#885 TPS Rewrite: Enrollment: Token Side Key Generation
Closed: Fixed Opened by jmagne.

This feature involves talking to the applet to generate the private key for the encryption cert. A more advanced feature is to generate this key on the server side and escrow it. This feature will be in another ticket.


Moving to 10.2 (May) per request of ticket owner.

New proposed milestone: 10.2 (May)

Have made local progress on this one.

The following is working locally using tpsclient first.

  1. Can read in and parse existing token data on the card.

  2. Provided code that reads in all the many config params needed to enroll a certificate.

  3. Created convenience classes to hold the many params that we are currently passing around in long param lists.

  4. Have tested the code that asks the client to generate a key on the token, which then returns the public key blob.

  5. Now we need to duplicate the functionality from the old tps that parses this public key blob. When that is done ,we can start making remote calls to the ca to enroll certificates.

Ticket well under way. Will be first task in June.

Latest commit results in the above results available in master.

Moved from Dogtag 10.2 (June) --> Dogtag 10.2 (July).

Patch reviewed and checked in. We can now enroll the configured number of certificates on a token, utilizing token size keygen for all certs.

The resulting token has been tested with BobR's "smartcard" utility to be able to perform the usual signing and encryption operations.

Closing.

Metadata Update from @jmagne:
- Issue assigned to jmagne
- Issue set to the milestone: 10.2 - 07/14 (July)

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1452

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.

Metadata