Configure Dogtag Certificate System

this section shows you how to install dogtag certificate system on fedora linux 28 the example demonstrates the installation of a ca subsystem by using a self signed ca signing certificate, with the certificates and their corresponding keys securely stored in {{ch}} install the dogtag packages install the dogtag packages by using the following command sudo dnf install pki ca pki kra 389 ds base create the directory server instance the dogtag ca and kra subsystems use a 389 directory server as an internal database perform the following steps to create the directory server instance for the dogtag internal db run the following command to log in as the root user sudo su to set a fqdn (fully qualified domain name) as the hostname for your fedora 28 system, edit the /etc/hosts file as follows 127 0 0 1 pki example com \ 1 pki example com you can set any valid fqdn, not just pki example com you must also run the following command to update the hostname in the /etc/hostname file hostnamectl set hostname pki example com create a directory for storing the 389 directory server configuration file mkdir p /etc/389 ds create a configuration file named setup inf in the /etc/389 ds directory with the \[general] and \[slapd] sections configured as follows \[general] fullmachinename= pki example com suitespotuserid= nobody suitespotgroup= nobody \[slapd] serverport= 389 serveridentifier= pki tomcat suffix= dc=example,dc=com rootdn= cn=directory manager rootdnpwd= password run the directory server installation script, selecting the defaults or customizing as desired setup ds pl silent file=/etc/389 ds/setup inf create a subsystem instance the next step in the process is to run the pkispawn script to create and configure a subsystem instance the pkispawn command line tool installs and configures a new pki instance it eliminates the need for separate installation and configuration steps, and may be run either interactively, as a batch process, or a combination of both (batch process with prompts for passwords) refer to the pkispawn man page for detailed information about all supported options by running man pkispawn the pkispawn command reads in its default installation and configuration values from a plain text configuration file ( /etc/pki/default cfg ) this file consists of name=value pairs divided into \[default] , \[tomcat] , \[ca] , \[kra] , \[ocsp] , \[tks] , and \[tps] sections we strongly recommend that you read the full documentation to understand the purpose of every parameter in the /etc/pki/default cfg file this enables you to customize your pki environment to your specific needs to spawn a subsystem that uses an hsm, dogtag recommends creating an override configuration file that contains only the parameters necessary for using the {{ch}} as its token any parameter settings in this file override the parameter settings in the default cfg file you can spawn any of the various dogtag pki subsystems (ca, kra, ocsp, tks, tps) to use the {{ch}} , but this integration guide focuses on the certificate authority (ca) for brevity perform the following tasks prepare an override configuration file with the required hsm parameters run the pkispawn utility view the keys and certificates that dogtag created in the {{ch}} import the ca administrator pkcs #12 file into the browser access the new ca subsystem in the browser prepare a configuration file perform the following steps to prepare an override configuration file with the required hsm parameters create the override configuration file for the ca subsystem sudo vim ca cfg the following is an example override file that can be used for spawning a ca subsystem with the {{ch}} all values contained within angle brackets need to be set to a specific value by the user all other values should be set exactly as shown the pki ds password value must match the password set for the directory manager when 389 directory server was installed the pki token password value must be set to the {{ch}} identity password configured inside the \<crypto opr pass> tag in the fxpkcs11 cfg file \[default] \########################## \# provide hsm parameters # \########################## pki hsm enable=true pki hsm libfile=\<path to fxpkcs11 libfile> pki hsm modulename=fxpkcs11 pki token name=futurex pki token password=\<hsm identity password> \######################################## \# provide pki specific hsm token names # \######################################## pki audit signing token=futurex pki ssl server token=futurex pki subsystem token=futurex \################################## \# provide pki specific passwords # \################################## pki admin password=\<pki admin password> pki client pkcs12 password=\<pki client pkcs12 password> pki ds password=\<pki ds password> \##################################### \# provide non ca specific passwords # \##################################### pki client database password=\<pki client database password> \[ca] \####################################### \# provide ca specific hsm token names # \####################################### pki ca signing token=futurex pki ocsp signing token=futurex after you have finished editing, save the file run the pkispawn utility perform the following steps to run the pkispawn utility in a terminal, run the following command to deploy a ca subsystem using the {{ch}} the full path to the ca cfg file is required if you are not running the command from the directory where the ca cfg file is saved sudo pkispawn f ca cfg s ca vvv you will most likely see a warning message about manually adding a module while p11 kit is enabled you can disregard this warning and press enter to continue if the deployment is successful, an installation summary similar to the following will be presented after the command completes ========================================================================== installation summary \========================================================================== administrator's username caadmin administrator's pkcs #12 file /root/ dogtag/pki tomcat/ca admin cert p12 to check the status of the subsystem systemctl status pki tomcatd\@pki tomcat service to restart the subsystem systemctl restart pki tomcatd\@pki tomcat service the url for the subsystem is https //pki example com 8443/ca pki instances will be enabled upon system boot \========================================================================== if the pkispawn command fails, you need to run the following command to delete the subsystem instance that was only partially created before re attempting to run pkispawn sudo pkidestroy s ca i pki tomcat view the keys and certificates to view the keys and certificates that dogtag created on the {{ch}} , use the pkcs11manager utility packaged with the {{futurex}} pkcs #11 module perform the following steps in a terminal, navigate to the directory where the fxpkcs11 module is installed ( /usr/local/bin/fxpkcs11 ) and run pkcs11manager by using the following command /pkcs11manager this presents the following main menu main menu 1\ print library/token info 2\ login 3\ logout 4\ generate key 5\ find objects 6\ modify objects 7\ delete objects 8\ generate random data 9\ sign data 10\ verify data 11\ wrap key 12\ unwrap key 13\ import public key 0\ exit enter 1 to find all objects, and select the enter key enter 2 to log in, and select the enter key enter the password of the identity that is defined in the fxpkcs11 configuration file, and select the enter key if successful, you receive confirmation that you are logged in enter 5 to find objects, and select the enter key enter 1 to find all objects, and select the enter key information prints for all keys and certificates that the connecting identity has access to dogtag pki creates 15 objects in {{ch}} for a ca subsystem deployment import the pkcs #12 file the following steps use a firefox web browser the steps might vary when using a different browser, but the overall process is the same perform the following steps to import the ca administrator pkcs #12 file into the browser in firefox, go to preferences > privacy & security > certificates and select \[ view certificates ] under the your certificates tab, select \[ import ] to import the ca administrator pkcs #12 file (for example, ca admin cert p12 ) when it prompts for a password, enter the value that was configured for the pki client pkcs12 password define in the ca cfg file the location of the ca admin cert p12 file is in the installation summary for the ca subsystem deployment access the ca subsystem perform the following steps to access the new ca subsystem in the browser access the dogtag certificate system subsystem console by going to the following url https // 8443/pki/ui/ when submitting certificate signing requests (csrs) in dogtag certificate system, you must use both the common name and uid fields if you submit a request with only the common name field completed, the request fails, and you receive an error stating that the subject name does not match this completes the instructions for the dogtag certificate system integration with the futurex {{ch}} all ca subsystem keys are secured within {{ch}} and available to the dogtag certificate system when you need to use them