Re: [CentOS] Simple OCSP server ??

2017-09-05 Thread Robert Moskowitz
Alice, Have you found an OCSP responder? I am writing an Internet Draft for using openssl to set up a simple ECDSA pki: https://datatracker.ietf.org/doc/draft-moskowitz-ecdsa-pki/ It is PAST time that the default for certs is RSA, and rather move on to ECDSA. EdDSA is almost ready to

Re: [CentOS] Simple OCSP server ??

2017-04-16 Thread Robert Moskowitz
What about the pki package that comes with Centos? pki-server and pki-ca? On 04/16/2017 11:54 AM, Alice Wonder wrote: Oh I don't know, their github works. However it seems that it isn't able to deal with more than one ocsp signing key. On 04/16/2017 08:40 AM, Robert Moskowitz wrote: On

Re: [CentOS] Simple OCSP server ??

2017-04-16 Thread Alice Wonder
Oh I don't know, their github works. However it seems that it isn't able to deal with more than one ocsp signing key. On 04/16/2017 08:40 AM, Robert Moskowitz wrote: On 04/14/2017 10:41 PM, Alice Wonder wrote: https://www.openca.org/ might fit my needs. their Centos repo does not exist,

Re: [CentOS] Simple OCSP server ??

2017-04-16 Thread Robert Moskowitz
On 04/14/2017 10:41 PM, Alice Wonder wrote: https://www.openca.org/ might fit my needs. their Centos repo does not exist, it seems? On 04/14/2017 06:29 PM, Alice Wonder wrote: Hello list, I'm contemplating running my own CA to implement the new proposed ISP for validation of S/MIME

Re: [CentOS] Simple OCSP server ??

2017-04-14 Thread Alice Wonder
https://www.openca.org/ might fit my needs. On 04/14/2017 06:29 PM, Alice Wonder wrote: Hello list, I'm contemplating running my own CA to implement the new proposed ISP for validation of S/MIME certificates via DANE. I already use self-signed for my MX servers (with 3 1 1 dane records on TCP

[CentOS] Simple OCSP server ??

2017-04-14 Thread Alice Wonder
Hello list, I'm contemplating running my own CA to implement the new proposed ISP for validation of S/MIME certificates via DANE. I already use self-signed for my MX servers (with 3 1 1 dane records on TCP port 25) but I don't want to use self-signed for S/MIME for user specific x.509 certs