maintain the >>>>>>> session on >>>>>>>>>> the device and will work properly. >>>>>>>>> Yes, I was wondering about this statement too and I thought it means >>>>>>>>> that he selects a key from the keystore based on which user it is. >>>>>>> In >>>>>>>>> that case caching the PrivateKey instance would not help, however >>>>>>>>> caching the KeyStore (assuming it works with the HSM/PKCS#11 >>>>>>>>> implementation) could give better performance as it might not have >>>>>>> to >>>>>>>>> ask the HSM to enumerate all keys every time. >>>>>>>>> >>>>>>>>>> I know i'm getting in middle of the discussion here, but i think we >>>>>>> will >>>>>>>>>> have the same problem soon when we will rotate our keys and it is >>>>>>> nice >>>>>>>>>> to have a discussion before we hit the problems. >>>>>>>>> I think this is a useful discussion. Your input is very welcome. >>>>>>>>> >>>>>>>>> We are also interested in the topic of how to make it useful for >>>>>>> signers >>>>>>>>> to have access to multiple key-pairs and certificates. >>>>>>>>> >>>>>>>>> >>>>>>>>> Regards, >>>>>>>>> >>>>>>>>> Markus >>>>>>>>> >>>>>>>>>> Cheers, >>>>>>>>>> >>>>>>>>>> Luis. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>> ------------------------------------------------------------------------------ >>>>>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>>>>> "Graph Databases" is the definitive new guide to graph databases and >>>>>>> their >>>>>>>> applications. Written by three acclaimed leaders in the field, >>>>>>>> this first edition is now available. Download your free book today! >>>>>>>> http://p.sf.net/sfu/13534_NeoTech >>>>>>>> _______________________________________________ >>>>>>>> SignServer-develop mailing list >>>>>>>> Sig...@li... >>>>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>>>> ------------------------------------------------------------------------------ >>>>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>>>> "Graph Databases" is the definitive new guide to graph databases and >>>>>>> their >>>>>>> applications. Written by three acclaimed leaders in the field, >>>>>>> this first edition is now available. Download your free book today! >>>>>>> http://p.sf.net/sfu/13534_NeoTech >>>>>>> _______________________________________________ >>>>>>> SignServer-develop mailing list >>>>>>> Sig...@li... >>>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>>> ------------------------------------------------------------------------------ >>>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>>> "Graph Databases" is the definitive new guide to graph databases and their >>>>>> applications. Written by three acclaimed leaders in the field, >>>>>> this first edition is now available. Download your free book today! >>>>>> http://p.sf.net/sfu/13534_NeoTech >>>>>> _______________________________________________ >>>>>> SignServer-develop mailing list >>>>>> Sig...@li... >>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>> >>>>> >>>>> >>>>> photo >>>>> *Antoine Louiset* >>>>> Co-founder Yousign >>>>> t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr >>>>> >>>>> Facebook >>>>> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> >>>>> Twitter >>>>> <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> >>>>> LinkedIn >>>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> >>>>> YouTube >>>>> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> >>>>> Notre dernier article : Découvrez l’API Yousign >>>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> >>>>> Designed with WiseStamp - >>>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get >>>>> yours >>>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> >>>>> >>>>> >>>>> ------------------------------------------------------------------------------ >>>>> Start Your Social Network Today - Download eXo Platform >>>>> Build your Enterprise Intranet with eXo Platform Software >>>>> Java Based Open Source Intranet - Social, Extensible, Cloud Ready >>>>> Get Started Now And Turn Your Intranet Into A Collaboration Platform >>>>> http://p.sf.net/sfu/ExoPlatform >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> SignServer-develop mailing list >>>>> Sig...@li... >>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>> >>>> >>>> >>>> -- >>>> Kind regards, >>>> Markus Kilås >>>> PKI Specialist >>>> >>>> PrimeKey Solutions AB >>>> >>>> Anderstorpsv. 16 >>>> 171 54 Solna >>>> Sweden >>>> >>>> Phone: +46 70 424 94 85 >>>> Skype: markusatskype >>>> Email: mar...@pr... >>>> >>>> www.primekey.se >>>> >>>> >> >> > > > > > photo > *Antoine Louiset* > Co-founder Yousign > t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr > > Facebook > <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> > Twitter > <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> > LinkedIn > <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> > YouTube > <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> > Notre dernier article : Découvrez l’API Yousign > <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> > Designed with WiseStamp - > <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398690047952%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get > yours > <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398690047952%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> -- Kind regards, Markus Kilås PKI Specialist PrimeKey Solutions AB Anderstorpsv. 16 171 54 Solna Sweden Phone: +46 70 424 94 85 Skype: markusatskype Email: mar...@pr... www.primekey.se |
|
From: Antoine L. <ant...@yo...> - 2014-04-28 15:02:18
|
Le 28/04/2014 14:05, Markus Kilås a écrit : > On 2014-04-28 09:35, Antoine Louiset wrote: >> Thanks for your answer. In my case, this is not really the configuration which changes but the private key changes for each request. So I need to activate the cryptotoken each time. It s still slow as in earlier versions, not slower. > How does the private key change? I send the alias of the certificate and the private key to use in the request. So for each signing, a new alias is used. > Are you generating a new key for every request? Even that shouldn't > require to run activate again as long as it is SignServer who generated > the key. Not necessary. Sometimes, I generate a new key, sometimes, it is not needed. This is not signserver which generate the keys, this is an independant program. When signserver generates new keys, it could send for signing the demand to EJBCA ? Is that case, the keystore is updated at this moment ? Could it be done in a Java program ? > >> This is not a problem of changing the configuration of the worker. I do not update the configuration of the worker, I send the alias directly in the request. > > Regards, > Markus > >> Le 28 avr. 2014 09:18, =?ISO-8859-1?Q?Markus_Kil=E5s?= <ma...@pr...> a écrit : >>> >>> On 2014-04-27 19:22, Antoine Louiset wrote: >>>> Hi, >>>> >>>> I upgrade to signserver 3.5.0. The HSM is quite slow. >>> You mean that activation is still slow as in earlier versions or slower now? >>> >>>> If I do not call PKCS11CryptoToken activate method, I can not get the >>>> certificate (and the private key) in the keystore so I can not sign anymore. >>> Yes, you need to call activate if the configuration changed. Normally >>> this doesn't happen so often. >>> >>> Do you change configuration of the workers frequently? >>> >>>> If I call PKCS11CryptoToken activate method, it takes 13 seconds. So >>>> it's quiet long, the getKeystore() method is now very fast. >>>> >>>> In PKCS11CryptoToken.java in Cesecore, we could see that in the activate >>>> method, the keystore is created for each call : >>>> >>>> final KeyStore keyStore = createKeyStore(authCode); >>>> setKeyStore(keyStore); >>>> >>>> Is there a way tu just update the keystore and not create it each time ? >>>> Or another idea to accelerate the process ? >>> I think the issue is that after a configuration change of the worker a >>> new instance is created. This also means a new instance of the >>> PKCS11CryptoToken (both the SignServer one and the CESeCore one it uses >>> internally). This means that we could not cache any KeyStore instance there. >>> >>> We have some open tickets for separating the worker and crypto token >>> which would mean that a worker could be changed and the crypto token >>> stay active: >>> https://jira.primekey.se/browse/DSS-716 >>> >>> >>> Regards, >>> Markus >>> >>>> Thanks for your help, >>>> >>>> >>>> Antoine >>>> >>>> >>>> Le 19/03/2014 21:35, Tomas Gustavsson a écrit : >>>>> Interesting, thanks for the info. >>>>> >>>>> >>>>> On 19 mars 2014 16:45:23 CET, Luis Maia <lui...@gm...> wrote: >>>>>> On 03/19/2014 09:04 AM, Tomas Gustavsson wrote: >>>>>>> SunPKCS11 always keeps the session open and reuses it. Authentication >>>>>> is >>>>>>> needed in order to create new sessions right, so even if SunPKCS11 >>>>>> would >>>>>>> be able to create new sessions, it would have to store the PKCS#11 >>>>>>> password (i.e. autologin), preventing use of smart cards for PKCS#11 >>>>>>> login etc. >>>>>>> >>>>>>> If the session is broken (network pulled) you usually need to restart >>>>>>> Java in order for SunPKCS11 to create new sessions. >>>>>> Actually if the card invalidates the session with the provider logout() >>>>>> >>>>>> method you do not have to restart JAVA. >>>>>> >>>>>> I've been developing a smartcard library (used in persistent applets >>>>> >from the browser) using the SUNPKCS11 and taking care of issues like >>>>>> terminal disconnection events, card removal, card insertion,etc. >>>>>> I noticed that some middleware for smartcards do not invalidate >>>>>> sessions >>>>>> when the logout method is called, but apart from that (required a few >>>>>> changes in the middleware source code) it works without restarting java >>>>>> >>>>>> for long-lived sessions interacting with the webapp (and multiple cards >>>>>> >>>>>> being removed and inserted, browser refreshed,etc). >>>>>> >>>>>> As i cache the keystore across multiple signatures, when a card is >>>>>> removed if i call the logout method and reinsert a new card it works >>>>>> fine, but i must catch the insertion events and force a logout >>>>>> (SUNPKCS11 is not aware of cards being removed). >>>>>> >>>>>> To implement the card events we used Threads checking with the >>>>>> smartcardio the card presence or absence from the terminal (you can >>>>>> even >>>>>> use blocking methods). >>>>>> It may not be the nicest solution but it works with buggy middleware >>>>>> and >>>>>> since the session will only be reestablished when a card is absent it >>>>>> is >>>>>> fast. >>>>>> >>>>>> >>>>>> Cheers, >>>>>> Luís. >>>>>> >>>>>>> Cheers, >>>>>>> Tomas >>>>>>> >>>>>>> On 2014-03-19 09:33, Markus Kilås wrote: >>>>>>>> On 2014-03-18 15:56, Luis Maia wrote: >>>>>>>>> On Tue, Mar 18, 2014 at 2:35 PM, Markus Kilås <ma...@pr... >>>>>>>>> <mailto:ma...@pr...>> wrote: >>>>>>>>> >>>>>>>>> On 2014-03-18 14:10, Luis Maia wrote: >>>>>>>>> > >>>>>>>>> > Em 18/03/2014 09:10, "Markus Kilås" <ma...@pr... >>>>>>>>> <mailto:ma...@pr...> >>>>>>>>> > <mailto:ma...@pr... <mailto:ma...@pr...