Hi Paul,
Paul Charles wrote:
I am trying to use OpenCA's SCEP interface with Netscreen NS208 boxes. I am using OpenCA 0.9.2-RC6 and ScreenOS 5.0.0r8.0.
The CSR is correctly generated and received by the OpenCA server. However after the request is approved and the certificate issued the Netscreen box does not retrieve the certificate.
The first error was an incorrect 'Content-type' response from the SCEP interface. The file /opt/OpenCA/lib/servers/scep/cmds/scepPKIOperation was sending : "Content-type: x-pki-message\n\n" instead of "Content-type: application/x-pki-message\n\n".
I fixed this in CVS. So next snapshots and 0.9.2.0 will include the correct content type. The interesting question is why do the cisco boxes work with a wrong content type?
Now that I have modified this I get the following error: ## 10:10:14 : PKCS7: envoloped. ## 10:10:14 : lib=33 func=109 reason=111 file=../../pkcs7/pk7_doit.c line=670 ## 10:10:14 : PKI: The device cannot decrypt SCEP data in outer PKCS7 envelope.
We had this problem to when we test ns208/ns500 series. The problem with our box was that OpenCA stores the used self-signed certificate of the SCPE box. This self-signed cert is used by SCEP boxes to sign their messages and this cert is used by SCEP responder to encrypt the sent messages. This means after the first sended request for a certificate this cert should never be changed. The surprising thing is that this cert/key can change on a netscreen box. We had this problem if we request a cert, patch the box and then we try to download the cert again. After the patching the used key of the box changed!
NetScreen was never able to explain this. Their only comment was to not patch the box during SCEP handling - but this we know after our test by ourselves.
So it is a good idea to always take a look at key before doing something. If the key changed then you can start from scratch (only the cert/key stuff).
I mean with a key the following:
Concepts & Examples ScreenOS Reference Guide: Vol 5, VPNs
--> Public Key Cryptography
--> Obtaining a local certificate automatically
--> WebUI
--> after the second step NetScreen Screen 5.0 displays a key and sometimes this key changes which means that all stuff is lost
Actually I have no NetScreen box to create an appropriate screenshot. So perhaps you must search a little bit on the webinterface to find the used key for the SCEP communication.
Michael -- ------------------------------------------------------------------- Michael Bell Email: [EMAIL PROTECTED] ZE Computer- und Medienservice Tel.: +49 (0)30-2093 2482 (Computing Centre) Fax: +49 (0)30-2093 2704 Humboldt-University of Berlin Unter den Linden 6 10099 Berlin Email (private): [EMAIL PROTECTED] Germany http://www.openca.org
------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Openca-Users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/openca-users
