OK, after reading another series of posts, I found the problem. It
has nothing to do with a bad OpenSSL version (at least in my case),
nothing to do with using the wrong certificates to enroll with, this
error is caused because the openca-scep program is not built as part
of either make install-online, or make install-offline.
Installing scep involves both doing make install-online, make install-
offline and also going into the src/scep directory, and doing ./
configure (with all toplevel openca configure options), make, make
install.
Strangely enough, all the rest of the SCEP infrastructure including
the web interface gets built and installed as part of the normal
process, so it would seem this is clearly an error with the build
scripts/Makefiles.
Personally, i would like to see this as a FAQ entry, since it has
taken me about 3-4 days of mailing list trawling following red
herrings and banging my head against the wall trying to fix this
immensely frustrating issue. - I may have the paths wrong in this FAQ
suggestion since I am not in front of my OpenCA box at the moment, so
if someone more familiar with the project than I could check it that
would be cool.
e.g.
FAQ:
Q: I am having problems with SCEP. I cant see any errors in the logs
and my SCEP clients seem to fail partway through the certificate
enrollment process
A: First, ensure you are not running OpenSSL 0.9.7d - this is known-
broken with SCEP.
Then, ensure the openca-scep script is present in $OPENCADIR/bin/. If
it is not present, CA and RA certificates will be issued without
problems, but enrolling certificates from a Cisco device will fail
with a non-specific error, and testing with sscep will result in an
empty response to certificate request being returned with an
accompanying segfault.
To build the openca-scep script you need to cd into the src/scep
directory, and issue a ./configure (along with any params you passed
the toplevel configure script - extractable from the toplevel
config.log), make, make install. This should give you a working SCEP
server setup.
-Pete
HI there,
I am trying to get SCEP working for Cisco clients and an ASA
router, but
am running into an error enrolling a certificate.
I have got my RA cert, my un-passphrased RA keyfile and my dummy
password
in the configuration, compiled OpenCA with openssl 0.9.7e3 (as shipped
with Ubuntu Hoary), Can retrieve the CA and RA certificates as
expected,
but when i try and enroll a cert with sscep, i get:
./sscep: PKCS#7 payload size 586 bytes
./sscep: printing PEM fomatted PKCS#7
-----BEGIN PKCS7-----
-----END PKCS7-----
Segmentation fault
The Cisco VPN client just gives me an 'Error 42 cannot construct
certificate request'.
There is no trace of openssl-0.9.7d on my system, openssl version
reports:
OpenSSL 0.9.7e 25 Oct 2004
Does OpenCA's SCEP support not work with any version of OpenSSL
later than
0.9.7c? And if so, it would probably be helpful to add this
information to
an FAQ or something.
Thanks for any help you can offer,
-Pete
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through
log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD
SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Openca-Users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openca-users
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Openca-Users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openca-users