>>> >>>>>> escreveu: >>>>>>>>> >> >>>>>>>>> >> On 2014-03-18 09:32, Antoine Louiset wrote: >>>>>>>>> >> > call the getKeystore() method because the private key >>>>>> changes >>>>>>>>> for every >>>>>>>>> >> > signing. >>>>>>>>> > >>>>>>>>> >> Yes, a quick look in the CESeCore code seems to show that >>>>>> after >>>>>>>>> >> activation the keystore is cached. So I believe it is >>>>>> likely that >>>>>>>>> >> upgrading to SignServer 3.5 would resolve this issue for >>>>>> you. >>>>>>>>> > >>>>>>>>> > I am not so sure that caching is a solution, because the >>>>>> keystore >>>>>>>>> would >>>>>>>>> > return the cached private key... >>>>>>>>> >>>>>>>>> In SignServer 3.5 (or if it was 3.4) we have the option to >>>>>> actually >>>>>>>>> cache the PrivateKey instance which gives a different >>>>>> performance as >>>>>>>>> compared to the normal way the getPrivateKey() method obtains >>>>>> the key >>>>>>>>> (from the keystore) so I don't think the PrivateKey is >>>>>> completely cached >>>>>>>>> only because the KeyStore is. >>>>>>>>> >>>>>>>>> Anyway, would it be a problem if the PrivateKey was cached? >>>>>>>>> >>>>>>>>> >>>>>>>>> I have no idea how the underlying implementation should work, but >>>>>> i've >>>>>>>>> seen some EID pkcs#11 devices behaving erratically if the private >>>>>> key is >>>>>>>>> cached. >>>>>>>> I could imagine their would be problem if a cached PrivateKey >>>>>> instance >>>>>>>> tries to use some session not available anymore. Haven't experienced >>>>>>>> this yet when testing with Utimaco and SoftHSM but for sure their >>>>>> could >>>>>>>> be some issues. >>>>>>>> >>>>>>>>> An explanation I've been told (feature not a bug) to throw >>>>>> exception's >>>>>>>>> on cached keys from their developers is due to the strict non >>>>>> caching >>>>>>>>> policy in qualified signatures... >>>>>>>>> This would also mean that a session would remain established and >>>>>> the >>>>>>>>> card would try to reuse the session of a qualified signature and >>>>>> throw >>>>>>>>> an exception. >>>>>>>>> >>>>>>>>> Also, in a library I've been implementing, the pin would be cached >>>>>> for a >>>>>>>>> qualified signature and an exception thrown immediately IF the >>>>>> private >>>>>>>>> key object was reused (which is kind of stupid) instead of >>>>>> destroying >>>>>>>>> the previous session... >>>>>>>>> >>>>>>>>> Notice that I've no idea what should be the "right" implementation, >>>>>> but >>>>>>>>> i've had problems before with maintaining sessions and had to make >>>>>> some >>>>>>>>> workarounds. >>>>>>>> I think the SunPKCS11 implementation often re-uses old sessions, I >>>>>> tried >>>>>>>> some time to have it close all old session but it always seems to >>>>>> have >>>>>>>> at least one left open, but was some time ago. >>>>>>>> >>>>>>>>> Meanwhile using our HSM none of this problems have ever surfaced, >>>>>> but >>>>>>>>> thinking about what Antoine told : >>>>>>>>> >>>>>>>>> " the private key changes for every signing." >>>>>>>>> >>>>>>>>> I keep wondering if caching the private key will maintain the >>>>>> session on >>>>>>>>> the device and will work properly. >>>>>>>> Yes, I was wondering about this statement too and I thought it means >>>>>>>> that he selects a key from the keystore based on which user it is. >>>>>> In >>>>>>>> that case caching the PrivateKey instance would not help, however >>>>>>>> caching the KeyStore (assuming it works with the HSM/PKCS#11 >>>>>>>> implementation) could give better performance as it might not have >>>>>> to >>>>>>>> ask the HSM to enumerate all keys every time. >>>>>>>> >>>>>>>>> I know i'm getting in middle of the discussion here, but i think we >>>>>> will >>>>>>>>> have the same problem soon when we will rotate our keys and it is >>>>>> nice >>>>>>>>> to have a discussion before we hit the problems. >>>>>>>> I think this is a useful discussion. Your input is very welcome. >>>>>>>> >>>>>>>> We are also interested in the topic of how to make it useful for >>>>>> signers >>>>>>>> to have access to multiple key-pairs and certificates. >>>>>>>> >>>>>>>> >>>>>>>> Regards, >>>>>>>> >>>>>>>> Markus >>>>>>>> >>>>>>>>> Cheers, >>>>>>>>> >>>>>>>>> Luis. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>> ------------------------------------------------------------------------------ >>>>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>>>> "Graph Databases" is the definitive new guide to graph databases and >>>>>> their >>>>>>> applications. Written by three acclaimed leaders in the field, >>>>>>> this first edition is now available. Download your free book today! >>>>>>> http://p.sf.net/sfu/13534_NeoTech >>>>>>> _______________________________________________ >>>>>>> SignServer-develop mailing list >>>>>>> Sig...@li... >>>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>>> ------------------------------------------------------------------------------ >>>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>>> "Graph Databases" is the definitive new guide to graph databases and >>>>>> their >>>>>> applications. Written by three acclaimed leaders in the field, >>>>>> this first edition is now available. Download your free book today! >>>>>> http://p.sf.net/sfu/13534_NeoTech >>>>>> _______________________________________________ >>>>>> SignServer-develop mailing list >>>>>> Sig...@li... >>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>> ------------------------------------------------------------------------------ >>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>> "Graph Databases" is the definitive new guide to graph databases and their >>>>> applications. Written by three acclaimed leaders in the field, >>>>> this first edition is now available. Download your free book today! >>>>> http://p.sf.net/sfu/13534_NeoTech >>>>> _______________________________________________ >>>>> SignServer-develop mailing list >>>>> Sig...@li... >>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>> >>>> >>>> >>>> photo >>>> *Antoine Louiset* >>>> Co-founder Yousign >>>> t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr >>>> >>>> Facebook >>>> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> >>>> Twitter >>>> <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> >>>> LinkedIn >>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> >>>> YouTube >>>> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> >>>> Notre dernier article : Découvrez l’API Yousign >>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> >>>> Designed with WiseStamp - >>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get >>>> yours >>>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> >>>> >>>> >>>> ------------------------------------------------------------------------------ >>>> Start Your Social Network Today - Download eXo Platform >>>> Build your Enterprise Intranet with eXo Platform Software >>>> Java Based Open Source Intranet - Social, Extensible, Cloud Ready >>>> Get Started Now And Turn Your Intranet Into A Collaboration Platform >>>> http://p.sf.net/sfu/ExoPlatform >>>> >>>> >>>> >>>> _______________________________________________ >>>> SignServer-develop mailing list >>>> Sig...@li... >>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>> >>> >>> >>> -- >>> Kind regards, >>> Markus Kilås >>> PKI Specialist >>> >>> PrimeKey Solutions AB >>> >>> Anderstorpsv. 16 >>> 171 54 Solna >>> Sweden >>> >>> Phone: +46 70 424 94 85 >>> Skype: markusatskype >>> Email: mar...@pr... >>> >>> www.primekey.se >>> >>> > > photo *Antoine Louiset* Co-founder Yousign t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr Facebook <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> Twitter <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> LinkedIn <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> YouTube <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> Notre dernier article : Découvrez l’API Yousign <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> Designed with WiseStamp - <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398690047952%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get yours <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398690047952%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> |
|
From: Markus K. <ma...@pr...> - 2014-04-28 12:05:10
|
On 2014-04-28 09:35, Antoine Louiset wrote: > Thanks for your answer. In my case, this is not really the configuration which changes but the private key changes for each request. So I need to activate the cryptotoken each time. It s still slow as in earlier versions, not slower. How does the private key change? Are you generating a new key for every request? Even that shouldn't require to run activate again as long as it is SignServer who generated the key. > > This is not a problem of changing the configuration of the worker. I do not update the configuration of the worker, I send the alias directly in the request. Regards, Markus > > Le 28 avr. 2014 09:18, =?ISO-8859-1?Q?Markus_Kil=E5s?= <ma...@pr...> a écrit : >> >> >> On 2014-04-27 19:22, Antoine Louiset wrote: >>> Hi, >>> >>> I upgrade to signserver 3.5.0. The HSM is quite slow. >> >> You mean that activation is still slow as in earlier versions or slower now? >> >>> >>> If I do not call PKCS11CryptoToken activate method, I can not get the >>> certificate (and the private key) in the keystore so I can not sign anymore. >> >> Yes, you need to call activate if the configuration changed. Normally >> this doesn't happen so often. >> >> Do you change configuration of the workers frequently? >> >>> >>> If I call PKCS11CryptoToken activate method, it takes 13 seconds. So >>> it's quiet long, the getKeystore() method is now very fast. >>> >>> In PKCS11CryptoToken.java in Cesecore, we could see that in the activate >>> method, the keystore is created for each call : >>> >>> final KeyStore keyStore = createKeyStore(authCode); >>> setKeyStore(keyStore); >>> >>> Is there a way tu just update the keystore and not create it each time ? >>> Or another idea to accelerate the process ? >> >> I think the issue is that after a configuration change of the worker a >> new instance is created. This also means a new instance of the >> PKCS11CryptoToken (both the SignServer one and the CESeCore one it uses >> internally). This means that we could not cache any KeyStore instance there. >> >> We have some open tickets for separating the worker and crypto token >> which would mean that a worker could be changed and the crypto token >> stay active: >> https://jira.primekey.se/browse/DSS-716 >> >> >> Regards, >> Markus >> >>> >>> Thanks for your help, >>> >>> >>> Antoine >>> >>> >>> Le 19/03/2014 21:35, Tomas Gustavsson a écrit : >>>> Interesting, thanks for the info. >>>> >>>> >>>> On 19 mars 2014 16:45:23 CET, Luis Maia <lui...@gm...> wrote: >>>>> On 03/19/2014 09:04 AM, Tomas Gustavsson wrote: >>>>>> SunPKCS11 always keeps the session open and reuses it. Authentication >>>>> is >>>>>> needed in order to create new sessions right, so even if SunPKCS11 >>>>> would >>>>>> be able to create new sessions, it would have to store the PKCS#11 >>>>>> password (i.e. autologin), preventing use of smart cards for PKCS#11 >>>>>> login etc. >>>>>> >>>>>> If the session is broken (network pulled) you usually need to restart >>>>>> Java in order for SunPKCS11 to create new sessions. >>>>> Actually if the card invalidates the session with the provider logout() >>>>> >>>>> method you do not have to restart JAVA. >>>>> >>>>> I've been developing a smartcard library (used in persistent applets >>>> >from the browser) using the SUNPKCS11 and taking care of issues like >>>>> terminal disconnection events, card removal, card insertion,etc. >>>>> I noticed that some middleware for smartcards do not invalidate >>>>> sessions >>>>> when the logout method is called, but apart from that (required a few >>>>> changes in the middleware source code) it works without restarting java >>>>> >>>>> for long-lived sessions interacting with the webapp (and multiple cards >>>>> >>>>> being removed and inserted, browser refreshed,etc). >>>>> >>>>> As i cache the keystore across multiple signatures, when a card is >>>>> removed if i call the logout method and reinsert a new card it works >>>>> fine, but i must catch the insertion events and force a logout >>>>> (SUNPKCS11 is not aware of cards being removed). >>>>> >>>>> To implement the card events we used Threads checking with the >>>>> smartcardio the card presence or absence from the terminal (you can >>>>> even >>>>> use blocking methods). >>>>> It may not be the nicest solution but it works with buggy middleware >>>>> and >>>>> since the session will only be reestablished when a card is absent it >>>>> is >>>>> fast. >>>>> >>>>> >>>>> Cheers, >>>>> Luís. >>>>> >>>>>> Cheers, >>>>>> Tomas >>>>>> >>>>>> On 2014-03-19 09:33, Markus Kilås wrote: >>>>>>> On 2014-03-18 15:56, Luis Maia wrote: >>>>>>>> >>>>>>>> On Tue, Mar 18, 2014 at 2:35 PM, Markus Kilås <ma...@pr... >>>>>>>> <mailto:ma...@pr...>> wrote: >>>>>>>> >>>>>>>> On 2014-03-18 14:10, Luis Maia wrote: >>>>>>>> > >>>>>>>> > Em 18/03/2014 09:10, "Markus Kilås" <ma...@pr... >>>>>>>> <mailto:ma...@pr...> >>>>>>>> > <mailto:ma...@pr... <mailto:ma...@pr...