Test of Develop Issuing CA alias
Closed this issue · 11 comments
@gotthardp, not sure if you received notifications to #111 testing output? I attached observations to that thread which is closed.
Testing was partially successful, where the difficult stuff works:-) , but the i'm experiencing a variable truncation issue.
Regards
Nigel
Thanks, Nigel! I saw it, but I forgot to respond, sorry.
Hi again, it should be fixed now.
Concerning the other issue your mentioned, GetCACaps: it is meant to be automatic. The capabilities are queried before every request to automatically select the right options to use. Right now it is used only to decide between GET and POST, but it could be extended also to select the algorithms, etc.
@gotthardp Just to confirm fix was successful. I just retested on CentOS 8 the GET method transaction (GetCACaps, GetCA, PKIOperation{PKCSReq, CertPoll}). For your knowledge, these requests are against the same [ VeriSign | Symantec | DigiCert ] OnSite Processing Centre, indicated on the README.md.
I will investigate both the extension of this legacy capabiilty, and the emerging next generation SCEP capability.
Thanks
Nigel
@gotthardp, WRT comment of GetCACaps could be used to select algorithms, this is something I do today. Essentially, I write the response to file, and parse the values into system variables. These variables are used on the sscep command line.
I hope this is useful information.
Regards
Nigel
And you obtain the GetCACaps values via some other tool, or you made a patch, or how?
You are correct, some other tool. either:
- wget ${SCEP_RESPONDER}"?operations=GetCACaps""&message="${IssuingCA_Identifier} -O ${CACAPS}, or
- wget ${SCEP_RESPONDER}"?operations=GetCACaps" -O ${CACAPS}
I then pull the values from the output file.
BTW, the GetCACaps operation works, it is just "misdocumented" it uses the "getcaps" name instead of "getcacaps".
user@server:~/projects/sscep$ ./sscep getcaps -u http://192.168.1.1/scep
./sscep: scep capabilities: DES3, POSTPKIOperation, Renewal, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
Thanks.
I checked the same yesterday, with similar confirmation. I also need to to talk to our platform operators regards what happens backend regards the impact of the missing "...message=${IssuingCA_Identifier}..."?
I do understand the SSCEP implementation reflects the the RFC8894.
Well, the SSCEP implementation has been made by a lot of people through the years, so it may not always reflect the latest RFC. When it does not reflect the RFC 8894, or when its operation is causing some troubles, please open an issue for that.