Hi Michael, Thanks for the answer. However I do not think it is the same issue you faced for a couple of reasons:
1) I am issuing the certificate right after the request is received 2) According to the finger print the pending certificate is not changed When you mention a self signed certificate, what should be the authority that signs the certificate ? According to the netscreen box the pending certificate is signed by my CA even though I haven't issued the certificate yet. Currently, I have two different certificates on the netscreen box: 1) the CA certificate 2) the SCEP certificate It seems that the certificate that is used to communicate with the SCEP interface is the CA certificate. Could that be the issue ? Here is a more complete log message from the netscreen: ## 23:39:33 : scep_rsp_cmd: p_scep_context = 66648e8 ## 23:39:33 : scep_rsp_pkioperation: SCEP_SUCCESS ## 23:39:33 : scep_rsp_pkioperation_success: p_scep_context = 66648e8 <056e4540> ## 23:39:33 : scep_transaction_id: len = 4 72d7f2bc 56946530 e3aecc71 16e1c0dc ## 23:39:33 : X509_new <02082a18>. ## 23:39:33 : PKCS7: envoloped. ## 23:39:33 : lib=33 func=109 reason=111 file=../../pkcs7/pk7_doit.c line=670 ## 23:39:33 : PKI: The device cannot decrypt SCEP data in outer PKCS7 envelope.## 23:39:33 : X509_free <02082a18>. ## 23:39:33 : X509_free: CN=test,CN=test.atriumnetwork.com,CN=rsa-key,CN=0043112003000176,CN=192.168.10.12,OU=AT Network,O=Atrium Network,L= ## 23:39:33 : X509_free real free. ## 23:39:33 : scep_rsp_pkioperation_success: p_scep_context = 66648e8 <056e4540> ## 23:39:33 : scep_rsp_pkioperation: PKCS7 data is not degenerated ## 23:39:33 : X509_free <0208140c>. Thanks for your support, Paul. On Wed, 2004-09-08 at 10:09, Michael Bell wrote: > Hi Paul, > > Paul Charles wrote: > > > I am trying to use OpenCA's SCEP interface with Netscreen NS208 boxes. I > > am using OpenCA 0.9.2-RC6 and ScreenOS 5.0.0r8.0. > > > > The CSR is correctly generated and received by the OpenCA server. > > However after the request is approved and the certificate issued the > > Netscreen box does not retrieve the certificate. > > > > The first error was an incorrect 'Content-type' response from the SCEP > > interface. The file /opt/OpenCA/lib/servers/scep/cmds/scepPKIOperation > > was sending : "Content-type: x-pki-message\n\n" instead of > > "Content-type: application/x-pki-message\n\n". > > I fixed this in CVS. So next snapshots and 0.9.2.0 will include the > correct content type. The interesting question is why do the cisco boxes > work with a wrong content type? > > > Now that I have modified this I get the following error: > > ## 10:10:14 : PKCS7: envoloped. > > ## 10:10:14 : lib=33 func=109 reason=111 file=../../pkcs7/pk7_doit.c > > line=670 > > ## 10:10:14 : PKI: The device cannot decrypt SCEP data in outer PKCS7 > > envelope. > > We had this problem to when we test ns208/ns500 series. The problem with > our box was that OpenCA stores the used self-signed certificate of the > SCPE box. This self-signed cert is used by SCEP boxes to sign their > messages and this cert is used by SCEP responder to encrypt the sent > messages. This means after the first sended request for a certificate > this cert should never be changed. The surprising thing is that this > cert/key can change on a netscreen box. We had this problem if we > request a cert, patch the box and then we try to download the cert > again. After the patching the used key of the box changed! > > NetScreen was never able to explain this. Their only comment was to not > patch the box during SCEP handling - but this we know after our test by > ourselves. > > So it is a good idea to always take a look at key before doing > something. If the key changed then you can start from scratch (only the > cert/key stuff). > > I mean with a key the following: > Concepts & Examples ScreenOS Reference Guide: Vol 5, VPNs > --> Public Key Cryptography > --> Obtaining a local certificate automatically > --> WebUI > --> after the second step NetScreen Screen 5.0 displays a key and > sometimes this key changes which means that all stuff is lost > > Actually I have no NetScreen box to create an appropriate screenshot. So > perhaps you must search a little bit on the webinterface to find the > used key for the SCEP communication. > > Michael ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Openca-Users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/openca-users