>>> >>>>> escreveu: >>>>>>>> >> >>>>>>>> >> On 2014-03-18 09:32, Antoine Louiset wrote: >>>>>>>> >> > call the getKeystore() method because the private key >>>>> changes >>>>>>>> for every >>>>>>>> >> > signing. >>>>>>>> > >>>>>>>> >> Yes, a quick look in the CESeCore code seems to show that >>>>> after >>>>>>>> >> activation the keystore is cached. So I believe it is >>>>> likely that >>>>>>>> >> upgrading to SignServer 3.5 would resolve this issue for >>>>> you. >>>>>>>> > >>>>>>>> > I am not so sure that caching is a solution, because the >>>>> keystore >>>>>>>> would >>>>>>>> > return the cached private key... >>>>>>>> >>>>>>>> In SignServer 3.5 (or if it was 3.4) we have the option to >>>>> actually >>>>>>>> cache the PrivateKey instance which gives a different >>>>> performance as >>>>>>>> compared to the normal way the getPrivateKey() method obtains >>>>> the key >>>>>>>> (from the keystore) so I don't think the PrivateKey is >>>>> completely cached >>>>>>>> only because the KeyStore is. >>>>>>>> >>>>>>>> Anyway, would it be a problem if the PrivateKey was cached? >>>>>>>> >>>>>>>> >>>>>>>> I have no idea how the underlying implementation should work, but >>>>> i've >>>>>>>> seen some EID pkcs#11 devices behaving erratically if the private >>>>> key is >>>>>>>> cached. >>>>>>> I could imagine their would be problem if a cached PrivateKey >>>>> instance >>>>>>> tries to use some session not available anymore. Haven't experienced >>>>>>> this yet when testing with Utimaco and SoftHSM but for sure their >>>>> could >>>>>>> be some issues. >>>>>>> >>>>>>>> An explanation I've been told (feature not a bug) to throw >>>>> exception's >>>>>>>> on cached keys from their developers is due to the strict non >>>>> caching >>>>>>>> policy in qualified signatures... >>>>>>>> This would also mean that a session would remain established and >>>>> the >>>>>>>> card would try to reuse the session of a qualified signature and >>>>> throw >>>>>>>> an exception. >>>>>>>> >>>>>>>> Also, in a library I've been implementing, the pin would be cached >>>>> for a >>>>>>>> qualified signature and an exception thrown immediately IF the >>>>> private >>>>>>>> key object was reused (which is kind of stupid) instead of >>>>> destroying >>>>>>>> the previous session... >>>>>>>> >>>>>>>> Notice that I've no idea what should be the "right" implementation, >>>>> but >>>>>>>> i've had problems before with maintaining sessions and had to make >>>>> some >>>>>>>> workarounds. >>>>>>> I think the SunPKCS11 implementation often re-uses old sessions, I >>>>> tried >>>>>>> some time to have it close all old session but it always seems to >>>>> have >>>>>>> at least one left open, but was some time ago. >>>>>>> >>>>>>>> Meanwhile using our HSM none of this problems have ever surfaced, >>>>> but >>>>>>>> thinking about what Antoine told : >>>>>>>> >>>>>>>> " the private key changes for every signing." >>>>>>>> >>>>>>>> I keep wondering if caching the private key will maintain the >>>>> session on >>>>>>>> the device and will work properly. >>>>>>> Yes, I was wondering about this statement too and I thought it means >>>>>>> that he selects a key from the keystore based on which user it is. >>>>> In >>>>>>> that case caching the PrivateKey instance would not help, however >>>>>>> caching the KeyStore (assuming it works with the HSM/PKCS#11 >>>>>>> implementation) could give better performance as it might not have >>>>> to >>>>>>> ask the HSM to enumerate all keys every time. >>>>>>> >>>>>>>> >>>>>>>> I know i'm getting in middle of the discussion here, but i think we >>>>> will >>>>>>>> have the same problem soon when we will rotate our keys and it is >>>>> nice >>>>>>>> to have a discussion before we hit the problems. >>>>>>> I think this is a useful discussion. Your input is very welcome. >>>>>>> >>>>>>> We are also interested in the topic of how to make it useful for >>>>> signers >>>>>>> to have access to multiple key-pairs and certificates. >>>>>>> >>>>>>> >>>>>>> Regards, >>>>>>> >>>>>>> Markus >>>>>>> >>>>>>>> Cheers, >>>>>>>> >>>>>>>> Luis. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> >>>>> ------------------------------------------------------------------------------ >>>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>>> "Graph Databases" is the definitive new guide to graph databases and >>>>> their >>>>>> applications. Written by three acclaimed leaders in the field, >>>>>> this first edition is now available. Download your free book today! >>>>>> http://p.sf.net/sfu/13534_NeoTech >>>>>> _______________________________________________ >>>>>> SignServer-develop mailing list >>>>>> Sig...@li... >>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>> >>>>> ------------------------------------------------------------------------------ >>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>> "Graph Databases" is the definitive new guide to graph databases and >>>>> their >>>>> applications. Written by three acclaimed leaders in the field, >>>>> this first edition is now available. Download your free book today! >>>>> http://p.sf.net/sfu/13534_NeoTech >>>>> _______________________________________________ >>>>> SignServer-develop mailing list >>>>> Sig...@li... >>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>> >>>> ------------------------------------------------------------------------------ >>>> Learn Graph Databases - Download FREE O'Reilly Book >>>> "Graph Databases" is the definitive new guide to graph databases and their >>>> applications. Written by three acclaimed leaders in the field, >>>> this first edition is now available. Download your free book today! >>>> http://p.sf.net/sfu/13534_NeoTech >>>> _______________________________________________ >>>> SignServer-develop mailing list >>>> Sig...@li... >>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>> >>> >>> >>> >>> photo >>> *Antoine Louiset* >>> Co-founder Yousign >>> t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr >>> >>> Facebook >>> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> >>> Twitter >>> <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> >>> LinkedIn >>> <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> >>> YouTube >>> <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> >>> Notre dernier article : Découvrez l’API Yousign >>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> >>> Designed with WiseStamp - >>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get >>> yours >>> <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> >>> >>> >>> ------------------------------------------------------------------------------ >>> Start Your Social Network Today - Download eXo Platform >>> Build your Enterprise Intranet with eXo Platform Software >>> Java Based Open Source Intranet - Social, Extensible, Cloud Ready >>> Get Started Now And Turn Your Intranet Into A Collaboration Platform >>> http://p.sf.net/sfu/ExoPlatform >>> >>> >>> >>> _______________________________________________ >>> SignServer-develop mailing list >>> Sig...@li... >>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>> >> >> >> >> -- >> Kind regards, >> Markus Kilås >> PKI Specialist >> >> PrimeKey Solutions AB >> >> Anderstorpsv. 16 >> 171 54 Solna >> Sweden >> >> Phone: +46 70 424 94 85 >> Skype: markusatskype >> Email: mar...@pr... >> >> www.primekey.se >> >> -- Kind regards, Markus Kilås PKI Specialist PrimeKey Solutions AB Anderstorpsv. 16 171 54 Solna Sweden Phone: +46 70 424 94 85 Skype: markusatskype Email: mar...@pr... www.primekey.se |
|
From: Antoine L. <ant...@yo...> - 2014-04-28 07:36:09
|
Thanks for your answer. In my case, this is not really the configuration which changes but the private key changes for each request. So I need to activate the cryptotoken each time. It s still slow as in earlier versions, not slower. This is not a problem of changing the configuration of the worker. I do not update the configuration of the worker, I send the alias directly in the request. Le 28 avr. 2014 09:18, =?ISO-8859-1?Q?Markus_Kil=E5s?= <ma...@pr...> a écrit : > > > On 2014-04-27 19:22, Antoine Louiset wrote: > > Hi, > > > > I upgrade to signserver 3.5.0. The HSM is quite slow. > > You mean that activation is still slow as in earlier versions or slower now? > > > > > If I do not call PKCS11CryptoToken activate method, I can not get the > > certificate (and the private key) in the keystore so I can not sign anymore. > > Yes, you need to call activate if the configuration changed. Normally > this doesn't happen so often. > > Do you change configuration of the workers frequently? > > > > > If I call PKCS11CryptoToken activate method, it takes 13 seconds. So > > it's quiet long, the getKeystore() method is now very fast. > > > > In PKCS11CryptoToken.java in Cesecore, we could see that in the activate > > method, the keystore is created for each call : > > > > final KeyStore keyStore = createKeyStore(authCode); > > setKeyStore(keyStore); > > > > Is there a way tu just update the keystore and not create it each time ? > > Or another idea to accelerate the process ? > > I think the issue is that after a configuration change of the worker a > new instance is created. This also means a new instance of the > PKCS11CryptoToken (both the SignServer one and the CESeCore one it uses > internally). This means that we could not cache any KeyStore instance there. > > We have some open tickets for separating the worker and crypto token > which would mean that a worker could be changed and the crypto token > stay active: > https://jira.primekey.se/browse/DSS-716 > > > Regards, > Markus > > > > > Thanks for your help, > > > > > > Antoine > > > > > > Le 19/03/2014 21:35, Tomas Gustavsson a écrit : > >> Interesting, thanks for the info. > >> > >> > >> On 19 mars 2014 16:45:23 CET, Luis Maia <lui...@gm...> wrote: > >>> On 03/19/2014 09:04 AM, Tomas Gustavsson wrote: > >>>> SunPKCS11 always keeps the session open and reuses it. Authentication > >>> is > >>>> needed in order to create new sessions right, so even if SunPKCS11 > >>> would > >>>> be able to create new sessions, it would have to store the PKCS#11 > >>>> password (i.e. autologin), preventing use of smart cards for PKCS#11 > >>>> login etc. > >>>> > >>>> If the session is broken (network pulled) you usually need to restart > >>>> Java in order for SunPKCS11 to create new sessions. > >>> Actually if the card invalidates the session with the provider logout() > >>> > >>> method you do not have to restart JAVA. > >>> > >>> I've been developing a smartcard library (used in persistent applets > >> >from the browser) using the SUNPKCS11 and taking care of issues like > >>> terminal disconnection events, card removal, card insertion,etc. > >>> I noticed that some middleware for smartcards do not invalidate > >>> sessions > >>> when the logout method is called, but apart from that (required a few > >>> changes in the middleware source code) it works without restarting java > >>> > >>> for long-lived sessions interacting with the webapp (and multiple cards > >>> > >>> being removed and inserted, browser refreshed,etc). > >>> > >>> As i cache the keystore across multiple signatures, when a card is > >>> removed if i call the logout method and reinsert a new card it works > >>> fine, but i must catch the insertion events and force a logout > >>> (SUNPKCS11 is not aware of cards being removed). > >>> > >>> To implement the card events we used Threads checking with the > >>> smartcardio the card presence or absence from the terminal (you can > >>> even > >>> use blocking methods). > >>> It may not be the nicest solution but it works with buggy middleware > >>> and > >>> since the session will only be reestablished when a card is absent it > >>> is > >>> fast. > >>> > >>> > >>> Cheers, > >>> Luís. > >>> > >>>> Cheers, > >>>> Tomas > >>>> > >>>> On 2014-03-19 09:33, Markus Kilås wrote: > >>>>> On 2014-03-18 15:56, Luis Maia wrote: > >>>>>> > >>>>>> On Tue, Mar 18, 2014 at 2:35 PM, Markus Kilås <ma...@pr... > >>>>>> <mailto:ma...@pr...>> wrote: > >>>>>> > >>>>>> On 2014-03-18 14:10, Luis Maia wrote: > >>>>>> > > >>>>>> > Em 18/03/2014 09:10, "Markus Kilås" <ma...@pr... > >>>>>> <mailto:ma...@pr...> > >>>>>> > <mailto:ma...@pr... <mailto:ma...@pr...>>> > >>> escreveu: > >>>>>> >> > >>>>>> >> On 2014-03-18 09:32, Antoine Louiset wrote: > >>>>>> >> > call the getKeystore() method because the private key > >>> changes > >>>>>> for every > >>>>>> >> > signing. > >>>>>> > > >>>>>> >> Yes, a quick look in the CESeCore code seems to show that > >>> after > >>>>>> >> activation the keystore is cached. So I believe it is > >>> likely that > >>>>>> >> upgrading to SignServer 3.5 would resolve this issue for > >>> you. > >>>>>> > > >>>>>> > I am not so sure that caching is a solution, because the > >>> keystore > >>>>>> would > >>>>>> > return the cached private key... > >>>>>> > >>>>>> In SignServer 3.5 (or if it was 3.4) we have the option to > >>> actually > >>>>>> cache the PrivateKey instance which gives a different > >>> performance as > >>>>>> compared to the normal way the getPrivateKey() method obtains > >>> the key > >>>>>> (from the keystore) so I don't think the PrivateKey is > >>> completely cached > >>>>>> only because the KeyStore is. > >>>>>> > >>>>>> Anyway, would it be a problem if the PrivateKey was cached? > >>>>>> > >>>>>> > >>>>>> I have no idea how the underlying implementation should work, but > >>> i've > >>>>>> seen some EID pkcs#11 devices behaving erratically if the private > >>> key is > >>>>>> cached. > >>>>> I could imagine their would be problem if a cached PrivateKey > >>> instance > >>>>> tries to use some session not available anymore. Haven't experienced > >>>>> this yet when testing with Utimaco and SoftHSM but for sure their > >>> could > >>>>> be some issues. > >>>>> > >>>>>> An explanation I've been told (feature not a bug) to throw > >>> exception's > >>>>>> on cached keys from their developers is due to the strict non > >>> caching > >>>>>> policy in qualified signatures... > >>>>>> This would also mean that a session would remain established and > >>> the > >>>>>> card would try to reuse the session of a qualified signature and > >>> throw > >>>>>> an exception. > >>>>>> > >>>>>> Also, in a library I've been implementing, the pin would be cached > >>> for a > >>>>>> qualified signature and an exception thrown immediately IF the > >>> private > >>>>>> key object was reused (which is kind of stupid) instead of > >>> destroying > >>>>>> the previous session... > >>>>>> > >>>>>> Notice