Hi folks I faced the same problem. I didn't find the exact root cause, but when switching back from the latest perl version to the previous, it works. (while installating the latest sources I faced the problem that a package has placed a wrong string.h file in the include pathes-> may not be related to the first problem)
Cheers Ulrich -----Urspr�ngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von [EMAIL PROTECTED] Gesendet: Freitag, 13. Februar 2004 15:25 An: [EMAIL PROTECTED] Betreff: Openca-Users digest, Vol 1 #958 - 10 msgs Send Openca-Users mailing list submissions to [EMAIL PROTECTED] To subscribe or unsubscribe via the World Wide Web, visit https://lists.sourceforge.net/lists/listinfo/openca-users or, via email, send a message with subject or body 'help' to [EMAIL PROTECTED] You can reach the person managing the list at [EMAIL PROTECTED] When replying, please edit your Subject line so it is more specific than "Re: Contents of Openca-Users digest..." Today's Topics: 1. Re: Dataexchange with several RA (Nuno Miguel Neves) 2. Re: Debian + OpenCA 0.9.2 (a bit long) (Alessandro Razeto) 3. Certificate with accents (Nuno Miguel Neves) 4. Re: Debian + OpenCA 0.9.2 (shortened) ([EMAIL PROTECTED]) 5. Re: Requesting a server certificate (Michael Bell) 6. Re: Requesting a server certificate (Nuno Miguel Neves) 7. Re: Debian + OpenCA 0.9.2 (shortened) (Alexei Chetroi) 8. Re: openca 0.9.1.7 blank page when issueing certificate.. (Michael Bell) 9. Re: Question about SSL authentication (Michael Bell) 10. Re: Requesting a server certificate (Michael Bell) --__--__-- Message: 1 Date: Fri, 13 Feb 2004 08:38:25 +0000 From: Nuno Miguel Neves <[EMAIL PROTECTED]> Organization: Fac. Ciencias da Univ. Lisboa To: [EMAIL PROTECTED] Subject: Re: [Openca-Users] Dataexchange with several RA Reply-To: [EMAIL PROTECTED] OK. After thinking, the scenario is roughly this: I have an offline CA machine. I have a "major" RA Server (n.1) Then I have 7 different "minor" RA Servers (n.2 to n.8). I want each "minor" server to have a local database and no knowledge of the others. Than I want "major" RA server to have a local DB, but be able to import and export data to/from the other RA. Mainly, if the RA Operator on RA fails to accept a request, I will "learn" about it at RA n.1 and sign it there. Also, RA Server n.1 exchanges data with the other RA, and then it is the only one to exchange data to the CA. Is this possible? Can you give some help in configuring each one in this setup? Thanks, Michael Bell wrote: > Nuno Miguel Neves wrote: > >> I want to configure 8 different RA/public interfaces with >> openca-0.9.1-7. >> >> I have to givem them different IDs, I know, but something is puzzling >> me. >> >> If I request a certificate in PUB n. 3, How do the other RA know >> about it? > > > There are several different things: > > 1. It is not required that every RA know the request from Pub 3. 2. > Which database organization do you plan? > 2.1. one central online database > 2.2. several parallel online database > 2.3. a hierarchical organization of online databases > 3. The serials cannot conflict. > 4. Parallel databases only know this request if the request is sent > from a higher database down to the lower databases during export. > >> And when I sign a request, how do I transfer that to the CA machine? > > > Via the normal dataexchange. > >> Do I have to configure dataexchange with every RA? > > > Again first you have to describe the database architecture and how do > you want to organize your interfaces. The easiest way is a description > of your plans. > > Michael -- [EMAIL PROTECTED] Dept. Informatica, Fac. Ciencias, |\ | |\ | Tel: +351 21 7500528 Univ. Lisboa, Bloco C5, Campo Grande | \|uno | \|eves Fax: +351 21 7500084 1700 Lisboa, Portugal --__--__-- Message: 2 Date: Fri, 13 Feb 2004 11:38:56 +0100 From: Alessandro Razeto <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Re: [Openca-Users] Debian + OpenCA 0.9.2 (a bit long) Reply-To: [EMAIL PROTECTED] There is a debian packaging system for debian working on sid; I use it sucessfully (I'm the mantainer too :-). It runs on sid because too few packages are present on debian/woody; you can try using it on woody by dowloading the backported packages. You can find some experimental packages at http://www.ge.infn.it/~razeto/openca/ The debian stuff for making packages by your own are at the openca cvs main site on the debian module. On Wed, Feb 