[Freeipa-devel] Re: SoftHSM and certmonger
Rob Crittenden via FreeIPA-devel wrote:
Alexander Bokovoy via FreeIPA-devel wrote:
< 0> rsa f9119ce98a883f7f75a72fb32faed0125b1b31a3 my-cert
Thanks for the script, easily reproducible.
I'm not sure why Nalin makes it a requirement to authenticate to the
token to write a certificate. It shouldn't be mandatory AFAIK.
I changed SelfSign to local so that I could have a CA associated with
the cert for validation purposes.
I tested with a build that ifdef'd that bit of code out and a cert is
written but it is written to the sql database and not to the token.
Maybe this is ok. AFAIR NSS is just fine mixing its own database with
the contents of tokens but this isn't expected and of course the trust
flags are ,, because the key isn't in the same place as the cert. It
verifies ok though if I add the local CA to the NSS database.
I have the basics in place so the cert is written to a token but I have
a ton more testing to do.
I also noticed that the issuer, subject and expiration dates aren't
being set in at least the local ca. I need to determine if that is due
to my patches or another bug.
rob