that I've no idea what should be the "right" implementation, > >>> but > >>>>>> i've had problems before with maintaining sessions and had to make > >>> some > >>>>>> workarounds. > >>>>> I think the SunPKCS11 implementation often re-uses old sessions, I > >>> tried > >>>>> some time to have it close all old session but it always seems to > >>> have > >>>>> at least one left open, but was some time ago. > >>>>> > >>>>>> Meanwhile using our HSM none of this problems have ever surfaced, > >>> but > >>>>>> thinking about what Antoine told : > >>>>>> > >>>>>> " the private key changes for every signing." > >>>>>> > >>>>>> I keep wondering if caching the private key will maintain the > >>> session on > >>>>>> the device and will work properly. > >>>>> Yes, I was wondering about this statement too and I thought it means > >>>>> that he selects a key from the keystore based on which user it is. > >>> In > >>>>> that case caching the PrivateKey instance would not help, however > >>>>> caching the KeyStore (assuming it works with the HSM/PKCS#11 > >>>>> implementation) could give better performance as it might not have > >>> to > >>>>> ask the HSM to enumerate all keys every time. > >>>>> > >>>>>> > >>>>>> I know i'm getting in middle of the discussion here, but i think we > >>> will > >>>>>> have the same problem soon when we will rotate our keys and it is > >>> nice > >>>>>> to have a discussion before we hit the problems. > >>>>> I think this is a useful discussion. Your input is very welcome. > >>>>> > >>>>> We are also interested in the topic of how to make it useful for > >>> signers > >>>>> to have access to multiple key-pairs and certificates. > >>>>> > >>>>> > >>>>> Regards, > >>>>> > >>>>> Markus > >>>>> > >>>>>> Cheers, > >>>>>> > >>>>>> Luis. > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>> > >>> ------------------------------------------------------------------------------ > >>>> Learn Graph Databases - Download FREE O'Reilly Book > >>>> "Graph Databases" is the definitive new guide to graph databases and > >>> their > >>>> applications. Written by three acclaimed leaders in the field, > >>>> this first edition is now available. Download your free book today! > >>>> http://p.sf.net/sfu/13534_NeoTech > >>>> _______________________________________________ > >>>> SignServer-develop mailing list > >>>> Sig...@li... > >>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop > >>> > >>> ------------------------------------------------------------------------------ > >>> Learn Graph Databases - Download FREE O'Reilly Book > >>> "Graph Databases" is the definitive new guide to graph databases and > >>> their > >>> applications. Written by three acclaimed leaders in the field, > >>> this first edition is now available. Download your free book today! > >>> http://p.sf.net/sfu/13534_NeoTech > >>> _______________________________________________ > >>> SignServer-develop mailing list > >>> Sig...@li... > >>> https://lists.sourceforge.net/lists/listinfo/signserver-develop > >> > >> ------------------------------------------------------------------------------ > >> Learn Graph Databases - Download FREE O'Reilly Book > >> "Graph Databases" is the definitive new guide to graph databases and their > >> applications. Written by three acclaimed leaders in the field, > >> this first edition is now available. Download your free book today! > >> http://p.sf.net/sfu/13534_NeoTech > >> _______________________________________________ > >> SignServer-develop mailing list > >> Sig...@li... > >> https://lists.sourceforge.net/lists/listinfo/signserver-develop > > > > > > > > > > photo > > *Antoine Louiset* > > Co-founder Yousign > > t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr > > > > Facebook > > <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> > > Twitter > > <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> > > LinkedIn > > <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> > > YouTube > > <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> > > Notre dernier article : Découvrez l’API Yousign > > <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> > > Designed with WiseStamp - > > <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get > > yours > > <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> > > > > > > ------------------------------------------------------------------------------ > > Start Your Social Network Today - Download eXo Platform > > Build your Enterprise Intranet with eXo Platform Software > > Java Based Open Source Intranet - Social, Extensible, Cloud Ready > > Get Started Now And Turn Your Intranet Into A Collaboration Platform > > http://p.sf.net/sfu/ExoPlatform > > > > > > > > _______________________________________________ > > SignServer-develop mailing list > > Sig...@li... > > https://lists.sourceforge.net/lists/listinfo/signserver-develop > > > > > > -- > Kind regards, > Markus Kilås > PKI Specialist > > PrimeKey Solutions AB > > Anderstorpsv. 16 > 171 54 Solna > Sweden > > Phone: +46 70 424 94 85 > Skype: markusatskype > Email: mar...@pr... > > www.primekey.se > > |
|
From: Markus K. <ma...@pr...> - 2014-04-28 07:18:39
|
On 2014-04-27 19:22, Antoine Louiset wrote: > Hi, > > I upgrade to signserver 3.5.0. The HSM is quite slow. You mean that activation is still slow as in earlier versions or slower now? > > If I do not call PKCS11CryptoToken activate method, I can not get the > certificate (and the private key) in the keystore so I can not sign anymore. Yes, you need to call activate if the configuration changed. Normally this doesn't happen so often. Do you change configuration of the workers frequently? > > If I call PKCS11CryptoToken activate method, it takes 13 seconds. So > it's quiet long, the getKeystore() method is now very fast. > > In PKCS11CryptoToken.java in Cesecore, we could see that in the activate > method, the keystore is created for each call : > > final KeyStore keyStore = createKeyStore(authCode); > setKeyStore(keyStore); > > Is there a way tu just update the keystore and not create it each time ? > Or another idea to accelerate the process ? I think the issue is that after a configuration change of the worker a new instance is created. This also means a new instance of the PKCS11CryptoToken (both the SignServer one and the CESeCore one it uses internally). This means that we could not cache any KeyStore instance there. We have some open tickets for separating the worker and crypto token which would mean that a worker could be changed and the crypto token stay active: https://jira.primekey.se/browse/DSS-716 Regards, Markus > > Thanks for your help, > > > Antoine > > > Le 19/03/2014 21:35, Tomas Gustavsson a écrit : >> Interesting, thanks for the info. >> >> >> On 19 mars 2014 16:45:23 CET, Luis Maia <lui...@gm...> wrote: >>> On 03/19/2014 09:04 AM, Tomas Gustavsson wrote: >>>> SunPKCS11 always keeps the session open and reuses it. Authentication >>> is >>>> needed in order to create new sessions right, so even if SunPKCS11 >>> would >>>> be able to create new sessions, it would have to store the PKCS#11 >>>> password (i.e. autologin), preventing use of smart cards for PKCS#11 >>>> login etc. >>>> >>>> If the session is broken (network pulled) you usually need to restart >>>> Java in order for SunPKCS11 to create new sessions. >>> Actually if the card invalidates the session with the provider logout() >>> >>> method you do not have to restart JAVA. >>> >>> I've been developing a smartcard library (used in persistent applets >> >from the browser) using the SUNPKCS11 and taking care of issues like >>> terminal disconnection events, card removal, card insertion,etc. >>> I noticed that some middleware for smartcards do not invalidate >>> sessions >>> when the logout method is called, but apart from that (required a few >>> changes in the middleware source code) it works without restarting java >>> >>> for long-lived sessions interacting with the webapp (and multiple cards >>> >>> being removed and inserted, browser refreshed,etc). >>> >>> As i cache the keystore across multiple signatures, when a card is >>> removed if i call the logout method and reinsert a new card it works >>> fine, but i must catch the insertion events and force a logout >>> (SUNPKCS11 is not aware of cards being removed). >>> >>> To implement the card events we used Threads checking with the >>> smartcardio the card presence or absence from the terminal (you can >>> even >>> use blocking methods). >>> It may not be the nicest solution but it works with buggy middleware >>> and >>> since the session will only be reestablished when a card is absent it >>> is >>> fast. >>> >>> >>> Cheers, >>> Luís. >>> >>>> Cheers, >>>> Tomas >>>> >>>> On 2014-03-19 09:33, Markus Kilås wrote: >>>>> On 2014-03-18 15:56, Luis Maia wrote: >>>>>> >>>>>> On Tue, Mar 18, 2014 at 2:35 PM, Markus Kilås <ma...@pr... >>>>>> <mailto:ma...@pr...>> wrote: >>>>>> >>>>>> On 2014-03-18 14:10, Luis Maia wrote: >>>>>> > >>>>>> > Em 18/03/2014 09:10, "Markus Kilås" <ma...@pr... >>>>>> <mailto:ma...@pr...> >>>>>> > <mailto:ma...@pr... <mailto:ma...@pr...>>> >>> escreveu: >>>>>> >> >>>>>> >> On 2014-03-18 09:32, Antoine Louiset wrote: >>>>>> >> > call the getKeystore() method because the private key >>> changes >>>>>> for every >>>>>> >> > signing. >>>>>> > >>>>>> >> Yes, a quick look in the CESeCore code seems to show that >>> after >>>>>> >> activation the keystore is cached. So I believe it is >>> likely that >>>>>> >> upgrading to SignServer 3.5 would resolve this issue for >>> you. >>>>>> > >>>>>> > I am not so sure that caching is a solution, because the >>> keystore >>>>>> would >>>>>> > return the cached private key... >>>>>> >>>>>> In SignServer 3.5 (or if it was 3.4) we have the option to >>> actually >>>>>> cache the PrivateKey instance which gives a different >>> performance as >>>>>> compared to the normal way the getPrivateKey() method obtains >>> the key >>>>>> (from the keystore) so I don't think the PrivateKey is >>> completely cached >>>>>> only because the KeyStore is. >>>>>> >>>>>> Anyway, would it be a problem if the PrivateKey was cached? >>>>>> >>>>>> >>>>>> I have no idea how the underlying implementation should work, but >>> i've >>>>>> seen some EID pkcs#11 devices behaving erratically if the private >>> key is >>>>>> cached. >>>>> I could imagine their would be problem if a cached PrivateKey >>> instance >>>>> tries to use some session not available anymore. Haven't experienced >>>>> this yet when testing with Utimaco and SoftHSM but for sure their >>> could >>>>> be some issues. >>>>> >>>>>> An explanation I've been told (feature not a bug) to throw >>> exception's >>>>>> on cached keys from their developers is due to the strict non >>> caching >>>>>> policy in qualified signatures... >>>>>> This would also mean that a session would remain established and >>> the >>>>>> card would try to reuse the session of a qualified signature and >>> throw >>>>>> an exception. >>>>>> >>>>>> Also, in a library I've been implementing, the pin would be cached >>> for a >>>>>> qualified signature and an exception thrown immediately IF the >>> private >>>>>> key object was reused (which is kind of stupid) instead of >>> destroying >>>>>> the previous session... >>>>>> >>>>>> Notice that I've no idea what should be the "right" implementation, >>> but >>>>>> i've had problems before with maintaining sessions and had to make >>> some >>>>>> workarounds. >>>>> I think the SunPKCS11 implementation often re-uses old sessions, I >>> tried >>>>> some time to have it close all old session but it always seems to >>> have >>>>> at least one left open, but was some time ago. >>>>> >>>>>> Meanwhile using our HSM none of this problems have ever surfaced, >>> but >>>>>> thinking about what Antoine told : >>>>>> >>>>>> " the private key changes for every signing." >>>>>> >>>>>> I keep wondering if caching the private key will maintain the >>> session on >>>>>> the device and will work properly. >>>>> Yes, I was wondering about this statement too and I thought it means >>>>> that he selects a key from the keystore based on which user it is. >>> In >>>>> that case caching the PrivateKey instance would not help, however >>>>> caching the KeyStore (assuming it works with the HSM/PKCS#11 >>>>> implementation) could give better performance as it might not have >>> to >>>>> ask the HSM to enumerate all keys every time. >>>>> >>>>>> >>>>>> I know i'm getting in middle of the discussion here, but i think we >>> will >>>>>> have the same problem soon when we will rotate our keys and it is >>> nice >>>>>> to have a discussion before we hit the problems. >>>>> I think this is a useful discussion. Your input is very welcome. >>>>> >>>>> We are also interested in the topic of how to make it useful for >>> signers >>>>> to have access to multiple key-pairs and certificates. >>>>> >>>>> >>>>> Regards, >>>>> >>>>> Markus >>>>> >>>>>> Cheers, >>>>>> >>>>>> Luis. >>>>>> >>>>>> >>>>>> >>>>>> >>>>> >>> ------------------------------------------------------------------------------ >>>> Learn Graph Databases - Download FREE O'Reilly Book >>>> "Graph Databases" is the definitive new guide to graph databases and >>> their >>>> applications. Written by three acclaimed leaders in the field, >>>> this first edition is now available. Download your free book today! >>>> http://p.sf.net/sfu/13534_NeoTech >>>> _______________________________________________ >>>> SignServer-develop mailing list >>>> Sig...