dogtagpki

#1485 [DOC] Unable to install Subsystems with user defined serial and Request Numbers
Closed: Duplicate Opened by mrniranjan.

Closed: Duplicate
Reopen Issue

RHCS 8.1 had the possibility of Installing subsystems with bigInteger support
because after running pkicreate one could edit CS.cfg to specify the Integers
to be used for requests and Serial Numbers and then continue with installation
so that subsystem certificates and requests could use below integers.

<snip>
dbs.beginRequestNumber=1001001007001
dbs.endRequestNumber=11001001007000
dbs.requestIncrement=10000000000000
dbs.requestLowWaterMark=2000000000000
dbs.requestCloneTransferNumber=10000
dbs.requestDN=ou=ca, ou=requests
dbs.requestRangeDN=ou=requests, ou=ranges
dbs.beginSerialNumber=1001001007001
dbs.endSerialNumber=11001001007000
dbs.serialIncrement=10000000000000
dbs.serialLowWaterMark=2000000000000
dbs.serialCloneTransferNumber=10000
dbs.serialDN=ou=certificateRepository, ou=ca
dbs.serialRangeDN=ou=certificateRepository, ou=ranges
dbs.beginReplicaNumber=1
dbs.endReplicaNumber=100
dbs.replicaIncrement=100
dbs.replicaLowWaterMark=20
dbs.replicaCloneTransferNumber=5
dbs.replicaDN=ou=replica
dbs.replicaRangeDN=ou=replica, ou=ranges
dbs.ldap=internaldb
dbs.newSchemaEntryAdded=true
</snip>

With new pkispawn utility there is no option to specify the Integers to be used
for subsystem certificates.

Request to provide this facility with pkispawn.

Per impromptu 10.2.6 meeting of 7/17/2015: 10.3

To mimic this behavior using pkispawn (e. g. - for the default case), run the following:

(1) "Install" the server without "Configuring" it:

    # pkispawn -s CA -f /root/pki/ca-install.cfg -vvv
      where '/root/pki/ca-install.cfg' contains:
          [DEFAULT]
          pki_admin_password=<password>
          pki_client_pkcs12_password=<password>
          pki_ds_password=<password>
          pki_skip_configuration=True

(2) Stop the server:

    # systemctl stop pki-tomcatd@pki-tomcat.service

(3) Change the desired name-value pairs in '/etc/pki/pki-tomcat/ca/CS.cfg':

    <snip>
    dbs.beginRequestNumber=1001001007001
    dbs.endRequestNumber=11001001007000
    dbs.requestIncrement=10000000000000
    dbs.requestLowWaterMark=2000000000000
    dbs.requestCloneTransferNumber=10000
    dbs.requestDN=ou=ca, ou=requests
    dbs.requestRangeDN=ou=requests, ou=ranges
    dbs.beginSerialNumber=1001001007001
    dbs.endSerialNumber=11001001007000
    dbs.serialIncrement=10000000000000
    dbs.serialLowWaterMark=2000000000000
    dbs.serialCloneTransferNumber=10000
    dbs.serialDN=ou=certificateRepository, ou=ca
    dbs.serialRangeDN=ou=certificateRepository, ou=ranges
    dbs.beginReplicaNumber=1
    dbs.endReplicaNumber=100
    dbs.replicaIncrement=100
    dbs.replicaLowWaterMark=20
    dbs.replicaCloneTransferNumber=5
    dbs.replicaDN=ou=replica
    dbs.replicaRangeDN=ou=replica, ou=ranges
    dbs.ldap=internaldb
    dbs.newSchemaEntryAdded=true
    </snip>

(4) Start the server:

    # systemctl start pki-tomcatd@pki-tomcat.service

(5) "Configure" the server without "Re-installing" it:

    # pkispawn -s CA -f /root/pki/ca-configure.cfg -vvv
      where '/root/pki/ca-configure.cfg' contains:
          [DEFAULT]
          pki_admin_password=<password>
          pki_client_pkcs12_password=<password>
          pki_ds_password=<password>
          pki_skip_installation=True

I would suggest that this bug be converted to a documentation bug such that these
instructions make their way into official Documentation as an example, be placed on
the Wiki as an example, or be placed into the appropriate man page as an example.

In the CS/DS Meeting of 03/14/2016, it was determined that the procedure documented in comment #3 above, should be documented in the RHCS 9.1 Administration Guide.

Closing upstream TRAC ticket, as this is purely a downstream task.

Metadata Update from @mrniranjan:
- Issue assigned to vakwetu
- Issue set to the milestone: 10.3.1

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2044

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Normal
defect
Infrastructure
QE
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.