11, 2004 at 10:38:59 +0100, [EMAIL PROTECTED] wrote: > hi > > > any debian users here? hope so. > > I'm trying to set up openca-SNAP-20040205 on woody but still no > success. I think redhat and suse users don't have such a problem > because almost every pre-required software (perl modules) is already > installed in their os. looks like mine is missing something... > > here's what I've done: > > debian woody 3.0r2 + all updates > > apt-get install: > unzip (5.50-1woody2) (for cpan) > ncftp (3.1.3-1) (for cpan) > wget (1.8.1-6.1) (for cpan) > gettext (0.10.40-5) > libexpat1 (1.95.2-6) > libexpat1-dev (1.95.2-6) > libgdbmg1-dev (1.7.3-27) > libdb3-dev (3.2.9-16) > libsasl-dev (1.5.27-3) > slapd (2.0.23-6.3) > libldap2-dev (2.0.23-6.3) > > from sources (install procedure as desc. in aprop. INSTALL files): > openssl-0.9.7c + ts-20031112-0_9_7c-patch (--prefix=/usr/local/ssl) > apache-1.3.29 + mm-1.3.0 + mod_ssl-2.8.16-1.3.29 > (--prefix=/usr/local/apache) > > perl -MCPAN -e "shell" (they're not in openca/src/modules): > XML::Parser (2.34) > Text::Iconv (1.2) > Scalar::Util (1.13) > Text::Balanced (1.95) > libnet (1.17) > > and then (based on one of configs/*): > > cd openca-SNAP-20040205 > ./configure --with-engine=no --with-httpd-user=nobody > --with-httpd-group=nogroup --with-openca-user=openca > --with-openca-group=openca --with-httpd-fs-prefix=/usr/local/apache > --with-cgi-url-prefix=/cgi-bin --with-web-host=jargot.nask.waw.pl > --with-ca-organization="NASK" --with-ca-country=PL > --with-ca-locality=Warszawa --with-openssl-prefix=/usr/local/ssl > --enable-db --disable-dbi --enable-rbac --disable-ocspd > --disable-openscep --with-db-name=openca --with-db-user=openca > --with-db-passwd="openca" --with-ldap-port=389 > --with-ldap-root="cn=Manager,o=NASK,c=PL" --with-ldap-root-pwd="****" > --prefix=/usr/local > --with-service-mail-account="[EMAIL PROTECTED]" > --with-language=pl_PL --with-hierarchy-level=ca > > script returns no errors/warnings > > then 'make' which seems to work fine but returns some errors/warnings: > > [...] > make[4]: Entering directory `[...]src/modules' [...] > Note (probably harmless): No library found for -lintl > Note (probably harmless): No library found for -liconv Writing > Makefile for Locale::gettext_xs Writing Makefile for libintl-perl > [...] > make[4]: Entering directory `[...]src/modules' [...] > Checking for OPTIONAL modules > URI ..........................** FAILED ** > Can't locate URI.pm in @INC > The URI::ldap module is needed ONLY IF you want to parse LDAP URLs > ... > [and some more: Digest/MD5.pm IO/Socket/SSL.pm XML/SAX/Base.pm > MIME/Base64.pm Authen/SASL.pm] > > > and finally: make install-online (no errors/warnings). > > after that: > vi config.xml (a bit too long to put it here ;) ./configure_etc.sh > ./openca_start > chown nobody /usr/local/OpenCA/var/tmp/* > > when I point my mozilla at the host I can see 'Index of /' with 4 > elements: ldap, pub, node, ra. > > when I enter pub all I see (after 2 seconds) is Server Information for > OpenCA Server Version 0.9.2 with list of installed modules (and > version > numbers) including: OpenSSL Tools DB Configuration TRIStateCGI REQ X509 > CRL PKCS7. > > when I enter ldap, node or ra all I see is a empty page that keeps on > reloading. the url is http://jargot/cgi-bin/ldap/ldap?redir=1 > > when I look at the source, then I see only 'skeleton' - <body> looks > like this: <body onload="top.location.href='?redir=1'"></body> > > > now, I don't worry about "Can't locate URI.pm in @INC" and so on > because this modules are installed by openca instalator (a part from > XML/SAX/Base.pm - should I be worried by that?). > > is it possible that > "Note (probably harmless): No library found for -lintl > Note (probably harmless): No library found for -liconv" > isn't so harmless? > > > /usr/local/OpenCA/var/session/cookie/* are empty a part from pub where > I see cgisess_***** files which look like this: > > $D = {"_SESSION_EXPIRE_LIST" => {},"_SESSION_REMOTE_ADDR" => > undef,"_SESSION_ATI ME" => "1076430519","valid" => 1,"_SESSION_CTIME" > => "1076430519","_SESSION_ID" => "[numbers here]","_SESSION_ETIME" => > 1200,"name" => undef}; > > > there are files in /usr/local/OpenCA/var/log/xml/time/2004/all/ that > contain something like this [cut a bit]: > > <acl><mode>off</mode></acl> > <login><name></name><type>none</type></login> > <message></message> > > > ... and I run out of ideas what to try next ... > > > > by the way: should in my case folder /usr/local/OpenCA/var/db be owned > by nobody:nogroup ? (./configure [...] --with-db-name=openca > --with-db-user=openca [...]) > > > if anybody 'survived' to the end of this mail and think to know the > solution, please give me a hint. > > > best regards > > > > p.s. why woody and not other distro? in this case it must be woody. > besides, it's quite a popular distro and I can't see why openca > shouldn't compile and run on it. > > -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- > F.Lewenda [ one 'logout' too far... ] > -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- > > > ------------------------------------------------------- > The SF.Net email is sponsored by EclipseCon 2004 > Premiere Conference on Open Tools Development and Integration See the > breadth of Eclipse activity. February 3-5 in Anaheim, CA. > http://www.eclipsecon.org/osdn > _______________________________________________ > Openca-Users mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/openca-users --__--__-- Message: 3 Date: Fri, 13 Feb 2004 10:43:26 +0000 From: Nuno Miguel Neves <[EMAIL PROTECTED]> Organization: Fac. Ciencias da Univ. Lisboa To: [EMAIL PROTECTED] Subject: [Openca-Users] Certificate with accents Reply-To: [EMAIL PROTECTED] Iive issued a certificate whose name had an accent (Ant=F3nio). However, both in Mozilla and Thunderbird, the certificate shows up with=20 an empty name. :( Is there anyway I can fix this, or must I enforce that all names are=20 written without accents? Thanks, --=20 =20 [EMAIL PROTECTED] Dept. Informatica, Fac. Ciencias, |\ | |\ | Tel: +351 21 7500528 Univ. Lisboa, Bloco C5, Campo Gra= nde | \|uno | \|eves Fax: +351 21 7500084 1700 Lisboa, Portugal --__--__-- Message: 4 Date: Fri, 13 Feb 2004 13:59:48 +0100 (MET) From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: [Openca-Users] Debian + OpenCA 0.9.2 (shortened) Reply-To: [EMAIL PROTECTED] On Fri, 13 Feb 2004, Alessandro Razeto wrote: > There is a debian packaging system for debian working on sid; I use it > sucessfully (I'm the mantainer too :-). thanks wow! I don't think I'm brave enough to run sid on production server. well, maybe I should: dist-upgrade woody to sid, setup openca, test it as long as possible/needed and stop even thinking of dist-upgrading (until for example reinstalling openca). I use sid on my workstation and I'm satisfied with it (a little crash caused by broken packages after dist-upgrade at most once a year - but never system crash so not a big deal) but prefere to use woody (poor old, outdated woody...) on production machines. > It runs on sid because too few packages are present on debian/woody; > you can try using it on woody by dowloading the backported packages. > You can find some experimental packages at > http://www.ge.infn.it/~razeto/openca/ so far I downloaded openca*20040204-1_i386.deb I took a closer look inside those debs and... now I see that my woody lacks some perl modules. install proces didn't report any error, so I thought everything was right but it wasn't. I'll try installing those modules manualy and see if it helps. if not... ...how about freebsd? ;) I know about gmake and '-D'. lets say I don't think that would be a great problem to me. should I expect other problems? > The debian stuff for making packages by your own are at the openca cvs > main site on the debian module. thanks. I'll keep it in mind. well, I'm not sure about using deb's (prefere building openca from source) but you really helped me with your e-mail. thank you. best regards franz > On Wed, Feb 11, 2004 at 10:38:59 +0100, [EMAIL PROTECTED] wrote: > > hi > > > > > > any debian users here? hope so. > > > > I'm trying to set up openca-SNAP-20040205 on woody but still no > > success. I think redhat and suse users don't have such a problem > > because almost every pre-required software (perl modules) is already > > installed in their os. looks like mine is missing something... > > > > here's what I've done: > > [...] -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- F.Lewenda [ one 'logout' too far... ] -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- --__--__-- Message: 5 Date: Fri, 13 Feb 2004 14:00:00 +0100 From: Michael Bell <[EMAIL PROTECTED]> Organization: Humboldt-Universitaet zu Berlin To: [EMAIL PROTECTED] Subject: Re: [Openca-Users] Requesting a server certificate Reply-To: [EMAIL PROTECTED] Nuno Miguel Neves