@li... >>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>> >>> ------------------------------------------------------------------------------ >>> Learn Graph Databases - Download FREE O'Reilly Book >>> "Graph Databases" is the definitive new guide to graph databases and >>> their >>> applications. Written by three acclaimed leaders in the field, >>> this first edition is now available. Download your free book today! >>> http://p.sf.net/sfu/13534_NeoTech >>> _______________________________________________ >>> SignServer-develop mailing list >>> Sig...@li... >>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >> >> ------------------------------------------------------------------------------ >> Learn Graph Databases - Download FREE O'Reilly Book >> "Graph Databases" is the definitive new guide to graph databases and their >> applications. Written by three acclaimed leaders in the field, >> this first edition is now available. Download your free book today! >> http://p.sf.net/sfu/13534_NeoTech >> _______________________________________________ >> SignServer-develop mailing list >> Sig...@li... >> https://lists.sourceforge.net/lists/listinfo/signserver-develop > > > > > photo > *Antoine Louiset* > Co-founder Yousign > t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr > > Facebook > <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> > Twitter > <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> > LinkedIn > <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> > YouTube > <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> > Notre dernier article : Découvrez l’API Yousign > <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> > Designed with WiseStamp - > <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get > yours > <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> > > > ------------------------------------------------------------------------------ > Start Your Social Network Today - Download eXo Platform > Build your Enterprise Intranet with eXo Platform Software > Java Based Open Source Intranet - Social, Extensible, Cloud Ready > Get Started Now And Turn Your Intranet Into A Collaboration Platform > http://p.sf.net/sfu/ExoPlatform > > > > _______________________________________________ > SignServer-develop mailing list > Sig...@li... > https://lists.sourceforge.net/lists/listinfo/signserver-develop > -- Kind regards, Markus Kilås PKI Specialist PrimeKey Solutions AB Anderstorpsv. 16 171 54 Solna Sweden Phone: +46 70 424 94 85 Skype: markusatskype Email: mar...@pr... www.primekey.se |
|
From: Antoine L. <ant...@yo...> - 2014-04-27 19:49:04
|
Hi, I upgrade to signserver 3.5.0. The HSM is quite slow. If I do not call PKCS11CryptoToken activate method, I can not get the certificate (and the private key) in the keystore so I can not sign anymore. If I call PKCS11CryptoToken activate method, it takes 13 seconds. So it's quiet long, the getKeystore() method is now very fast. In PKCS11CryptoToken.java in Cesecore, we could see that in the activate method, the keystore is created for each call : final KeyStore keyStore = createKeyStore(authCode); setKeyStore(keyStore); Is there a way tu just update the keystore and not create it each time ? Or another idea to accelerate the process ? Thanks for your help, Antoine Le 19/03/2014 21:35, Tomas Gustavsson a écrit : > Interesting, thanks for the info. > > > On 19 mars 2014 16:45:23 CET, Luis Maia <lui...@gm...> wrote: >> On 03/19/2014 09:04 AM, Tomas Gustavsson wrote: >>> SunPKCS11 always keeps the session open and reuses it. Authentication >> is >>> needed in order to create new sessions right, so even if SunPKCS11 >> would >>> be able to create new sessions, it would have to store the PKCS#11 >>> password (i.e. autologin), preventing use of smart cards for PKCS#11 >>> login etc. >>> >>> If the session is broken (network pulled) you usually need to restart >>> Java in order for SunPKCS11 to create new sessions. >> Actually if the card invalidates the session with the provider logout() >> >> method you do not have to restart JAVA. >> >> I've been developing a smartcard library (used in persistent applets > >from the browser) using the SUNPKCS11 and taking care of issues like >> terminal disconnection events, card removal, card insertion,etc. >> I noticed that some middleware for smartcards do not invalidate >> sessions >> when the logout method is called, but apart from that (required a few >> changes in the middleware source code) it works without restarting java >> >> for long-lived sessions interacting with the webapp (and multiple cards >> >> being removed and inserted, browser refreshed,etc). >> >> As i cache the keystore across multiple signatures, when a card is >> removed if i call the logout method and reinsert a new card it works >> fine, but i must catch the insertion events and force a logout >> (SUNPKCS11 is not aware of cards being removed). >> >> To implement the card events we used Threads checking with the >> smartcardio the card presence or absence from the terminal (you can >> even >> use blocking methods). >> It may not be the nicest solution but it works with buggy middleware >> and >> since the session will only be reestablished when a card is absent it >> is >> fast. >> >> >> Cheers, >> Luís. >> >>> Cheers, >>> Tomas >>> >>> On 2014-03-19 09:33, Markus Kilås wrote: >>>> On 2014-03-18 15:56, Luis Maia wrote: >>>>> >>>>> On Tue, Mar 18, 2014 at 2:35 PM, Markus Kilås <ma...@pr... >>>>> <mailto:ma...@pr...>> wrote: >>>>> >>>>> On 2014-03-18 14:10, Luis Maia wrote: >>>>> > >>>>> > Em 18/03/2014 09:10, "Markus Kilås" <ma...@pr... >>>>> <mailto:ma...@pr...> >>>>> > <mailto:ma...@pr... <mailto:ma...@pr...>>> >> escreveu: >>>>> >> >>>>> >> On 2014-03-18 09:32, Antoine Louiset wrote: >>>>> >> > call the getKeystore() method because the private key >> changes >>>>> for every >>>>> >> > signing. >>>>> > >>>>> >> Yes, a quick look in the CESeCore code seems to show that >> after >>>>> >> activation the keystore is cached. So I believe it is >> likely that >>>>> >> upgrading to SignServer 3.5 would resolve this issue for >> you. >>>>> > >>>>> > I am not so sure that caching is a solution, because the >> keystore >>>>> would >>>>> > return the cached private key... >>>>> >>>>> In SignServer 3.5 (or if it was 3.4) we have the option to >> actually >>>>> cache the PrivateKey instance which gives a different >> performance as >>>>> compared to the normal way the getPrivateKey() method obtains >> the key >>>>> (from the keystore) so I don't think the PrivateKey is >> completely cached >>>>> only because the KeyStore is. >>>>> >>>>> Anyway, would it be a problem if the PrivateKey was cached? >>>>> >>>>> >>>>> I have no idea how the underlying implementation should work, but >> i've >>>>> seen some EID pkcs#11 devices behaving erratically if the private >> key is >>>>> cached. >>>> I could imagine their would be problem if a cached PrivateKey >> instance >>>> tries to use some session not available anymore. Haven't experienced >>>> this yet when testing with Utimaco and SoftHSM but for sure their >> could >>>> be some issues. >>>> >>>>> An explanation I've been told (feature not a bug) to throw >> exception's >>>>> on cached keys from their developers is due to the strict non >> caching >>>>> policy in qualified signatures... >>>>> This would also mean that a session would remain established and >> the >>>>> card would try to reuse the session of a qualified signature and >> throw >>>>> an exception. >>>>> >>>>> Also, in a library I've been implementing, the pin would be cached >> for a >>>>> qualified signature and an exception thrown immediately IF the >> private >>>>> key object was reused (which is kind of stupid) instead of >> destroying >>>>> the previous session... >>>>> >>>>> Notice that I've no idea what should be the "right" implementation, >> but >>>>> i've had problems before with maintaining sessions and had to make >> some >>>>> workarounds. >>>> I think the SunPKCS11 implementation often re-uses old sessions, I >> tried >>>> some time to have it close all old session but it always seems to >> have >>>> at least one left open, but was some time ago. >>>> >>>>> Meanwhile using our HSM none of this problems have ever surfaced, >> but >>>>> thinking about what Antoine told : >>>>> >>>>> " the private key changes for every signing." >>>>> >>>>> I keep wondering if caching the private key will maintain the >> session on >>>>> the device and will work properly. >>>> Yes, I was wondering about this statement too and I thought it means >>>> that he selects a key from the keystore based on which user it is. >> In >>>> that case caching the PrivateKey instance would not help, however >>>> caching the KeyStore (assuming it works with the HSM/PKCS#11 >>>> implementation) could give better performance as it might not have >> to >>>> ask the HSM to enumerate all keys every time. >>>> >>>>> >>>>> I know i'm getting in middle of the discussion here, but i think we >> will >>>>> have the same problem soon when we will rotate our keys and it is >> nice >>>>> to have a discussion before we hit the problems. >>>> I think this is a useful discussion. Your input is very welcome. >>>> >>>> We are also interested in the topic of how to make it useful for >> signers >>>> to have access to multiple key-pairs and certificates. >>>> >>>> >>>> Regards, >>>> >>>> Markus >>>> >>>>> Cheers, >>>>> >>>>> Luis. >>>>> >>>>> >>>>> >>>>> >>>> >> ------------------------------------------------------------------------------ >>> Learn Graph Databases - Download FREE O'Reilly Book >>> "Graph Databases" is the definitive new guide to graph databases and >> their >>> applications. Written by three acclaimed leaders in the field, >>> this first edition is now available. Download your free book today! >>> http://p.sf.net/sfu/13534_NeoTech >>> _______________________________________________ >>> SignServer-develop mailing list >>> Sig...@li... >>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >> >> ------------------------------------------------------------------------------ >> Learn Graph Databases - Download FREE O'Reilly Book >> "Graph Databases" is the definitive new guide to graph databases and >> their >> applications. Written by three acclaimed leaders in the field, >> this first edition is now available. Download your free book today! >> http://p.sf.net/sfu/13534_NeoTech >> _______________________________________________ >> SignServer-develop mailing list >> Sig...@li... >> https://lists.sourceforge.net/lists/listinfo/signserver-develop > > ------------------------------------------------------------------------------ > Learn Graph Databases - Download FREE O'Reilly Book > "Graph Databases" is the definitive new guide to graph databases and their > applications. Written by three acclaimed leaders in the field, > this first edition is now available. Download your free book today! > http://p.sf.net/sfu/13534_NeoTech > _______________________________________________ > SignServer-develop mailing list > Sig...@li... > https://lists.sourceforge.net/lists/listinfo/signserver-develop photo *Antoine Louiset* Co-founder Yousign t: 33 6 76 66 80 34 | e: ant...@yo... | w: yousign.fr Facebook <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.facebook.com%2Fpages%2FYousign%2F172490519609309> Twitter <http://s.wisestamp.com/links?url=https%3A%2F%2Ftwitter.com%2FYousignfr> LinkedIn <http://s.wisestamp.com/links?url=http%3A%2F%2Ffr.linkedin.com%2Fpub%2Fyousign-sas%2F89%2F556%2F9a6> YouTube <http://s.wisestamp.com/links?url=https%3A%2F%2Fwww.youtube.com%2Fchannel%2FUCwIeklozHF4J85SBsbwAT5Q> Notre dernier article : Découvrez l’API Yousign <http://s.wisestamp.com/links?url=http%3A%2F%2Fblog.yousign.fr%2Fdecouvrez-lapi-yousign%2F%3Futm_source%3Drss%26utm_medium%3Drss%26utm_campaign%3Ddecouvrez-lapi-yousign> Designed with WiseStamp - <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10>Get yours <http://s.wisestamp.com/links?url=http%3A%2F%2Fr1.wisestamp.com%2Fr%2Flanding%3Fu%3D72825a891bdebde7%26v%3D3.13.31%26t%3D1398604529412%26promo%3D10%26dest%3Dhttp%253A%252F%252Fwww.wisestamp.com%252Femail-install%253Futm_source%253Dextension%2526utm_medium%253Demail%2526utm_campaign%253Dpromo_10> |
|
From: Markus K. <ma...@pr...> - 2014-04-15 08:39:46
|
On 2014-04-14 20:14, Antoine Louiset wrote: > Hi Markus !! > > You were right... There were additional libraries in > glassfish_home/lib/endorsed/ > > After deploying in a new glassfish 2 server, I compare the directories > and I see that jul-to-slf4j-1.7.0.jar, log4j-over-slf4j-1.7.0.jar, > logback-classic-1.0.7.jar, logback-core-1.0.7.jar, slf4j-api-1.7.0.jar > were present. > > If I delete them, the problem does not appear anymore on the deployment. > Unfortanately, I need these libraries to activate the log in ejbca. > > I'll ask to the community of ejbca. > > Thanks for your help ! Great that you found it! Cheers, Markus PrimeKey > > > Antoine > > > Le 14/04/2014 17:35, Markus Kilås a écrit : >> On 2014-04-14 15:15, Antoine Louiset wrote: >>> Hi, >>> >>> Le 14/04/2014 13:16, Markus Kilås a écrit : >>>> On 2014-04-14 10:42, Antoine Louiset wrote: >>>>> Hi Markus, >>>>> >>>>> Thanks for your answer. >>>>> >>>>> >>>>> Le 14/04/2014 10:13, Markus Kilås a écrit : >>>>>> On 2014-04-12 00:45, Antoine Louiset wrote: >>>>>>> Hi, >>>>>> Hi Antoine, >>>>>> >>>>>>> I continue my tests. It seems to be broken since signerver-3.4.0. It >>>>>>> works with signerver-3.3.0. >>>>>>> >>>>>>> Here is the log for signserver 3.4.0 : http://justpaste.it/f2fh >>>>>>> >>>>>>> It seems to be linked with >>>>>>> org.signserver.server.log.SignServerLog4jDevice >>>>>>> >>>>>>> Did you change something for the log system between these >>>>>>> versions ? Is >>>>>>> there a new library to add in glassfish ? >>>>>> Yes, the log system was changed in 3.4. That version introduced >>>>>> logging >>>>>> using the CESeCore project. >>>>>> >>>>>> No, new libraries should be needed in GlassFish as all >>>>>> dependencies are >>>>>> available in the EAR file. >>>>>> >>>>>> It should be working using GlassFish 2 as well and in fact we have >>>>>> testing on that platform so there must be some difference between our >>>>>> set up and yours. >>>>> Ok, but it works with a new install of glassfish 3. I'll try to check >>>>> the dependencies of Log project. >>>>>> Could you give some details about your setup: >>>>>> - JDK, JDK version >>>>> java version "1.6.0_26" >>>>> Java(TM) SE Runtime Environment (build 1.6.0_26-b03) >>>>> Java HotSpot(TM) Client VM (build 20.1-b02, mixed mode, sharing) >>>> That looks like Oracle JDK, right? It should work however we are >>>> testing >>>> using OpenJDK so maybe that could be the issue. >>>> Could you test with OpenJDK? >>> No changes with OpenJDK. >>>>>> - What configurations do you have under SIGNSERVER_HOME/conf ? >>>>> http://justpaste.it/f39t >>>>>> - Have you moved any JARs manually to GlassFish ? >>>>> mysql-connector-java-5.1.26.jar >>>> That should be fine. >>>> >>>>>> - If you have done any modifications to SignServer, have you >>>>>> tested with >>>>>> an unmodified version as well? >>>>> My tests are done with clean signserver versions, for the moment. >>>> And you don't have deployed any other applications in GlassFish? >>> There was ejbca and another application but I undeploy them to be sure >>> there is no conflict with signserver. Maybe I can update ehcache ? How >>> can I do this ? I found a message in the log : >>> "[net.sf.ehcache.CacheManager@1d3a00] DEBUG >>> net.sf.ehcache.util.UpdateChecker - Update check failed: >>> java.lang.RuntimeException: Can't find resource: >>> /ehcache-version.properties" >>> >> Other applications deployed has been known to cause issues in some >> application servers. I have mostly seen this with JBoss 5 though. >> >>> Do you think it could be a problem ? >> No, I don't think the ehcache thing has anything to do with it. >> >> The only things that comes to mind now is if there are some incompatible >> log4j or maybe hibernate jars put in GlassFish. Maybe start with a >> freshly unzipped GlassFish just to be sure none of the other >> applications put in any jars. >> >> >> Regards, >> Markus >> >>> Cheers, >>> >>> >>> Antoine >>>> >>>> Cheers, >>>> Markus >>>> >>>>>> Regards, >>>>>> Markus >>>>>> >>>>>> PrimeKey Solutions offers a commercial EJBCA & SignServer support >>>>>> subscription and training. Please see www.primekey.se or contact >>>>>> in...@pr... for more information. >>>>>> http://www.primekey.se/Services/Support/ >>>>>> http://www.primekey.se/Services/Training/ >>>>>> >>>>>> >>>>>>> Thanks for your answer, >>>>>>> >>>>>>> >>>>>>> Antoine >>>>>>> >>>>>>> >>>>>>> >>>>>>> Le 08/04/2014 19:17, Antoine Louiset a écrit : >>>>>>>> Hi, >>>>>>>> >>>>>>>> I do not succeed to the deployment. Very strange, I try to disable >>>>>>>> this parameter : |disable-nonportable-jndi-names >>>>>>>> >>>>>>>> But it does not work. >>>>>>>> >>>>>>>> Have you got other ideas ? >>>>>>>> >>>>>>>> Thanks >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Antoine >>>>>>>> | >>>>>>>> >>>>>>>> Le 08/04/2014 10:23, Antoine Louiset a écrit : >>>>>>>>> I try to restart glassfish, server, delete every temporary folder. >>>>>>>> ------------------------------------------------------------------------------ >>>>>>>> >>>>>>>> Put Bad Developers to Shame >>>>>>>> Dominate Development with Jenkins Continuous Integration >>>>>>>> Continuously Automate Build, Test & Deployment >>>>>>>> Start a new project now. Try Jenkins in the cloud. >>>>>>>> http://p.sf.net/sfu/13600_Cloudbees >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> SignServer-develop mailing list >>>>>>>> Sig...@li... >>>>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>> ------------------------------------------------------------------------------ >>>>> >>>>> Learn Graph Databases - Download FREE O'Reilly Book >>>>> "Graph Databases" is the definitive new guide to graph databases >>>>> and their >>>>> applications. Written by three acclaimed leaders in the field, >>>>> this first edition is now available. Download your free book today! >>>>> http://p.sf.net/sfu/NeoTech >>>>> _______________________________________________ >>>>> SignServer-develop mailing list >>>>> Sig...@li... >>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>>> >>>> >> >> > -- Kind regards, Markus Kilås PKI Specialist PrimeKey Solutions AB Anderstorpsv. 16 171 54 Solna Sweden Phone: +46 70 424 94 85 Skype: markusatskype Email: mar...@pr... www.primekey.se |
|
From: Antoine L. <ant...@yo...> - 2014-04-14 18:14:14
|
Hi Markus !! You were right... There were additional libraries in glassfish_home/lib/endorsed/ After deploying in a new glassfish 2 server, I compare the directories and I see that jul-to-slf4j-1.7.0.jar, log4j-over-slf4j-1.7.0.jar, logback-classic-1.0.7.jar, logback-core-1.0.7.jar, slf4j-api-1.7.0.jar were present. If I delete them, the problem does not appear anymore on the deployment. Unfortanately, I need these libraries to activate the log in ejbca. I'll ask to the community of ejbca. Thanks for your help ! Antoine Le 14/04/2014 17:35, Markus Kilås a écrit : > On 2014-04-14 15:15, Antoine Louiset wrote: >> Hi, >> >> Le 14/04/2014 13:16, Markus Kilås a écrit : >>> On 2014-04-14 10:42, Antoine Louiset wrote: >>>> Hi Markus, >>>> >>>> Thanks for your answer. >>>> >>>> >>>> Le 14/04/2014 10:13, Markus Kilås a écrit : >>>>> On 2014-04-12 00:45, Antoine Louiset wrote: >>>>>> Hi, >>>>> Hi Antoine, >>>>> >>>>>> I continue my tests. It seems to be broken since signerver-3.4.0. It >>>>>> works with signerver-3.3.0. >>>>>> >>>>>> Here is the log for signserver 3.4.0 : http://justpaste.it/f2fh >>>>>> >>>>>> It seems to be linked with org.signserver.server.log.SignServerLog4jDevice >>>>>> >>>>>> Did you change something for the log system between these versions ? Is >>>>>> there a new library to add in glassfish ? >>>>> Yes, the log system was changed in 3.4. That version introduced logging >>>>> using the CESeCore project. >>>>> >>>>> No, new libraries should be needed in GlassFish as all dependencies are >>>>> available in the EAR file. >>>>> >>>>> It should be working using GlassFish 2 as well and in fact we have >>>>> testing on that platform so there must be some difference between our >>>>> set up and yours. >>>> Ok, but it works with a new install of glassfish 3. I'll try to check >>>> the dependencies of Log project. >>>>> Could you give some details about your setup: >>>>> - JDK, JDK version >>>> java version "1.6.0_26" >>>> Java(TM) SE Runtime Environment (build 1.6.0_26-b03) >>>> Java HotSpot(TM) Client VM (build 20.1-b02, mixed mode, sharing) >>> That looks like Oracle JDK, right? It should work however we are testing >>> using OpenJDK so maybe that could be the issue. >>> Could you test with OpenJDK? >> No changes with OpenJDK. >>>>> - What configurations do you have under SIGNSERVER_HOME/conf ? >>>> http://justpaste.it/f39t >>>>> - Have you moved any JARs manually to GlassFish ? >>>> mysql-connector-java-5.1.26.jar >>> That should be fine. >>> >>>>> - If you have done any modifications to SignServer, have you tested with >>>>> an unmodified version as well? >>>> My tests are done with clean signserver versions, for the moment. >>> And you don't have deployed any other applications in GlassFish? >> There was ejbca and another application but I undeploy them to be sure >> there is no conflict with signserver. Maybe I can update ehcache ? How >> can I do this ? I found a message in the log : >> "[net.sf.ehcache.CacheManager@1d3a00] DEBUG >> net.sf.ehcache.util.UpdateChecker - Update check failed: >> java.lang.RuntimeException: Can't find resource: >> /ehcache-version.properties" >> > Other applications deployed has been known to cause issues in some > application servers. I have mostly seen this with JBoss 5 though. > >> Do you think it could be a problem ? > No, I don't think the ehcache thing has anything to do with it. > > The only things that comes to mind now is if there are some incompatible > log4j or maybe hibernate jars put in GlassFish. Maybe start with a > freshly unzipped GlassFish just to be sure none of the other > applications put in any jars. > > > Regards, > Markus > >> Cheers, >> >> >> Antoine >>> >>> Cheers, >>> Markus >>> >>>>> Regards, >>>>> Markus >>>>> >>>>> PrimeKey Solutions offers a commercial EJBCA & SignServer support >>>>> subscription and training. Please see www.primekey.se or contact >>>>> in...@pr... for more information. >>>>> http://www.primekey.se/Services/Support/ >>>>> http://www.primekey.se/Services/Training/ >>>>> >>>>> >>>>>> Thanks for your answer, >>>>>> >>>>>> >>>>>> Antoine >>>>>> >>>>>> >>>>>> >>>>>> Le 08/04/2014 19:17, Antoine Louiset a écrit : >>>>>>> Hi, >>>>>>> >>>>>>> I do not succeed to the deployment. Very strange, I try to disable >>>>>>> this parameter : |disable-nonportable-jndi-names >>>>>>> >>>>>>> But it does not work. >>>>>>> >>>>>>> Have you got other ideas ? >>>>>>> >>>>>>> Thanks >>>>>>> >>>>>>> >>>>>>> >>>>>>> Antoine >>>>>>> | >>>>>>> >>>>>>> Le 08/04/2014 10:23, Antoine Louiset a écrit : >>>>>>>> I try to restart glassfish, server, delete every temporary folder. >>>>>>> ------------------------------------------------------------------------------ >>>>>>> Put Bad Developers to Shame >>>>>>> Dominate Development with Jenkins Continuous Integration >>>>>>> Continuously Automate Build, Test & Deployment >>>>>>> Start a new project now. Try Jenkins in the cloud. >>>>>>> http://p.sf.net/sfu/13600_Cloudbees >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> SignServer-develop mailing list >>>>>>> Sig...@li... >>>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>> ------------------------------------------------------------------------------ >>>> Learn Graph Databases - Download FREE O'Reilly Book >>>> "Graph Databases" is the definitive new guide to graph databases and their >>>> applications. Written by three acclaimed leaders in the field, >>>> this first edition is now available. Download your free book today! >>>> http://p.sf.net/sfu/NeoTech >>>> _______________________________________________ >>>> SignServer-develop mailing list >>>> Sig...@li... >>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>> >>> > > |
|
From: Markus K. <ma...@pr...> - 2014-04-14 15:35:18
|