wrote: > You can access it and see for yourself. > >> 1. CN in the subject (this is for netscape and mozilla 1.0) >> CN=(pki|ra).fcul.research.ec.org >> >> 2. DNS in the subject alternative name (this is for all standard >> compliant browsers) >> >> DNS:pki.fcul.research.ec.org;DNS:ra.fcul.research.ec.org;email:pki-ad >> [EMAIL PROTECTED] > I've put everything you said (DNS, IP), and still no luck... :( > > Does it matter that pki.fcul.research.ec.org is in fact a CNAME and > not > an A record? No, but if you use Mozilla then you can verify the certificate in your browser (preferences, privacy & security, certificates). If this doesn't work then you have a problem with your CA or the trustsetting of your CA. Michael -- ------------------------------------------------------------------- Michael Bell Email: [EMAIL PROTECTED] ZE Computer- und Medienservice Tel.: +49 (0)30-2093 2482 (Computing Centre) Fax: +49 (0)30-2093 2704 Humboldt-University of Berlin Unter den Linden 6 10099 Berlin Email (private): [EMAIL PROTECTED] Germany http://www.openca.org --__--__-- Message: 6 Date: Fri, 13 Feb 2004 13:23:34 +0000 From: Nuno Miguel Neves <[EMAIL PROTECTED]> Organization: Fac. Ciencias da Univ. Lisboa To: [EMAIL PROTECTED] Subject: Re: [Openca-Users] Requesting a server certificate Reply-To: [EMAIL PROTECTED] Michael Bell wrote: > Nuno Miguel Neves wrote: > >> You can access it and see for yourself. >> >>> 1. CN in the subject (this is for netscape and mozilla 1.0) >>> CN=(pki|ra).fcul.research.ec.org >>> >>> 2. DNS in the subject alternative name (this is for all standard >>> compliant browsers) >>> >>> DNS:pki.fcul.research.ec.org;DNS:ra.fcul.research.ec.org;email:pki-a >>> [EMAIL PROTECTED] >> >> > >> I've put everything you said (DNS, IP), and still no luck... :( >> >> Does it matter that pki.fcul.research.ec.org is in fact a CNAME and >> not an A record? > > > No, but if you use Mozilla then you can verify the certificate in your > browser (preferences, privacy & security, certificates). If this > doesn't work then you have a problem with your CA or the trustsetting > of your CA. > > Michael The certificate verifies OK. It just gives a warning because of the name... Can you please access https://pki.fcul.research.ec.org and verify the certificate? Maybe there is something wrong and I can't figure out what. Thanks, -- [EMAIL PROTECTED] Dept. Informatica, Fac. Ciencias, |\ | |\ | Tel: +351 21 7500528 Univ. Lisboa, Bloco C5, Campo Grande | \|uno | \|eves Fax: +351 21 7500084 1700 Lisboa, Portugal --__--__-- Message: 7 Date: Fri, 13 Feb 2004 15:54:21 +0200 From: Alexei Chetroi <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Re: [Openca-Users] Debian + OpenCA 0.9.2 (shortened) Reply-To: [EMAIL PROTECTED] On Fri, Feb 13, 2004 at 01:59:48PM +0100, [EMAIL PROTECTED] wrote: > Date: Fri, 13 Feb 2004 13:59:48 +0100 (MET) > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > Reply-To: [EMAIL PROTECTED] > Subject: Re: [Openca-Users] Debian + OpenCA 0.9.2 (shortened) > > On Fri, 13 Feb 2004, Alessandro Razeto wrote: > > > There is a debian packaging system for debian working on sid; I use > > it sucessfully (I'm the mantainer too :-). > > thanks > > wow! I don't think I'm brave enough to run sid on production server. > > well, maybe I should: dist-upgrade woody to sid, setup openca, test it > as long as possible/needed and stop even thinking of dist-upgrading > (until for example reinstalling openca). > > I use sid on my workstation and I'm satisfied with it (a little crash > caused by broken packages after dist-upgrade at most once a year - but > never system crash so not a big deal) but prefere to use woody (poor > old, outdated woody...) on production machines. Why won't you recompile necessary packages for Woody? After all there're not so many packages needed, most of them being perl modules. Or you may stick with Sarge, me personally running OpenCA on testing without any problems. Anyway Sarge is going to became stable, I hope very soon :) > > It runs on sid because too few packages are present on debian/woody; > > you can try using it on woody by dowloading the backported packages. > > You can find some experimental packages at > > http://www.ge.infn.it/~razeto/openca/ > > so far I downloaded openca*20040204-1_i386.deb > > I took a closer look inside those debs and... now I see that my woody [snip] --- Alexei Chetroi --__--__-- Message: 8 Date: Fri, 13 Feb 2004 15:09:35 +0100 