On 2014-04-14 15:15, Antoine Louiset wrote: > Hi, > > Le 14/04/2014 13:16, Markus Kilås a écrit : >> On 2014-04-14 10:42, Antoine Louiset wrote: >>> Hi Markus, >>> >>> Thanks for your answer. >>> >>> >>> Le 14/04/2014 10:13, Markus Kilås a écrit : >>>> On 2014-04-12 00:45, Antoine Louiset wrote: >>>>> Hi, >>>> Hi Antoine, >>>> >>>>> I continue my tests. It seems to be broken since signerver-3.4.0. It >>>>> works with signerver-3.3.0. >>>>> >>>>> Here is the log for signserver 3.4.0 : http://justpaste.it/f2fh >>>>> >>>>> It seems to be linked with org.signserver.server.log.SignServerLog4jDevice >>>>> >>>>> Did you change something for the log system between these versions ? Is >>>>> there a new library to add in glassfish ? >>>> Yes, the log system was changed in 3.4. That version introduced logging >>>> using the CESeCore project. >>>> >>>> No, new libraries should be needed in GlassFish as all dependencies are >>>> available in the EAR file. >>>> >>>> It should be working using GlassFish 2 as well and in fact we have >>>> testing on that platform so there must be some difference between our >>>> set up and yours. >>> Ok, but it works with a new install of glassfish 3. I'll try to check >>> the dependencies of Log project. >>>> Could you give some details about your setup: >>>> - JDK, JDK version >>> java version "1.6.0_26" >>> Java(TM) SE Runtime Environment (build 1.6.0_26-b03) >>> Java HotSpot(TM) Client VM (build 20.1-b02, mixed mode, sharing) >> That looks like Oracle JDK, right? It should work however we are testing >> using OpenJDK so maybe that could be the issue. >> Could you test with OpenJDK? > No changes with OpenJDK. >> >>>> - What configurations do you have under SIGNSERVER_HOME/conf ? >>> http://justpaste.it/f39t >>>> - Have you moved any JARs manually to GlassFish ? >>> mysql-connector-java-5.1.26.jar >> That should be fine. >> >>>> - If you have done any modifications to SignServer, have you tested with >>>> an unmodified version as well? >>> My tests are done with clean signserver versions, for the moment. >> And you don't have deployed any other applications in GlassFish? > There was ejbca and another application but I undeploy them to be sure > there is no conflict with signserver. Maybe I can update ehcache ? How > can I do this ? I found a message in the log : > "[net.sf.ehcache.CacheManager@1d3a00] DEBUG > net.sf.ehcache.util.UpdateChecker - Update check failed: > java.lang.RuntimeException: Can't find resource: > /ehcache-version.properties" > Other applications deployed has been known to cause issues in some application servers. I have mostly seen this with JBoss 5 though. > > Do you think it could be a problem ? No, I don't think the ehcache thing has anything to do with it. The only things that comes to mind now is if there are some incompatible log4j or maybe hibernate jars put in GlassFish. Maybe start with a freshly unzipped GlassFish just to be sure none of the other applications put in any jars. Regards, Markus > > Cheers, > > > Antoine >> >> >> Cheers, >> Markus >> >>>> >>>> Regards, >>>> Markus >>>> >>>> PrimeKey Solutions offers a commercial EJBCA & SignServer support >>>> subscription and training. Please see www.primekey.se or contact >>>> in...@pr... for more information. >>>> http://www.primekey.se/Services/Support/ >>>> http://www.primekey.se/Services/Training/ >>>> >>>> >>>>> Thanks for your answer, >>>>> >>>>> >>>>> Antoine >>>>> >>>>> >>>>> >>>>> Le 08/04/2014 19:17, Antoine Louiset a écrit : >>>>>> Hi, >>>>>> >>>>>> I do not succeed to the deployment. Very strange, I try to disable >>>>>> this parameter : |disable-nonportable-jndi-names >>>>>> >>>>>> But it does not work. >>>>>> >>>>>> Have you got other ideas ? >>>>>> >>>>>> Thanks >>>>>> >>>>>> >>>>>> >>>>>> Antoine >>>>>> | >>>>>> >>>>>> Le 08/04/2014 10:23, Antoine Louiset a écrit : >>>>>>> I try to restart glassfish, server, delete every temporary folder. >>>>>> >>>>>> ------------------------------------------------------------------------------ >>>>>> Put Bad Developers to Shame >>>>>> Dominate Development with Jenkins Continuous Integration >>>>>> Continuously Automate Build, Test & Deployment >>>>>> Start a new project now. Try Jenkins in the cloud. >>>>>> http://p.sf.net/sfu/13600_Cloudbees >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> SignServer-develop mailing list >>>>>> Sig...@li... >>>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>>> >>> >>> ------------------------------------------------------------------------------ >>> Learn Graph Databases - Download FREE O'Reilly Book >>> "Graph Databases" is the definitive new guide to graph databases and their >>> applications. Written by three acclaimed leaders in the field, >>> this first edition is now available. Download your free book today! >>> http://p.sf.net/sfu/NeoTech >>> _______________________________________________ >>> SignServer-develop mailing list >>> Sig...@li... >>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>> >> >> > -- Kind regards, Markus Kilås PKI Specialist PrimeKey Solutions AB Anderstorpsv. 16 171 54 Solna Sweden Phone: +46 70 424 94 85 Skype: markusatskype Email: mar...@pr... www.primekey.se |
|
From: Antoine L. <ant...@yo...> - 2014-04-14 14:33:08
|
Hi, Le 14/04/2014 13:16, Markus Kilås a écrit : > On 2014-04-14 10:42, Antoine Louiset wrote: >> Hi Markus, >> >> Thanks for your answer. >> >> >> Le 14/04/2014 10:13, Markus Kilås a écrit : >>> On 2014-04-12 00:45, Antoine Louiset wrote: >>>> Hi, >>> Hi Antoine, >>> >>>> I continue my tests. It seems to be broken since signerver-3.4.0. It >>>> works with signerver-3.3.0. >>>> >>>> Here is the log for signserver 3.4.0 : http://justpaste.it/f2fh >>>> >>>> It seems to be linked with org.signserver.server.log.SignServerLog4jDevice >>>> >>>> Did you change something for the log system between these versions ? Is >>>> there a new library to add in glassfish ? >>> Yes, the log system was changed in 3.4. That version introduced logging >>> using the CESeCore project. >>> >>> No, new libraries should be needed in GlassFish as all dependencies are >>> available in the EAR file. >>> >>> It should be working using GlassFish 2 as well and in fact we have >>> testing on that platform so there must be some difference between our >>> set up and yours. >> Ok, but it works with a new install of glassfish 3. I'll try to check >> the dependencies of Log project. >>> Could you give some details about your setup: >>> - JDK, JDK version >> java version "1.6.0_26" >> Java(TM) SE Runtime Environment (build 1.6.0_26-b03) >> Java HotSpot(TM) Client VM (build 20.1-b02, mixed mode, sharing) > That looks like Oracle JDK, right? It should work however we are testing > using OpenJDK so maybe that could be the issue. > Could you test with OpenJDK? No changes with OpenJDK. > >>> - What configurations do you have under SIGNSERVER_HOME/conf ? >> http://justpaste.it/f39t >>> - Have you moved any JARs manually to GlassFish ? >> mysql-connector-java-5.1.26.jar > That should be fine. > >>> - If you have done any modifications to SignServer, have you tested with >>> an unmodified version as well? >> My tests are done with clean signserver versions, for the moment. > And you don't have deployed any other applications in GlassFish? There was ejbca and another application but I undeploy them to be sure there is no conflict with signserver. Maybe I can update ehcache ? How can I do this ? I found a message in the log : "[net.sf.ehcache.CacheManager@1d3a00] DEBUG net.sf.ehcache.util.UpdateChecker - Update check failed: java.lang.RuntimeException: Can't find resource: /ehcache-version.properties" Do you think it could be a problem ? Cheers, Antoine > > > Cheers, > Markus > >>> >>> Regards, >>> Markus >>> >>> PrimeKey Solutions offers a commercial EJBCA & SignServer support >>> subscription and training. Please see www.primekey.se or contact >>> in...@pr... for more information. >>> http://www.primekey.se/Services/Support/ >>> http://www.primekey.se/Services/Training/ >>> >>> >>>> Thanks for your answer, >>>> >>>> >>>> Antoine >>>> >>>> >>>> >>>> Le 08/04/2014 19:17, Antoine Louiset a écrit : >>>>> Hi, >>>>> >>>>> I do not succeed to the deployment. Very strange, I try to disable >>>>> this parameter : |disable-nonportable-jndi-names >>>>> >>>>> But it does not work. >>>>> >>>>> Have you got other ideas ? >>>>> >>>>> Thanks >>>>> >>>>> >>>>> >>>>> Antoine >>>>> | >>>>> >>>>> Le 08/04/2014 10:23, Antoine Louiset a écrit : >>>>>> I try to restart glassfish, server, delete every temporary folder. >>>>> >>>>> ------------------------------------------------------------------------------ >>>>> Put Bad Developers to Shame >>>>> Dominate Development with Jenkins Continuous Integration >>>>> Continuously Automate Build, Test & Deployment >>>>> Start a new project now. Try Jenkins in the cloud. >>>>> http://p.sf.net/sfu/13600_Cloudbees >>>>> >>>>> >>>>> _______________________________________________ >>>>> SignServer-develop mailing list >>>>> Sig...@li... >>>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >>> >> >> ------------------------------------------------------------------------------ >> Learn Graph Databases - Download FREE O'Reilly Book >> "Graph Databases" is the definitive new guide to graph databases and their >> applications. Written by three acclaimed leaders in the field, >> this first edition is now available. Download your free book today! >> http://p.sf.net/sfu/NeoTech >> _______________________________________________ >> SignServer-develop mailing list >> Sig...@li... >> https://lists.sourceforge.net/lists/listinfo/signserver-develop >> > > |
|
From: Markus K. <ma...@pr...> - 2014-04-14 11:16:15
|
On 2014-04-14 10:42, Antoine Louiset wrote: > Hi Markus, > > Thanks for your answer. > > > Le 14/04/2014 10:13, Markus Kilås a écrit : >> On 2014-04-12 00:45, Antoine Louiset wrote: >>> Hi, >> Hi Antoine, >> >>> I continue my tests. It seems to be broken since signerver-3.4.0. It >>> works with signerver-3.3.0. >>> >>> Here is the log for signserver 3.4.0 : http://justpaste.it/f2fh >>> >>> It seems to be linked with org.signserver.server.log.SignServerLog4jDevice >>> >>> Did you change something for the log system between these versions ? Is >>> there a new library to add in glassfish ? >> Yes, the log system was changed in 3.4. That version introduced logging >> using the CESeCore project. >> >> No, new libraries should be needed in GlassFish as all dependencies are >> available in the EAR file. >> >> It should be working using GlassFish 2 as well and in fact we have >> testing on that platform so there must be some difference between our >> set up and yours. > Ok, but it works with a new install of glassfish 3. I'll try to check > the dependencies of Log project. >> >> Could you give some details about your setup: >> - JDK, JDK version > java version "1.6.0_26" > Java(TM) SE Runtime Environment (build 1.6.0_26-b03) > Java HotSpot(TM) Client VM (build 20.1-b02, mixed mode, sharing) That looks like Oracle JDK, right? It should work however we are testing using OpenJDK so maybe that could be the issue. Could you test with OpenJDK? >> - What configurations do you have under SIGNSERVER_HOME/conf ? > http://justpaste.it/f39t >> - Have you moved any JARs manually to GlassFish ? > mysql-connector-java-5.1.26.jar That should be fine. >> - If you have done any modifications to SignServer, have you tested with >> an unmodified version as well? > My tests are done with clean signserver versions, for the moment. And you don't have deployed any other applications in GlassFish? Cheers, Markus >> >> >> Regards, >> Markus >> >> PrimeKey Solutions offers a commercial EJBCA & SignServer support >> subscription and training. Please see www.primekey.se or contact >> in...@pr... for more information. >> http://www.primekey.se/Services/Support/ >> http://www.primekey.se/Services/Training/ >> >> >>> Thanks for your answer, >>> >>> >>> Antoine >>> >>> >>> >>> Le 08/04/2014 19:17, Antoine Louiset a écrit : >>>> Hi, >>>> >>>> I do not succeed to the deployment. Very strange, I try to disable >>>> this parameter : |disable-nonportable-jndi-names >>>> >>>> But it does not work. >>>> >>>> Have you got other ideas ? >>>> >>>> Thanks >>>> >>>> >>>> >>>> Antoine >>>> | >>>> >>>> Le 08/04/2014 10:23, Antoine Louiset a écrit : >>>>> I try to restart glassfish, server, delete every temporary folder. >>>> >>>> >>>> ------------------------------------------------------------------------------ >>>> Put Bad Developers to Shame >>>> Dominate Development with Jenkins Continuous Integration >>>> Continuously Automate Build, Test & Deployment >>>> Start a new project now. Try Jenkins in the cloud. >>>> http://p.sf.net/sfu/13600_Cloudbees >>>> >>>> >>>> _______________________________________________ >>>> SignServer-develop mailing list >>>> Sig...@li... >>>> https://lists.sourceforge.net/lists/listinfo/signserver-develop >> >> > > > ------------------------------------------------------------------------------ > Learn Graph Databases - Download FREE O'Reilly Book > "Graph Databases" is the definitive new guide to graph databases and their > applications. Written by three acclaimed leaders in the field, > this first edition is now available. Download your free book today! > http://p.sf.net/sfu/NeoTech > _______________________________________________ > SignServer-develop mailing list > Sig...@li... > https://lists.sourceforge.net/lists/listinfo/signserver-develop > -- Kind regards, Markus Kilås PKI Specialist PrimeKey Solutions AB Anderstorpsv. 16 171 54 Solna Sweden Phone: +46 70 424 94 85 Skype: markusatskype Email: mar...@pr... www.primekey.se |
|
From: Antoine L. <ant...@yo...> - 2014-04-14 11:08:26
|
Hi Markus, Thanks for your answer. Le 14/04/2014 10:13, Markus Kilås a écrit : > On 2014-04-12 00:45, Antoine Louiset wrote: >> Hi, > Hi Antoine, > >> I continue my tests. It seems to be broken since signerver-3.4.0. It >> works with signerver-3.3.0. >> >> Here is the log for signserver 3.4.0 : http://justpaste.it/f2fh >> >> It seems to be linked with org.signserver.server.log.SignServerLog4jDevice >> >> Did you change something for the log system between these versions ? Is >> there a new library to add in glassfish ? > Yes, the log system was changed in 3.4. That version introduced logging > using the CESeCore project. > > No, new libraries should be needed in GlassFish as all dependencies are > available in the EAR file. > > It should be working using GlassFish 2 as well and in fact we have > testing on that platform so there must be some difference between our > set up and yours. Ok, but it works with a new install of glassfish 3. I'll try to check the dependencies of Log project. > > Could you give some details about your setup: > - JDK, JDK version java version "1.6.0_26" Java(TM) SE Runtime Environment (build 1.6.0_26-b03) Java HotSpot(TM) Client VM (build 20.1-b02, mixed mode, sharing) > - What configurations do you have under SIGNSERVER_HOME/conf ? http://justpaste.it/f39t > - Have you moved any JARs manually to GlassFish ? mysql-connector-java-5.1.26.jar > - If you have done any modifications to SignServer, have you tested with > an unmodified version as well? My tests are done with clean signserver versions, for the moment. > > > Regards, > Markus > > PrimeKey Solutions offers a commercial EJBCA & SignServer support > subscription and training. Please see www.primekey.se or contact > in...@pr... for more information. > http://www.primekey.se/Services/Support/ > http://www.primekey.se/Services/Training/ > > >> Thanks for your answer, >> >> >> Antoine >> >> >> >> Le 08/04/2014 19:17, Antoine Louiset a écrit : >>> Hi, >>> >>> I do not succeed to the deployment. Very strange, I try to disable >>> this parameter : |disable-nonportable-jndi-names >>> >>> But it does not work. >>> >>> Have you got other ideas ? >>> >>> Thanks >>> >>> >>> >>> Antoine >>> | >>> >>> Le 08/04/2014 10:23, Antoine Louiset a écrit : >>>> I try to restart glassfish, server, delete every temporary folder. >>> >>> >>> ------------------------------------------------------------------------------ >>> Put Bad Developers to Shame >>> Dominate Development with Jenkins Continuous Integration >>> Continuously Automate Build, Test & Deployment >>> Start a new project now. Try Jenkins in the cloud. >>> http://p.sf.net/sfu/13600_Cloudbees >>> >>> >>> _______________________________________________ >>> SignServer-develop mailing list >>> Sig...@li... >>> https://lists.sourceforge.net/lists/listinfo/signserver-develop > > |
|
From: Markus K. <ma...@pr...> - 2014-04-14 08:13:31
|
On 2014-04-12 00:45, Antoine Louiset wrote: > Hi, Hi Antoine, > > I continue my tests. It seems to be broken since signerver-3.4.0. It > works with signerver-3.3.0. > > Here is the log for signserver 3.4.0 : http://justpaste.it/f2fh > > It seems to be linked with org.signserver.server.log.SignServerLog4jDevice > > Did you change something for the log system between these versions ? Is > there a new library to add in glassfish ? Yes, the log system was changed in 3.4. That version introduced logging using the CESeCore project. No, new libraries should be needed in GlassFish as all dependencies are available in the EAR file. It should be working using GlassFish 2 as well and in fact we have testing on that platform so there must be some difference between our set up and yours. Could you give some details about your setup: - JDK, JDK version - What configurations do you have under SIGNSERVER_HOME/conf ? - Have you moved any JARs manually to GlassFish ? - If you have done any modifications to SignServer, have you tested with an unmodified version as well? Regards, Markus PrimeKey Solutions offers a commercial EJBCA & SignServer support subscription and training. Please see www.primekey.se or contact in...@pr... for more information. http://www.primekey.se/Services/Support/ http://www.primekey.se/Services/Training/ > > Thanks for your answer, > > > Antoine > > > > Le 08/04/2014 19:17, Antoine Louiset a écrit : >> Hi, >> >> I do not succeed to the deployment. Very strange, I try to disable >> this parameter : |disable-nonportable-jndi-names >> >> But it does not work. >> >> Have you got other ideas ? >> >> Thanks >> >> >> >> Antoine >> | >> >> Le 08/04/2014 10:23, Antoine Louiset a écrit : >>> I try to restart glassfish, server, delete every temporary folder. >> >> >> >> ------------------------------------------------------------------------------ >> Put Bad Developers to Shame >> Dominate Development with Jenkins Continuous Integration >> Continuously Automate Build, Test & Deployment >> Start a new project now. Try Jenkins in the cloud. >> http://p.sf.net/sfu/13600_Cloudbees >> >> >> _______________________________________________ >> SignServer-develop mailing list >> Sig...@li... >> https://lists.sourceforge.net/lists/listinfo/signserver-develop > -- Kind regards, Markus Kilås PKI Specialist PrimeKey Solutions AB Anderstorpsv. 16 171 54 Solna Sweden Phone: +46 70 424 94 85 Skype: markusatskype Email: mar...@pr... www.primekey.se |
|
From: Antoine L. <ant...@yo...> - 2014-04-12 01:45:10
|
Hi, I continue my tests. It seems to be broken since signerver-3.4.0. It works with signerver-3.3.0. Here is the log for signserver 3.4.0 : http://justpaste.it/f2fh It seems to be linked with org.signserver.server.log.SignServerLog4jDevice Did you change something for the log system between these versions ? Is there a new library to add in glassfish ? Thanks for your answer, Antoine Le 08/04/2014 19:17, Antoine Louiset a écrit : > Hi, > > I do not succeed to the deployment. Very strange, I try to disable > this parameter : |disable-nonportable-jndi-names > > But it does not work. > > Have you got other ideas ? > > Thanks > > > > Antoine > | > > Le 08/04/2014 10:23, Antoine Louiset a écrit : >> I try to restart glassfish, server, delete every temporary folder. > > > > ------------------------------------------------------------------------------ > Put Bad Developers to Shame > Dominate Development with Jenkins Continuous Integration > Continuously Automate Build, Test & Deployment > Start a new project now. Try Jenkins in the cloud. > http://p.sf.net/sfu/13600_Cloudbees > > > _______________________________________________ > SignServer-develop mailing list > Sig...@li... > https://lists.sourceforge.net/lists/listinfo/signserver-develop |
|
From: Antoine L. <ant...@yo...> - 2014-04-08 17:53:15
|
Hi, I do not succeed to the deployment. Very strange, I try to disable this parameter : |disable-nonportable-jndi-names But it does not work. Have you got other ideas ? Thanks Antoine | Le 08/04/2014 10:23, Antoine Louiset a écrit : > I try to restart glassfish, server, delete every temporary folder. |
|
From: Antoine L. <ant...@yo...> - 2014-04-08 08:32:53
|
Hi Markus, Thanks for your answer. I try to restart glassfish, server, delete every temporary folder. Sometimes, the error is changing but it's never deployed. Have a nice day Antoine Le 08/04/2014 10:14, Markus Kilås a écrit : > Hi Antoine, > > We are running automatic testing on GlassFish 2.1.1 here: > - > https://hudson.primekey.se/view/SignServer%20trunk/job/SIGNSERVER_TRUNK_TEST_NODB_GLASSFISH2/ > - > https://hudson.primekey.se/view/SignServer%20trunk/job/SIGNSERVER_TRUNK_TEST_MYSQL_GLASSFISH2/ > > Both are running fine so it should work. > > Have you tried undeploy and deploy and restarting, possibly clearing > some temporary folder (assuming GlassFish has one, at least jboss has > some issues when this is needed when upgrading) etc? > > > Cheers, > Markus > > On 2014-04-07 22:19, Antoine Louiset wrote: >> Hi, >> >> I have got an error during deployment of signserver 3.5.0 on glassfish >> 2.1.1 : >> >> I put the log here : http://justpaste.it/f0i1 >> >> It seems to work on glassfish 3.1.1 >> >> Is this version of signserver compatible with glassfish 2.1.1 ? >> >> Thanks for your help, >> >> >> Antoine >> >> ------------------------------------------------------------------------------ >> Put Bad Developers to Shame >> Dominate Development with Jenkins Continuous Integration >> Continuously Automate Build, Test & Deployment >> Start a new project now. Try Jenkins in the cloud. >> http://p.sf.net/sfu/13600_Cloudbees >> _______________________________________________ >> SignServer-develop mailing list >> Sig...@li... >> https://lists.sourceforge.net/lists/listinfo/signserver-develop >> > > |
|
From: Markus K. <ma...@pr...> - 2014-04-08 08:14:41
|
Hi Antoine, We are running automatic testing on GlassFish 2.1.1 here: - https://hudson.primekey.se/view/SignServer%20trunk/job/SIGNSERVER_TRUNK_TEST_NODB_GLASSFISH2/ - https://hudson.primekey.se/view/SignServer%20trunk/job/SIGNSERVER_TRUNK_TEST_MYSQL_GLASSFISH2/ Both are running fine so it should work. Have you tried undeploy and deploy and restarting, possibly clearing some temporary folder (assuming GlassFish has one, at least jboss has some issues when this is needed when upgrading) etc? Cheers, Markus On 2014-04-07 22:19, Antoine Louiset wrote: > Hi, > > I have got an error during deployment of signserver 3.5.0 on glassfish > 2.1.1 : > > I put the log here : http://justpaste.it/f0i1 > > It seems to work on glassfish 3.1.1 > > Is this version of signserver compatible with glassfish 2.1.1 ? > > Thanks for your help, > > > Antoine > > ------------------------------------------------------------------------------ > Put Bad Developers to Shame > Dominate Development with Jenkins Continuous Integration > Continuously Automate Build, Test & Deployment > Start a new project now. Try Jenkins in the cloud. > http://p.sf.net/sfu/13600_Cloudbees > _______________________________________________ > SignServer-develop mailing list > Sig...@li... > https://lists.sourceforge.net/lists/listinfo/signserver-develop > -- Kind regards, Markus Kilås PKI Specialist PrimeKey Solutions AB Anderstorpsv. 16 171 54 Solna Sweden Phone: +46 70 424 94 85 Skype: markusatskype Email: mar...@pr... www.primekey.se |
|
From: Antoine L. <ant...@yo...> - 2014-04-07 20:36:42
|
Hi, I have got an error during deployment of signserver 3.5.0 on glassfish 2.1.1 : I put the log here : http://justpaste.it/f0i1 It seems to work on glassfish 3.1.1 Is this version of signserver compatible with glassfish 2.1.1 ? Thanks for your help, Antoine |
|
From: Martin K. <mar...@cy...> - 2014-04-02 11:26:00
|
Hi! Thanks for so guick investigation and reply! Hope to see version 4.0.0 soon :) Cheers! Martin On 02.04.2014 14:21, Markus Kilås wrote: > Hi Martin, > > The problem was fixed in a later version of BouncyCastle. > > I registered https://jira.primekey.se/browse/DSS-777 to eventually > upgrade BC in SignServer. > > > Best regards, > Markus > > |
|
From: Markus K. <ma...@pr...> - 2014-04-02 11:21:43
|
Hi Martin, The problem was fixed in a later version of BouncyCastle. I registered https://jira.primekey.se/browse/DSS-777 to eventually upgrade BC in SignServer. Best regards, Markus PrimeKey Solutions offers a commercial EJBCA & SignServer support subscription and training. Please see www.primekey.se or contact in...@pr... for more information. http://www.primekey.se/Services/Support/ http://www.primekey.se/Services/Training/ On 2014-04-02 11:41, Markus Kilås wrote: > Hi Martin, > > SignServer uses the BouncyCastle library (currently version 1.47) for > constructing the PKCS#10 request. > > Looking at the code of BC, it looks like the attributes are not included > if empty. I have forwarded your question to the bouncycastle mailing > list here: > http://bouncycastle.org/devmailarchive/msg13727.html > > > Best regards, > Markus > > > On 2014-04-02 09:04, Martin Kannel wrote: >> Hi signserver developers! >> >> I'm writing you to notify that Signserver 3.5.0 provide a bit invalid >> certificate request: >> >> In current case the the KeyOne software from Safelayer company does not >> accept it like valid request. >> Here is this in more detail: >> -------- >> In the ASN.1 specification of PKCS#10 : >> >> CertificationRequestInfo ::= SEQUENCE { >> version INTEGER { v1(0) } (v1,...), >> subject Name, >> subjectPKInfo SubjectPublicKeyInfo{{ PKInfoAlgorithms }}, >> attributes [0] Attributes{{ CRIAttributes }} >> } >> >> the attributes field is NOT OPTIONAL, then the DER encoding of this >> structure in case it doesnt' specify any atribute must be a SET OF of >> length 0. >> >> In DER encoding you've sent this SET OF is not present and then is not a >> correct PKCS#10 >> ------ >> >> It seems like "attributes" field is missing? >> >> >> Our components are: >> RHEL6 + Oracle JDK7 + JBOSS 7.1.1 + Signserver 3.5.0 and nCipher netHSM using PKCS11 library >> >> Best regards >> > > > -- Kind regards, Markus Kilås PKI Specialist PrimeKey Solutions AB Anderstorpsv. 16 171 54 Solna Sweden Phone: +46 70 424 94 85 Skype: markusatskype Email: mar...@pr... www.primekey.se |
8 messages has been excluded from this view by a project administrator.