From: Michael Bell <[EMAIL PROTECTED]> Organization: Humboldt-Universitaet zu Berlin To: [EMAIL PROTECTED] Subject: Re: [Openca-Users] openca 0.9.1.7 blank page when issueing certificate.. Reply-To: [EMAIL PROTECTED] PeP wrote: > hello, > > I'm still stuck in the CA --> Management --> Phase 2 --> issue > certificate for > initial administrator ... (symptom : blank page after entering CA pwd to issue > the certificate request... no certificate has been generated, the request is > still pending...) > > I've reinstalled openssl (0.9.7c) from scratch; I've reinitialized > database, > set correct pwd for db access, complete Init phase 1 successfully, etc. > I can issue the certificate request for the Initial admin without problem > apparently, but when I want to issue the certificate, it give me a blank page > after having entered the CA pwd... > > As I get the same phenomenon using openca v 0.9.1.7 and a older one > like > 0.9.1.4, I figure that the problem reside elsewhere, but I really don't know > where... > > I dander up with that stupid problem... Does there be any errormessage in error_log from Apache? Michael -- ------------------------------------------------------------------- Michael Bell Email: [EMAIL PROTECTED] ZE Computer- und Medienservice Tel.: +49 (0)30-2093 2482 (Computing Centre) Fax: +49 (0)30-2093 2704 Humboldt-University of Berlin Unter den Linden 6 10099 Berlin Email (private): [EMAIL PROTECTED] Germany http://www.openca.org --__--__-- Message: 9 Date: Fri, 13 Feb 2004 15:12:03 +0100 From: Michael Bell <[EMAIL PROTECTED]> Organization: Humboldt-Universitaet zu Berlin To: [EMAIL PROTECTED] Subject: Re: [Openca-Users] Question about SSL authentication Reply-To: [EMAIL PROTECTED] Dalini wrote: >> This doesn't work with Netscape and Mozilla 1.0. The CN must include >> the DNS names as regex. Opera usually doesn't work because they >> implement the crypto stuff in the same way like Netscape - including >> SPKAC :( > > > do they plan to fix this someday? - hmm i have to try with the regex > in > cn, maybe this helps for opera... ;o), than we can add this to the > 'known bugs' hints for those users of opera - at least the 7.11 still > can't handle it > > i'll post if it will be working or not... i hope the regex stuff will > do > the trick for opera too - and they'll get a bug-report - right now - > even if they have may have one already to this subject > > which rfc u referenced to for the subjAltName and DNS for browsers? No idea at the moment. Try "grep -i netscape docs/guide/*/*.xml". Michael -- ------------------------------------------------------------------- Michael Bell Email: [EMAIL PROTECTED] ZE Computer- und Medienservice Tel.: +49 (0)30-2093 2482 (Computing Centre) Fax: +49 (0)30-2093 2704 Humboldt-University of Berlin Unter den Linden 6 10099 Berlin Email (private): [EMAIL PROTECTED] Germany http://www.openca.org --__--__-- Message: 10 Date: Fri, 13 Feb 2004 15:18:38 +0100 From: Michael Bell <[EMAIL PROTECTED]> Organization: Humboldt-Universitaet zu Berlin To: [EMAIL PROTECTED] Subject: Re: [Openca-Users] Requesting a server certificate Reply-To: [EMAIL PROTECTED] Nuno Miguel Neves wrote: > The certificate verifies OK. It just gives a warning because of the > name... > > Can you please access https://pki.fcul.research.ec.org and verify the > certificate? Maybe there is something wrong and I can't figure out what. I have no problems with the page. My Mozilla accepts the certificate without any warnings after I added the CA. Perhaps you tested too long with the same Mozilla. If have issued CAs or certificates with the same subject in the certificate then there are management problems. There problems too if you use a name for a certificate twice. Michael -- ------------------------------------------------------------------- Michael Bell Email: [EMAIL PROTECTED] ZE Computer- und Medienservice Tel.: +49 (0)30-2093 2482 (Computing Centre) Fax: +49 (0)30-2093 2704 Humboldt-University of Berlin Unter den Linden 6 10099 Berlin Email (private): [EMAIL PROTECTED] Germany http://www.openca.org --__--__-- _______________________________________________ Openca-Users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/openca-users End of Openca-Users Digest ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id56&alloc_id438&op=click _______________________________________________ Openca-Users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/openca-users
